Use the jarsigner command
This section provides examples of how you use the jarsigner command to sign a JAR file and verify the signature of a signed JAR file.
Before performing the following steps to sign a Java ARchive (JAR) file (example.jar, in this case), ensure that the keys stored on the that you need for signing are accessible:
Run the following command to go to the $JAVA_HOME/bin directory:
Run the following keytool command to list all of the keys on the that the configured identity has access to:
The response should be similar to the following:
Change directory to the same directory that contains the example.jar file.
After you confirm the keys needed for code signing are accessible and change to the directory with the example.jar file, run the following command to sign a JAR file by using the -stored keys:
The last field in the preceding jarsigner command, JarsignerDemo, must match the alias you specified in the keytool -importcert command in the previous section.
Refer to the Oracle documentation about other jarsigner command flags such as -tsa and -tsacert.
If the signing succeeds, the response includes a confirmation message that says: jar signed.
The jarsigner command in the previous section returned a signed JAR file, demo_ signed.jar. Now, run the following command to verify the signature of that file:
If the verification succeeds, the response includes a confirmation message: jar verified.