I was reading the man page for the jarsigner
tool that ships with the JDK. This line surprised me:
A verification is still considered successful if none of the files that were in the JAR file when the signature was generated have been changed since then, which is the case if the hashes in the non-header sections of the .SF file equal the hashes of the corresponding sections in the manifest file.
This doesn't make sense to me. Couldn't an attacker hide malicious code in an already-signed jar file?
Update: Here is an example of this scenario. It looks like jarsigner will flag the jar as containing extra files, but still considers it verified.
=> jar -cf twelfthnight.jar TwelfthNight.html
=> keytool -genkey -alias signFiles -keystore examplestore
=> jarsigner -keystore examplestore twelfthnight.jar signFiles
Enter Passphrase for keystore:
jar signed.
Warning:
The signer certificate will expire within six months.
No -tsa or -tsacert is provided and this jar is not timestamped. Without a timestamp, users may not be able to validate this jar after the signer certificate's expiration date (2016-10-16) or after any future revocation date.
=> jarsigner -verify twelfthnight.jar
jar verified.
Warning:
This jar contains entries whose certificate chain is not validated.
This jar contains entries whose signer certificate will expire within six months.
This jar contains signatures that does not include a timestamp. Without a timestamp, users may not be able to validate this jar after the signer certificate's expiration date (2016-10-16) or after any future revocation date.
Re-run with the -verbose and -certs options for more details.
=> jar uf twelfthnight.jar Hamlet.html
=> jarsigner -verify twelfthnight.jar
jar verified.
Warning:
This jar contains unsigned entries which have not been integrity-checked.
This jar contains entries whose certificate chain is not validated.
This jar contains entries whose signer certificate will expire within six months.
This jar contains signatures that does not include a timestamp. Without a timestamp, users may not be able to validate this jar after the signer certificate's expiration date (2016-10-16) or after any future revocation date.
Re-run with the -verbose and -certs options for more details.