changeset 6927:82f3d3f4e5df

Merge
author coffeys
date Thu, 23 Jan 2014 19:23:55 +0000
parents c03c270734ae 7d4a292dda4f
children 3d3f975635eb
files
diffstat 193 files changed, 9496 insertions(+), 9306 deletions(-) [+]
line wrap: on
line diff
--- a/.hgtags	Fri Jan 10 15:10:25 2014 +0000
+++ b/.hgtags	Thu Jan 23 19:23:55 2014 +0000
@@ -365,4 +365,25 @@
 c5ca4daec23b5e7f99ac8d684f5016ff8bfebbb0 jdk7u45-b18
 4797f984f6c93c433aa797e9b2d8f904cf083f96 jdk7u45-b30
 8c343a783777b8728cb819938f387db0acf7f3ac jdk7u45-b31
+402d54c7d8ce95f3945cc3d698e528e4adec7b9b jdk7u45-b33
+34e8f9f26ae612ebac36357eecbe70ea20e0233c jdk7u45-b34
+3c9a6d9eafd31be44b0ade0354e60f5078b417a4 jdk7u51-b00
+d76613074ff357d0664b97b4aaf99fbb65dcec47 jdk7u51-b01
+fb057871f094ebe4906ad6856326768b01a62c45 jdk7u51-b02
+6b3c195c73b051ee3c4a0ac44f050011414ab08b jdk7u51-b03
+96431826ae3a927008c56aeefa1397a33bda3e70 jdk7u51-b04
+8ee582bb96a6b79311d55a7170f42844af77a269 jdk7u51-b05
+594ae80153afaeced6acedff5d37f889a9821690 jdk7u51-b06
+7b84e6514c297861d85ed9457b2260805311d9e8 jdk7u51-b07
+40fca6b57cd81114d4aace3d0469e20274f015c3 jdk7u51-b08
+33ae35eeb5a4c04a4d05351ff68d4021e4cad752 jdk7u51-b09
+4a6e31d94b29c7115235824a6e317289819bb00f jdk7u51-b10
+f0425ecbbb0ca9d8c87c250c19e8f9524b38833d jdk7u51-b11
+f5eee4f1d5b4a1e19febc9c26c863ae853ed6d2e jdk7u51-b12
+d19a89fdfb9b959b8638441d9d396685d6c7ab7b jdk7u51-b13
+ef58b2b9a9a1e1a42b0139b57816a160c4681371 jdk7u51-b30
+5bca0d0969b13b1d9b8caba3cce8293a98d68318 jdk7u51-b31
 db5a29c812ee25c34ce9cd97de6e0dae284a4e34 jdk7u60-b00
+def34c4a798678c424786a8f0d0508e90185958d jdk7u60-b01
+ff67c89658525e8903fb870861ed3645befd6bc5 jdk7u60-b02
+b1bcc999a8f1b4b4452b59c6636153bb0154cf5a jdk7u60-b03
--- a/make/common/Release.gmk	Fri Jan 10 15:10:25 2014 +0000
+++ b/make/common/Release.gmk	Thu Jan 23 19:23:55 2014 +0000
@@ -836,10 +836,6 @@
 	    $(BOOT_JAVA_CMD) -jar $(BUILDMETAINDEX_JARFILE) \
 		-o meta-index *.jar
 	@$(CD) $(JRE_IMAGE_DIR)/lib/ext && $(java-vm-cleanup)
-ifeq ($(PLATFORM), macosx)
-	@#install jobjc, apple mac only
-	$(CP) $(OUTPUTDIR)/JObjC.build/JObjC.jar $(JRE_IMAGE_DIR)/lib/JObjC.jar
-endif # macosx
 ifeq ($(PLATFORM), windows)
 	@# Remove certain *.lib files
 	$(CD) $(JRE_IMAGE_DIR)/lib && \
--- a/make/java/Makefile	Fri Jan 10 15:10:25 2014 +0000
+++ b/make/java/Makefile	Thu Jan 23 19:23:55 2014 +0000
@@ -57,10 +57,6 @@
   SUBDIRS += jexec
 endif # PLATFORM
 
-ifeq ($(PLATFORM), macosx)
-  SUBDIRS += jobjc
-endif # PLATFORM
-
 include $(BUILDDIR)/common/Subdirs.gmk
 
 all build clean clobber::
--- a/make/java/net/FILES_c.gmk	Fri Jan 10 15:10:25 2014 +0000
+++ b/make/java/net/FILES_c.gmk	Thu Jan 23 19:23:55 2014 +0000
@@ -24,20 +24,21 @@
 #
 
 FILES_c = \
-	DatagramPacket.c \
-	InetAddress.c \
-	Inet4Address.c \
-	Inet6Address.c \
-	NetworkInterface.c \
-	InetAddressImplFactory.c \
-	Inet4AddressImpl.c \
-	Inet6AddressImpl.c \
-	SocketInputStream.c \
-	SocketOutputStream.c \
-	net_util.c \
-	net_util_md.c \
-	ResolverConfigurationImpl.c \
-	DefaultProxySelector.c
+        DatagramPacket.c \
+        InetAddress.c \
+        Inet4Address.c \
+        Inet6Address.c \
+        NetworkInterface.c \
+        InetAddressImplFactory.c \
+        Inet4AddressImpl.c \
+        Inet6AddressImpl.c \
+        SocketInputStream.c \
+        SocketOutputStream.c \
+        net_util.c \
+        net_util_md.c \
+        portconfig.c \
+        ResolverConfigurationImpl.c \
+        DefaultProxySelector.c
 
 ifeq ($(PLATFORM), linux)
     FILES_c += linux_close.c
--- a/make/java/net/Makefile	Fri Jan 10 15:10:25 2014 +0000
+++ b/make/java/net/Makefile	Thu Jan 23 19:23:55 2014 +0000
@@ -83,7 +83,8 @@
 # Find platform specific native code
 #
 vpath %.c $(PLATFORM_SRC)/native/sun/net/dns $(PLATFORM_SRC)/native/sun/net/www/protocol/http/ntlm \
-    $(PLATFORM_SRC)/native/sun/net/sdp $(PLATFORM_SRC)/native/sun/net/spi
+    $(PLATFORM_SRC)/native/sun/net/sdp $(PLATFORM_SRC)/native/sun/net/spi \
+    $(PLATFORM_SRC)/native/sun/net
 
 #
 # Include rules
--- a/make/java/net/mapfile-vers	Fri Jan 10 15:10:25 2014 +0000
+++ b/make/java/net/mapfile-vers	Thu Jan 23 19:23:55 2014 +0000
@@ -26,84 +26,86 @@
 # Define public interface.
 
 SUNWprivate_1.1 {
-	global:
-		JNI_OnLoad;
-		Java_java_net_PlainSocketImpl_socketListen;
-		Java_java_net_PlainDatagramSocketImpl_getTTL;
-		Java_java_net_PlainDatagramSocketImpl_init;
-		Java_java_net_SocketOutputStream_socketWrite0;
-		Java_java_net_PlainSocketImpl_socketCreate;
-		Java_java_net_PlainSocketImpl_socketAvailable;
-		Java_java_net_PlainDatagramSocketImpl_join;
-		Java_java_net_PlainDatagramSocketImpl_socketGetOption;
-		Java_java_net_InetAddress_init;
-		Java_java_net_Inet4Address_init;
-		Java_java_net_Inet6Address_init;
-		Java_java_net_PlainDatagramSocketImpl_setTTL;
-		Java_java_net_PlainDatagramSocketImpl_socketSetOption;
-		Java_java_net_PlainDatagramSocketImpl_bind0;
-		Java_java_net_PlainSocketImpl_socketAccept;
-		Java_java_net_DatagramPacket_init;
-		Java_java_net_PlainDatagramSocketImpl_leave;
-		Java_java_net_SocketInputStream_socketRead0;
-		Java_java_net_InetAddressImplFactory_isIPv6Supported;
-		Java_java_net_Inet4AddressImpl_getLocalHostName;
-		Java_java_net_Inet4AddressImpl_lookupAllHostAddr;
-		Java_java_net_Inet4AddressImpl_getHostByAddr;
-		Java_java_net_Inet4AddressImpl_isReachable0;
-		Java_java_net_Inet6AddressImpl_getLocalHostName;
-		Java_java_net_Inet6AddressImpl_lookupAllHostAddr;
-		Java_java_net_Inet6AddressImpl_getHostByAddr;
-		Java_java_net_Inet6AddressImpl_isReachable0;
-		Java_java_net_NetworkInterface_init;
-		Java_java_net_NetworkInterface_getByName0;
-		Java_java_net_NetworkInterface_getByIndex0;
-		Java_java_net_NetworkInterface_getByInetAddress0;
-		Java_java_net_NetworkInterface_getAll;
-		Java_java_net_NetworkInterface_isUp0;
-		Java_java_net_NetworkInterface_isLoopback0;
-		Java_java_net_NetworkInterface_isP2P0;
-		Java_java_net_NetworkInterface_supportsMulticast0;
-		Java_java_net_NetworkInterface_getMacAddr0;
-		Java_java_net_NetworkInterface_getMTU0;
-		Java_java_net_PlainDatagramSocketImpl_send;
-		Java_java_net_PlainSocketImpl_socketClose0;
-		Java_java_net_SocketOutputStream_init;
-		Java_java_net_PlainDatagramSocketImpl_peek;
-		Java_java_net_PlainDatagramSocketImpl_peekData;
-		Java_java_net_PlainSocketImpl_socketSetOption;
-		Java_java_net_PlainSocketImpl_socketSendUrgentData;
-		Java_java_net_PlainDatagramSocketImpl_datagramSocketCreate;
-		Java_java_net_PlainSocketImpl_socketGetOption;
-		Java_java_net_PlainDatagramSocketImpl_receive0;
-		Java_java_net_PlainDatagramSocketImpl_connect0;
-		Java_java_net_PlainDatagramSocketImpl_disconnect0;
-		Java_java_net_PlainDatagramSocketImpl_datagramSocketClose;
-		Java_java_net_PlainSocketImpl_initProto;
-		Java_java_net_PlainSocketImpl_socketBind;
-		Java_java_net_PlainSocketImpl_socketShutdown;
-		Java_java_net_SocketInputStream_init;
-		Java_java_net_PlainSocketImpl_socketConnect;
-		Java_java_net_PlainDatagramSocketImpl_getTimeToLive;
-		Java_java_net_PlainDatagramSocketImpl_setTimeToLive;
-		Java_sun_net_dns_ResolverConfigurationImpl_localDomain0;
-		Java_sun_net_dns_ResolverConfigurationImpl_fallbackDomain0;
-		Java_sun_net_sdp_SdpSupport_convert0;
-		Java_sun_net_sdp_SdpSupport_create0;
-		Java_sun_net_spi_DefaultProxySelector_init;
-		Java_sun_net_spi_DefaultProxySelector_getSystemProxy;
-		NET_AllocSockaddr;
-		NET_SockaddrToInetAddress;
+        global:
+                JNI_OnLoad;
+                Java_java_net_PlainSocketImpl_socketListen;
+                Java_java_net_PlainDatagramSocketImpl_getTTL;
+                Java_java_net_PlainDatagramSocketImpl_init;
+                Java_java_net_SocketOutputStream_socketWrite0;
+                Java_java_net_PlainSocketImpl_socketCreate;
+                Java_java_net_PlainSocketImpl_socketAvailable;
+                Java_java_net_PlainDatagramSocketImpl_join;
+                Java_java_net_PlainDatagramSocketImpl_socketGetOption;
+                Java_java_net_InetAddress_init;
+                Java_java_net_Inet4Address_init;
+                Java_java_net_Inet6Address_init;
+                Java_java_net_PlainDatagramSocketImpl_setTTL;
+                Java_java_net_PlainDatagramSocketImpl_socketSetOption;
+                Java_java_net_PlainDatagramSocketImpl_bind0;
+                Java_java_net_PlainSocketImpl_socketAccept;
+                Java_java_net_DatagramPacket_init;
+                Java_java_net_PlainDatagramSocketImpl_leave;
+                Java_java_net_SocketInputStream_socketRead0;
+                Java_java_net_InetAddressImplFactory_isIPv6Supported;
+                Java_java_net_Inet4AddressImpl_getLocalHostName;
+                Java_java_net_Inet4AddressImpl_lookupAllHostAddr;
+                Java_java_net_Inet4AddressImpl_getHostByAddr;
+                Java_java_net_Inet4AddressImpl_isReachable0;
+                Java_java_net_Inet6AddressImpl_getLocalHostName;
+                Java_java_net_Inet6AddressImpl_lookupAllHostAddr;
+                Java_java_net_Inet6AddressImpl_getHostByAddr;
+                Java_java_net_Inet6AddressImpl_isReachable0;
+                Java_java_net_NetworkInterface_init;
+                Java_java_net_NetworkInterface_getByName0;
+                Java_java_net_NetworkInterface_getByIndex0;
+                Java_java_net_NetworkInterface_getByInetAddress0;
+                Java_java_net_NetworkInterface_getAll;
+                Java_java_net_NetworkInterface_isUp0;
+                Java_java_net_NetworkInterface_isLoopback0;
+                Java_java_net_NetworkInterface_isP2P0;
+                Java_java_net_NetworkInterface_supportsMulticast0;
+                Java_java_net_NetworkInterface_getMacAddr0;
+                Java_java_net_NetworkInterface_getMTU0;
+                Java_java_net_PlainDatagramSocketImpl_send;
+                Java_java_net_PlainSocketImpl_socketClose0;
+                Java_java_net_SocketOutputStream_init;
+                Java_java_net_PlainDatagramSocketImpl_peek;
+                Java_java_net_PlainDatagramSocketImpl_peekData;
+                Java_java_net_PlainSocketImpl_socketSetOption;
+                Java_java_net_PlainSocketImpl_socketSendUrgentData;
+                Java_java_net_PlainDatagramSocketImpl_datagramSocketCreate;
+                Java_java_net_PlainSocketImpl_socketGetOption;
+                Java_java_net_PlainDatagramSocketImpl_receive0;
+                Java_java_net_PlainDatagramSocketImpl_connect0;
+                Java_java_net_PlainDatagramSocketImpl_disconnect0;
+                Java_java_net_PlainDatagramSocketImpl_datagramSocketClose;
+                Java_java_net_PlainSocketImpl_initProto;
+                Java_java_net_PlainSocketImpl_socketBind;
+                Java_java_net_PlainSocketImpl_socketShutdown;
+                Java_java_net_SocketInputStream_init;
+                Java_java_net_PlainSocketImpl_socketConnect;
+                Java_java_net_PlainDatagramSocketImpl_getTimeToLive;
+                Java_java_net_PlainDatagramSocketImpl_setTimeToLive;
+                Java_sun_net_PortConfig_getLower0;
+                Java_sun_net_PortConfig_getUpper0;
+                Java_sun_net_dns_ResolverConfigurationImpl_localDomain0;
+                Java_sun_net_dns_ResolverConfigurationImpl_fallbackDomain0;
+                Java_sun_net_sdp_SdpSupport_convert0;
+                Java_sun_net_sdp_SdpSupport_create0;
+                Java_sun_net_spi_DefaultProxySelector_init;
+                Java_sun_net_spi_DefaultProxySelector_getSystemProxy;
+                NET_AllocSockaddr;
+                NET_SockaddrToInetAddress;
                 NET_SockaddrEqualsInetAddress;
-		NET_InetAddressToSockaddr;
-		NET_GetPortFromSockaddr;
-		NET_SetSockOpt;
-		NET_GetSockOpt;
-		NET_Bind;
-		NET_MapSocketOption;
-		NET_Wait;
+                NET_InetAddressToSockaddr;
+                NET_GetPortFromSockaddr;
+                NET_SetSockOpt;
+                NET_GetSockOpt;
+                NET_Bind;
+                NET_MapSocketOption;
+                NET_Wait;
                 ipv6_available;
 
-	local:
-		*;
+        local:
+                *;
 };
--- a/make/sun/javazic/tzdata/VERSION	Fri Jan 10 15:10:25 2014 +0000
+++ b/make/sun/javazic/tzdata/VERSION	Thu Jan 23 19:23:55 2014 +0000
@@ -21,4 +21,4 @@
 # or visit www.oracle.com if you need additional information or have any
 # questions.
 #
-tzdata2013g
+tzdata2013h
--- a/make/sun/javazic/tzdata/africa	Fri Jan 10 15:10:25 2014 +0000
+++ b/make/sun/javazic/tzdata/africa	Thu Jan 23 19:23:55 2014 +0000
@@ -474,6 +474,14 @@
 # (either two days before them or five days after them, so as to fall on
 # lastFri instead of lastSun).
 
+# From Even Scharning (2013-10-25):
+# The scheduled end of DST in Libya on Friday, October 25, 2013 was
+# cancelled yesterday....
+# http://www.libyaherald.com/2013/10/24/correction-no-time-change-tomorrow/
+#
+# From Paul Eggert (2013-10-25):
+# For now, assume they're reverting to the pre-2012 rules of permanent UTC+2.
+
 # Rule	NAME	FROM	TO	TYPE	IN	ON	AT	SAVE	LETTER/S
 Rule	Libya	1951	only	-	Oct	14	2:00	1:00	S
 Rule	Libya	1952	only	-	Jan	 1	0:00	0	-
@@ -490,19 +498,21 @@
 Rule	Libya	1987	1989	-	Oct	 1	0:00	0	-
 Rule	Libya	1997	only	-	Apr	 4	0:00	1:00	S
 Rule	Libya	1997	only	-	Oct	 4	0:00	0	-
-Rule	Libya	2013	max	-	Mar	lastFri	1:00	1:00	S
-Rule	Libya	2013	max	-	Oct	lastFri	2:00	0	-
+Rule	Libya	2013	only	-	Mar	lastFri	1:00	1:00	S
+Rule	Libya	2013	only	-	Oct	lastFri	2:00	0	-
+
+# The 1996 and 1997 entries are from Shanks & Pottenger;
+# the IATA SSIM data contain some obvious errors.
 # Zone	NAME		GMTOFF	RULES	FORMAT	[UNTIL]
 Zone	Africa/Tripoli	0:52:44 -	LMT	1920
 			1:00	Libya	CE%sT	1959
 			2:00	-	EET	1982
 			1:00	Libya	CE%sT	1990 May  4
-# The 1996 and 1997 entries are from Shanks & Pottenger;
-# the IATA SSIM data contain some obvious errors.
 			2:00	-	EET	1996 Sep 30
 			1:00	Libya	CE%sT	1997 Oct  4
 			2:00	-	EET	2012 Nov 10 2:00
-			1:00	Libya	CE%sT
+			1:00	Libya	CE%sT	2013 Oct 25 2:00
+			2:00	-	EET
 
 # Madagascar
 # Zone	NAME		GMTOFF	RULES	FORMAT	[UNTIL]
@@ -707,15 +717,6 @@
 # http://www.google.com/search?hl=en&q=Conseil+de+gouvernement+maroc+heure+avance&btnG=Search
 # </a>
 
-# From Alex Krivenyshev (2008-05-09):
-# Is Western Sahara (part which administrated by Morocco) going to follow
-# Morocco DST changes?  Any information?  What about other part of
-# Western Sahara - under administration of POLISARIO Front (also named
-# SADR Saharawi Arab Democratic Republic)?
-
-# From Arthur David Olson (2008-05-09):
-# XXX--guess that it is only Morocco for now; guess only 2008 for now.
-
 # From Steffen Thorsen (2008-08-27):
 # Morocco will change the clocks back on the midnight between August 31
 # and September 1. They originally planned to observe DST to near the end
@@ -891,13 +892,13 @@
 # Another source (specifying the time for start and end in the decree):
 # http://www.lemag.ma/Heure-d-ete-au-Maroc-jusqu-au-27-octobre_a75620.html
 
-# From Paul Eggert (2013-09-30):
+# From Paul Eggert (2013-10-03):
 # To estimate what the Moroccan government will do in future years,
-# transition dates for 2014 through 2037 were determined by running
+# transition dates for 2014 through 2038 were determined by running
 # the following program under GNU Emacs 24.3:
 #
 # (let ((islamic-year 1435))
-#   (while (< islamic-year 1460)
+#   (while (< islamic-year 1461)
 #     (let ((a
 #	     (calendar-gregorian-from-absolute
 #	      (calendar-islamic-to-absolute (list 9 1 islamic-year))))
@@ -917,9 +918,13 @@
 # all transitions removed for 2026-2035, where the estimated Ramadan
 # falls entirely outside daylight-saving time; and with fall-back
 # transitions removed for 2036-2037, where the normal fall-back
-# date falls during the estimated Ramadan.  Problems continue after that,
-# but 32-bit time_t values roll around in 2038 so for now do not worry
-# about dates after 2037.
+# date falls during the estimated Ramadan.  Normally, the table would
+# stop after 2037 because 32-bit time_t values roll around early in 2038,
+# but that would imply a prediction of perpetual DST after March 2038
+# due to the year-2037 glitches.  So, this table instead stops after
+# 2038, the first non-glitchy year after the 32-bit rollover.
+# An advantage of stopping after 2038 is that it lets zic guess
+# TZ='WET0WEST,M3.5.0,M10.5.0/3' for time stamps far in the future.
 
 # RULE	NAME	FROM	TO	TYPE	IN	ON	AT	SAVE	LETTER/S
 
@@ -987,10 +992,21 @@
 			 0:00	Morocco	WE%sT	1984 Mar 16
 			 1:00	-	CET	1986
 			 0:00	Morocco	WE%sT
+
 # Western Sahara
+#
+# From Gwillim Law (2013-10-22):
+# A correspondent who is usually well informed about time zone matters
+# ... says that Western Sahara observes daylight saving time, just as
+# Morocco does.
+#
+# From Paul Eggert (2013-10-23):
+# Assume that this has been true since Western Sahara switched to GMT,
+# since most of it was then controlled by Morocco.
+
 Zone Africa/El_Aaiun	-0:52:48 -	LMT	1934 Jan
 			-1:00	-	WAT	1976 Apr 14
-			 0:00	-	WET
+			 0:00	Morocco	WE%sT
 
 # Mozambique
 # Zone	NAME		GMTOFF	RULES	FORMAT	[UNTIL]
--- a/make/sun/javazic/tzdata/southamerica	Fri Jan 10 15:10:25 2014 +0000
+++ b/make/sun/javazic/tzdata/southamerica	Thu Jan 23 19:23:55 2014 +0000
@@ -874,6 +874,15 @@
 # We will keep this article updated when this is confirmed:
 # http://www.timeanddate.com/news/time/brazil-starts-dst-2013.html
 
+# From Steffen Thorsen (2013-10-17):
+# http://www.timeanddate.com/news/time/acre-amazonas-change-time-zone.html
+# Senator Jorge Viana announced that Acre will change time zone on November 10.
+# He did not specify the time of the change, nor if western parts of Amazonas
+# will change as well.
+#
+# From Paul Eggert (2013-10-17):
+# For now, assume western Amazonas will change as well.
+
 # Rule	NAME	FROM	TO	TYPE	IN	ON	AT	SAVE	LETTER/S
 # Decree <a href="http://pcdsh01.on.br/HV20466.htm">20,466</a> (1931-10-01)
 # Decree <a href="http://pcdsh01.on.br/HV21896.htm">21,896</a> (1932-01-10)
@@ -1162,13 +1171,15 @@
 			-5:00	-	ACT	1993 Sep 28
 			-5:00	Brazil	AC%sT	1994 Sep 22
 			-5:00	-	ACT	2008 Jun 24 00:00
-			-4:00	-	AMT
+			-4:00	-	AMT	2013 Nov 10
+			-5:00	-	ACT
 #
 # Acre (AC)
 Zone America/Rio_Branco	-4:31:12 -	LMT	1914
 			-5:00	Brazil	AC%sT	1988 Sep 12
 			-5:00	-	ACT	2008 Jun 24 00:00
-			-4:00	-	AMT
+			-4:00	-	AMT	2013 Nov 10
+			-5:00	-	ACT
 
 # Chile
 
--- a/make/sun/net/FILES_java.gmk	Fri Jan 10 15:10:25 2014 +0000
+++ b/make/sun/net/FILES_java.gmk	Thu Jan 23 19:23:55 2014 +0000
@@ -24,122 +24,123 @@
 #
 
 FILES_java = \
-	sun/net/InetAddressCachePolicy.java \
-	sun/net/URLCanonicalizer.java \
-	sun/net/NetworkClient.java \
-	sun/net/NetworkServer.java \
-	sun/net/ProgressMonitor.java \
-	sun/net/ProgressSource.java \
-	sun/net/ProgressEvent.java \
-	sun/net/ProgressListener.java \
-	sun/net/ProgressMeteringPolicy.java \
-	sun/net/SocksProxy.java \
-	sun/net/ResourceManager.java \
-	sun/net/TelnetInputStream.java \
-	sun/net/TelnetOutputStream.java \
-	sun/net/TelnetProtocolException.java \
-	sun/net/TransferProtocolClient.java \
-	sun/net/ConnectionResetException.java \
-	sun/net/NetProperties.java \
-	sun/net/NetHooks.java \
-	sun/net/util/IPAddressUtil.java \
-	sun/net/util/URLUtil.java \
-	sun/net/dns/ResolverConfiguration.java \
-	sun/net/dns/ResolverConfigurationImpl.java \
-	sun/net/ftp/FtpClient.java \
-	sun/net/ftp/FtpClientProvider.java \
-	sun/net/ftp/FtpDirEntry.java \
-	sun/net/ftp/FtpReplyCode.java \
-	sun/net/ftp/FtpDirParser.java \
-	sun/net/ftp/FtpLoginException.java \
-	sun/net/ftp/FtpProtocolException.java \
-	sun/net/ftp/impl/FtpClient.java \
-	sun/net/ftp/impl/DefaultFtpClientProvider.java \
-	sun/net/sdp/SdpSupport.java \
-	sun/net/spi/DefaultProxySelector.java \
-	sun/net/spi/nameservice/NameServiceDescriptor.java \
-	sun/net/spi/nameservice/NameService.java \
-	sun/net/smtp/SmtpClient.java \
-	sun/net/smtp/SmtpProtocolException.java \
-	sun/net/www/content/text/Generic.java \
-	sun/net/www/content/text/plain.java \
-	sun/net/www/content/text/PlainTextInputStream.java \
-	sun/net/www/MessageHeader.java \
-	sun/net/www/HeaderParser.java \
-	sun/net/www/MeteredStream.java \
-	sun/net/www/MimeEntry.java \
-	sun/net/www/MimeLauncher.java \
-	sun/net/www/ApplicationLaunchException.java \
-	sun/net/www/MimeTable.java \
-	sun/net/www/URLConnection.java \
-	sun/net/www/ParseUtil.java \
-	sun/net/www/protocol/file/Handler.java \
-	sun/net/www/protocol/file/FileURLConnection.java \
-	sun/net/www/http/HttpClient.java \
-	sun/net/www/http/HttpCapture.java \
-	sun/net/www/http/HttpCaptureInputStream.java \
-	sun/net/www/http/HttpCaptureOutputStream.java \
-	sun/net/www/http/PosterOutputStream.java \
-	sun/net/www/http/ChunkedInputStream.java \
-	sun/net/www/http/ChunkedOutputStream.java \
-	sun/net/www/http/KeepAliveCache.java \
-	sun/net/www/http/KeepAliveStream.java \
-	sun/net/www/http/KeepAliveStreamCleaner.java \
-	sun/net/www/http/Hurryable.java \
-	sun/net/www/protocol/http/Handler.java \
-	sun/net/www/protocol/http/HttpURLConnection.java \
-	sun/net/www/protocol/http/HttpAuthenticator.java \
-	sun/net/www/protocol/http/AuthenticationHeader.java \
-	sun/net/www/protocol/http/AuthenticationInfo.java \
-	sun/net/www/protocol/http/AuthCache.java \
-	sun/net/www/protocol/http/AuthCacheImpl.java \
-	sun/net/www/protocol/http/AuthCacheValue.java \
-	sun/net/www/protocol/http/AuthScheme.java \
-	sun/net/www/protocol/http/BasicAuthentication.java \
-	sun/net/www/protocol/http/DigestAuthentication.java \
-	sun/net/www/protocol/http/NTLMAuthenticationProxy.java \
-	sun/net/www/protocol/http/NegotiateAuthentication.java \
-	sun/net/www/protocol/http/Negotiator.java \
-	sun/net/www/protocol/http/ntlm/NTLMAuthentication.java \
-	sun/net/www/protocol/http/ntlm/NTLMAuthenticationCallback.java \
-	sun/net/www/protocol/http/spnego/NegotiatorImpl.java \
-	sun/net/www/protocol/http/spnego/NegotiateCallbackHandler.java \
-	sun/net/www/protocol/http/logging/HttpLogFormatter.java \
-	sun/net/www/protocol/https/AbstractDelegateHttpsURLConnection.java \
-	sun/net/www/protocol/https/HttpsClient.java \
-	sun/net/www/protocol/https/DefaultHostnameVerifier.java \
-	sun/net/www/protocol/https/HttpsURLConnectionImpl.java \
-	sun/net/www/protocol/https/DelegateHttpsURLConnection.java \
-	sun/net/www/protocol/https/Handler.java \
-	sun/net/www/protocol/jar/Handler.java \
-	sun/net/www/protocol/jar/URLJarFile.java \
-	sun/net/www/protocol/jar/JarFileFactory.java \
-	sun/net/www/protocol/jar/JarURLConnection.java \
-	sun/net/www/protocol/netdoc/Handler.java \
-	sun/net/www/content/image/gif.java \
-	sun/net/www/content/image/jpeg.java \
-	sun/net/www/content/image/x_xbitmap.java \
-	sun/net/www/content/image/x_xpixmap.java \
-	sun/net/www/content/image/png.java \
-	sun/net/www/content/audio/aiff.java \
-	sun/net/www/content/audio/basic.java \
-	sun/net/www/content/audio/wav.java \
-	sun/net/www/content/audio/x_aiff.java \
-	sun/net/www/content/audio/x_wav.java \
-	sun/net/www/protocol/ftp/Handler.java \
-	sun/net/www/protocol/ftp/FtpURLConnection.java \
-	sun/net/www/protocol/gopher/GopherClient.java \
-	sun/net/www/protocol/gopher/Handler.java \
-	sun/net/www/protocol/mailto/Handler.java \
-	sun/net/www/protocol/mailto/MailToURLConnection.java \
-	sun/net/idn/Punycode.java \
-	sun/net/idn/UCharacterEnums.java \
-	sun/net/idn/UCharacterDirection.java \
-	sun/net/idn/StringPrepDataReader.java \
-	sun/net/idn/StringPrep.java
+        sun/net/InetAddressCachePolicy.java \
+        sun/net/URLCanonicalizer.java \
+        sun/net/NetworkClient.java \
+        sun/net/NetworkServer.java \
+        sun/net/PortConfig.java \
+        sun/net/ProgressMonitor.java \
+        sun/net/ProgressSource.java \
+        sun/net/ProgressEvent.java \
+        sun/net/ProgressListener.java \
+        sun/net/ProgressMeteringPolicy.java \
+        sun/net/SocksProxy.java \
+        sun/net/ResourceManager.java \
+        sun/net/TelnetInputStream.java \
+        sun/net/TelnetOutputStream.java \
+        sun/net/TelnetProtocolException.java \
+        sun/net/TransferProtocolClient.java \
+        sun/net/ConnectionResetException.java \
+        sun/net/NetProperties.java \
+        sun/net/NetHooks.java \
+        sun/net/util/IPAddressUtil.java \
+        sun/net/util/URLUtil.java \
+        sun/net/dns/ResolverConfiguration.java \
+        sun/net/dns/ResolverConfigurationImpl.java \
+        sun/net/ftp/FtpClient.java \
+        sun/net/ftp/FtpClientProvider.java \
+        sun/net/ftp/FtpDirEntry.java \
+        sun/net/ftp/FtpReplyCode.java \
+        sun/net/ftp/FtpDirParser.java \
+        sun/net/ftp/FtpLoginException.java \
+        sun/net/ftp/FtpProtocolException.java \
+        sun/net/ftp/impl/FtpClient.java \
+        sun/net/ftp/impl/DefaultFtpClientProvider.java \
+        sun/net/sdp/SdpSupport.java \
+        sun/net/spi/DefaultProxySelector.java \
+        sun/net/spi/nameservice/NameServiceDescriptor.java \
+        sun/net/spi/nameservice/NameService.java \
+        sun/net/smtp/SmtpClient.java \
+        sun/net/smtp/SmtpProtocolException.java \
+        sun/net/www/content/text/Generic.java \
+        sun/net/www/content/text/plain.java \
+        sun/net/www/content/text/PlainTextInputStream.java \
+        sun/net/www/MessageHeader.java \
+        sun/net/www/HeaderParser.java \
+        sun/net/www/MeteredStream.java \
+        sun/net/www/MimeEntry.java \
+        sun/net/www/MimeLauncher.java \
+        sun/net/www/ApplicationLaunchException.java \
+        sun/net/www/MimeTable.java \
+        sun/net/www/URLConnection.java \
+        sun/net/www/ParseUtil.java \
+        sun/net/www/protocol/file/Handler.java \
+        sun/net/www/protocol/file/FileURLConnection.java \
+        sun/net/www/http/HttpClient.java \
+        sun/net/www/http/HttpCapture.java \
+        sun/net/www/http/HttpCaptureInputStream.java \
+        sun/net/www/http/HttpCaptureOutputStream.java \
+        sun/net/www/http/PosterOutputStream.java \
+        sun/net/www/http/ChunkedInputStream.java \
+        sun/net/www/http/ChunkedOutputStream.java \
+        sun/net/www/http/KeepAliveCache.java \
+        sun/net/www/http/KeepAliveStream.java \
+        sun/net/www/http/KeepAliveStreamCleaner.java \
+        sun/net/www/http/Hurryable.java \
+        sun/net/www/protocol/http/Handler.java \
+        sun/net/www/protocol/http/HttpURLConnection.java \
+        sun/net/www/protocol/http/HttpAuthenticator.java \
+        sun/net/www/protocol/http/AuthenticationHeader.java \
+        sun/net/www/protocol/http/AuthenticationInfo.java \
+        sun/net/www/protocol/http/AuthCache.java \
+        sun/net/www/protocol/http/AuthCacheImpl.java \
+        sun/net/www/protocol/http/AuthCacheValue.java \
+        sun/net/www/protocol/http/AuthScheme.java \
+        sun/net/www/protocol/http/BasicAuthentication.java \
+        sun/net/www/protocol/http/DigestAuthentication.java \
+        sun/net/www/protocol/http/NTLMAuthenticationProxy.java \
+        sun/net/www/protocol/http/NegotiateAuthentication.java \
+        sun/net/www/protocol/http/Negotiator.java \
+        sun/net/www/protocol/http/ntlm/NTLMAuthentication.java \
+        sun/net/www/protocol/http/ntlm/NTLMAuthenticationCallback.java \
+        sun/net/www/protocol/http/spnego/NegotiatorImpl.java \
+        sun/net/www/protocol/http/spnego/NegotiateCallbackHandler.java \
+        sun/net/www/protocol/http/logging/HttpLogFormatter.java \
+        sun/net/www/protocol/https/AbstractDelegateHttpsURLConnection.java \
+        sun/net/www/protocol/https/HttpsClient.java \
+        sun/net/www/protocol/https/DefaultHostnameVerifier.java \
+        sun/net/www/protocol/https/HttpsURLConnectionImpl.java \
+        sun/net/www/protocol/https/DelegateHttpsURLConnection.java \
+        sun/net/www/protocol/https/Handler.java \
+        sun/net/www/protocol/jar/Handler.java \
+        sun/net/www/protocol/jar/URLJarFile.java \
+        sun/net/www/protocol/jar/JarFileFactory.java \
+        sun/net/www/protocol/jar/JarURLConnection.java \
+        sun/net/www/protocol/netdoc/Handler.java \
+        sun/net/www/content/image/gif.java \
+        sun/net/www/content/image/jpeg.java \
+        sun/net/www/content/image/x_xbitmap.java \
+        sun/net/www/content/image/x_xpixmap.java \
+        sun/net/www/content/image/png.java \
+        sun/net/www/content/audio/aiff.java \
+        sun/net/www/content/audio/basic.java \
+        sun/net/www/content/audio/wav.java \
+        sun/net/www/content/audio/x_aiff.java \
+        sun/net/www/content/audio/x_wav.java \
+        sun/net/www/protocol/ftp/Handler.java \
+        sun/net/www/protocol/ftp/FtpURLConnection.java \
+        sun/net/www/protocol/gopher/GopherClient.java \
+        sun/net/www/protocol/gopher/Handler.java \
+        sun/net/www/protocol/mailto/Handler.java \
+        sun/net/www/protocol/mailto/MailToURLConnection.java \
+        sun/net/idn/Punycode.java \
+        sun/net/idn/UCharacterEnums.java \
+        sun/net/idn/UCharacterDirection.java \
+        sun/net/idn/StringPrepDataReader.java \
+        sun/net/idn/StringPrep.java
 
 ifeq ($(PLATFORM), windows)
-    FILES_java += sun/net/www/protocol/http/ntlm/NTLMAuthSequence.java 
+    FILES_java += sun/net/www/protocol/http/ntlm/NTLMAuthSequence.java
 else
     FILES_java += sun/net/sdp/SdpProvider.java
 endif
--- a/src/bsd/doc/man/jarsigner.1	Fri Jan 10 15:10:25 2014 +0000
+++ b/src/bsd/doc/man/jarsigner.1	Thu Jan 23 19:23:55 2014 +0000
@@ -1,1567 +1,985 @@
-." Copyright (c) 1998, 2011, Oracle and/or its affiliates. All rights reserved.
-." DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-."
-." This code is free software; you can redistribute it and/or modify it
-." under the terms of the GNU General Public License version 2 only, as
-." published by the Free Software Foundation.
-."
-." This code is distributed in the hope that it will be useful, but WITHOUT
-." ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-." FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-." version 2 for more details (a copy is included in the LICENSE file that
-." accompanied this code).
-."
-." You should have received a copy of the GNU General Public License version
-." 2 along with this work; if not, write to the Free Software Foundation,
-." Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-."
-." Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-." or visit www.oracle.com if you need additional information or have any
-." questions.
-."
-.TH jarsigner 1 "10 May 2011"
+'\" t
+.\"  Copyright (c) 1998, 2013, Oracle and/or its affiliates. All rights reserved.
+.\"
+.\" DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+.\"
+.\" This code is free software; you can redistribute it and/or modify it
+.\" under the terms of the GNU General Public License version 2 only, as
+.\" published by the Free Software Foundation.
+.\"
+.\" This code is distributed in the hope that it will be useful, but WITHOUT
+.\" ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+.\" FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+.\" version 2 for more details (a copy is included in the LICENSE file that
+.\" accompanied this code).
+.\"
+.\" You should have received a copy of the GNU General Public License version
+.\" 2 along with this work; if not, write to the Free Software Foundation,
+.\" Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+.\"
+.\" Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+.\" or visit www.oracle.com if you need additional information or have any
+.\" questions.
+.\"
+.\"     Arch: generic
+.\"     Software: JDK 7
+.\"     Date: 6 August 2013
+.\"     SectDesc: Security Tools
+.\"     Title: jarsigner.1
+.\"
+.if n .pl 99999
+.TH jarsigner 1 "6 August 2013" "JDK 7" "Security Tools"
+.\" -----------------------------------------------------------------
+.\" * Define some portability stuff
+.\" -----------------------------------------------------------------
+.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.\" http://bugs.debian.org/507673
+.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
+.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.ie \n(.g .ds Aq \(aq
+.el       .ds Aq '
+.\" -----------------------------------------------------------------
+.\" * set default formatting
+.\" -----------------------------------------------------------------
+.\" disable hyphenation
+.nh
+.\" disable justification (adjust text to left margin only)
+.ad l
+.\" -----------------------------------------------------------------
+.\" * MAIN CONTENT STARTS HERE *
+.\" -----------------------------------------------------------------
 
-.LP
-.SH "Name"
-jarsigner \- JAR Signing and Verification Tool
-.LP
-.LP
-Generates signatures for Java ARchive (JAR) files, and verifies the signatures of signed JAR files.
-.LP
-.SH "SYNOPSIS"
-.LP
-.nf
-\f3
-.fl
-\fP\f3jarsigner\fP [ options ] jar\-file alias
-.fl
-\f3jarsigner\fP \-verify [ options ] jar\-file [alias...]
-.fl
-.fi
+.SH NAME    
+jarsigner \- Signs and verifies Java Archive (JAR) files\&.
+.SH SYNOPSIS    
+.sp     
+.nf     
 
-.LP
-.LP
-The jarsigner \-verify command can take zero or more keystore alias names after the jar filename. When specified, jarsigner will check that the certificate used to verify each signed entry in the jar file matches one of the keystore aliases. The aliases are defined in the keystore specified by \-keystore, or the default keystore.
-.LP
-.SH "DESCRIPTION"
-.LP
-.LP
-The \f3jarsigner\fP tool is used for two purposes:
-.LP
-.RS 3
-.TP 3
-1.
-to sign Java ARchive (JAR) files, and
-.TP 3
-2.
-to verify the signatures and integrity of signed JAR files.
-.RE
+\fBjarsigner\fR [ \fIoptions\fR ] \fIjar\-file\fR \fIalias\fR
+.fi     
+.nf     
 
-.LP
-.LP
-The JAR feature enables the packaging of class files, images, sounds, and other digital data in a single file for faster and easier distribution. A tool named jar(1) enables developers to produce JAR files. (Technically, any zip file can also be considered a JAR file, although when created by \f3jar\fP or processed by \f3jarsigner\fP, JAR files also contain a META\-INF/MANIFEST.MF file.)
-.LP
-.LP
-A \f2digital signature\fP is a string of bits that is computed from some data (the data being "signed") and the private key of an entity (a person, company, etc.). Like a handwritten signature, a digital signature has many useful characteristics:
-.LP
-.RS 3
-.TP 2
-o
-Its authenticity can be verified, via a computation that uses the public key corresponding to the private key used to generate the signature.
-.TP 2
-o
-It cannot be forged, assuming the private key is kept secret.
-.TP 2
-o
-It is a function of the data signed and thus can't be claimed to be the signature for other data as well.
-.TP 2
-o
-The signed data cannot be changed; if it is, the signature will no longer verify as being authentic.
-.RE
+\fBjarsigner\fR \fB\-verify\fR [ \fIoptions\fR ] \fIjar\-file\fR [\fIalias \&.\&.\&.\fR]
+.fi     
+.sp     
+.TP     
+\fIoptions\fR
+The command-line options\&. See Options\&.
+.TP
+-verify
+.br
+The \f3-verify\fR option can take zero or more keystore alias names after the JAR file name\&. When the \f3-verify\fR option is specified, the \f3jarsigner\fR command checks that the certificate used to verify each signed entry in the JAR file matches one of the keystore aliases\&. The aliases are defined in the keystore specified by \f3-keystore\fR or the default keystore\&.
 
-.LP
-.LP
-In order for an entity's signature to be generated for a file, the entity must first have a public/private key pair associated with it, and also one or more certificates authenticating its public key. A \f2certificate\fP is a digitally signed statement from one entity, saying that the public key of some other entity has a particular value.
-.LP
-.LP
-\f3jarsigner\fP uses key and certificate information from a \f2keystore\fP to generate digital signatures for JAR files. A keystore is a database of private keys and their associated X.509 certificate chains authenticating the corresponding public keys. The keytool(1) utility is used to create and administer keystores.
-.LP
-.LP
-\f3jarsigner\fP uses an entity's private key to generate a signature. The signed JAR file contains, among other things, a copy of the certificate from the keystore for the public key corresponding to the private key used to sign the file. \f3jarsigner\fP can verify the digital signature of the signed JAR file using the certificate inside it (in its signature block file).
-.LP
-.LP
-\f3jarsigner\fP can generate signatures that include a timestamp, thus enabling systems/deployer (including Java Plug\-in) to check whether the JAR file was signed while the signing certificate was still valid. In addition, APIs will allow applications to obtain the timestamp information.
-.LP
-.LP
-At this time, \f3jarsigner\fP can only sign JAR files created by the SDK jar(1) tool or zip files. (JAR files are the same as zip files, except they also have a META\-INF/MANIFEST.MF file. Such a file will automatically be created when \f3jarsigner\fP signs a zip file.)
-.LP
-.LP
-The default \f3jarsigner\fP behavior is to \f2sign\fP a JAR (or zip) file. Use the \f2\-verify\fP option to instead have it \f2verify\fP a signed JAR file.
-.LP
-.SS
-Keystore Aliases
-.LP
-.LP
-All keystore entities are accessed via unique \f2aliases\fP.
-.LP
-.LP
-When using \f3jarsigner\fP to sign a JAR file, you must specify the alias for the keystore entry containing the private key needed to generate the signature. For example, the following will sign the JAR file named "MyJARFile.jar", using the private key associated with the alias "duke" in the keystore named "mystore" in the "working" directory. Since no output file is specified, it overwrites MyJARFile.jar with the signed JAR file.
-.LP
-.nf
-\f3
-.fl
-    jarsigner \-keystore /working/mystore \-storepass \fP\f4<keystore password>\fP\f3
-.fl
-      \-keypass \fP\f4<private key password>\fP\f3 MyJARFile.jar duke
-.fl
-\fP
-.fi
+If you also specified the \f3-strict\fR option, and the \f3jarsigner\fR command detected severe warnings, the message, "jar verified, with signer errors" is displayed\&.
+.TP     
+\fIjar-file\fR
+The JAR file to be signed\&.
 
-.LP
-.LP
-Keystores are protected with a password, so the store password must be specified. You will be prompted for it if you don't specify it on the command line. Similarly, private keys are protected in a keystore with a password, so the private key's password must be specified, and you will be prompted for it if you don't specify it on the command line and it isn't the same as the store password.
-.LP
-.SS
-Keystore Location
-.LP
-.LP
-\f3jarsigner\fP has a \f2\-keystore\fP option for specifying the URL of the keystore to be used. The keystore is by default stored in a file named \f2.keystore\fP in the user's home directory, as determined by the \f2user.home\fP system property. On Solaris systems \f2user.home\fP defaults to the user's home directory.
-.LP
-.LP
-Note that the input stream from the \f2\-keystore\fP option is passed to the \f2KeyStore.load\fP method. If \f2NONE\fP is specified as the URL, then a null stream is passed to the \f2KeyStore.load\fP method. \f2NONE\fP should be specified if the \f2KeyStore\fP is not file\-based, for example, if it resides on a hardware token device.
-.LP
-.SS
-Keystore Implementation
-.LP
-.LP
-The \f2KeyStore\fP class provided in the \f2java.security\fP package supplies well\-defined interfaces to access and modify the information in a keystore. It is possible for there to be multiple different concrete implementations, where each implementation is that for a particular \f2type\fP of keystore.
-.LP
-.LP
-Currently, there are two command\-line tools that make use of keystore implementations (\f3keytool\fP and \f3jarsigner\fP), and also a GUI\-based tool named \f3Policy Tool\fP. Since \f2KeyStore\fP is publicly available, Java 2 SDK users can write additional security applications that use it.
-.LP
-.LP
-There is a built\-in default implementation, provided by Sun Microsystems. It implements the keystore as a file, utilizing a proprietary keystore type (format) named "JKS". It protects each private key with its individual password, and also protects the integrity of the entire keystore with a (possibly different) password.
-.LP
-.LP
-Keystore implementations are provider\-based. More specifically, the application interfaces supplied by \f2KeyStore\fP are implemented in terms of a "Service Provider Interface" (SPI). That is, there is a corresponding abstract \f2KeystoreSpi\fP class, also in the \f2java.security\fP package, which defines the Service Provider Interface methods that "providers" must implement. (The term "provider" refers to a package or a set of packages that supply a concrete implementation of a subset of services that can be accessed by the Java Security API.) Thus, to provide a keystore implementation, clients must implement a provider and supply a KeystoreSpi subclass implementation, as described in
-.na
-\f2How to Implement a Provider for the Java Cryptography Architecture\fP @
-.fi
-http://download.oracle.com/javase/7/docs/technotes/guides/security/crypto/HowToImplAProvider.html.
-.LP
-.LP
-Applications can choose different \f2types\fP of keystore implementations from different providers, using the "getInstance" factory method supplied in the \f2KeyStore\fP class. A keystore type defines the storage and data format of the keystore information, and the algorithms used to protect private keys in the keystore and the integrity of the keystore itself. Keystore implementations of different types are not compatible.
-.LP
-.LP
-\f3keytool\fP works on any file\-based keystore implementation. (It treats the keystore location that is passed to it at the command line as a filename and converts it to a FileInputStream, from which it loads the keystore information.) The \f3jarsigner\fP and \f3policytool\fP tools, on the other hand, can read a keystore from any location that can be specified using a URL.
-.LP
-.LP
-For \f3jarsigner\fP and \f3keytool\fP, you can specify a keystore type at the command line, via the \f2\-storetype\fP option. For \f3Policy Tool\fP, you can specify a keystore type via the "Change Keystore" command in the Edit menu.
-.LP
-.LP
-If you don't explicitly specify a keystore type, the tools choose a keystore implementation based simply on the value of the \f2keystore.type\fP property specified in the security properties file. The security properties file is called \f2java.security\fP, and it resides in the SDK security properties directory, \f2java.home\fP/lib/security, where \f2java.home\fP is the runtime environment's directory (the \f2jre\fP directory in the SDK or the top\-level directory of the Java 2 Runtime Environment).
-.LP
-.LP
-Each tool gets the \f2keystore.type\fP value and then examines all the currently\-installed providers until it finds one that implements keystores of that type. It then uses the keystore implementation from that provider.
-.LP
-.LP
-The \f2KeyStore\fP class defines a static method named \f2getDefaultType\fP that lets applications and applets retrieve the value of the \f2keystore.type\fP property. The following line of code creates an instance of the default keystore type (as specified in the \f2keystore.type\fP property):
-.LP
-.nf
-\f3
-.fl
-    KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
-.fl
-\fP
-.fi
+If you also specified the \f3-strict\fR option, and the \f3jarsigner\fR command detected severe warnings, the message, "jar signed, with signer errors" is displayed\&.
+.TP     
+\fIalias\fR
+The aliases are defined in the keystore specified by \f3-keystore\fR or the default keystore\&.
+.SH DESCRIPTION    
+The \f3jarsigner\fR tool has two purposes:
+.TP 0.2i    
+\(bu
+To sign Java Archive (JAR) files\&.
+.TP 0.2i    
+\(bu
+To verify the signatures and integrity of signed JAR files\&.
+.PP
+The JAR feature enables the packaging of class files, images, sounds, and other digital data in a single file for faster and easier distribution\&. A tool named \f3jar\fR enables developers to produce JAR files\&. (Technically, any zip file can also be considered a JAR file, although when created by the \f3jar\fR command or processed by the \f3jarsigner\fR command, JAR files also contain a \f3META-INF/MANIFEST\&.MF\fR file\&.)
+.PP
+A digital signature is a string of bits that is computed from some data (the data being signed) and the private key of an entity (a person, company, and so on)\&. Similar to a handwritten signature, a digital signature has many useful characteristics:
+.TP 0.2i    
+\(bu
+Its authenticity can be verified by a computation that uses the public key corresponding to the private key used to generate the signature\&.
+.TP 0.2i    
+\(bu
+It cannot be forged, assuming the private key is kept secret\&.
+.TP 0.2i    
+\(bu
+It is a function of the data signed and thus cannot be claimed to be the signature for other data as well\&.
+.TP 0.2i    
+\(bu
+The signed data cannot be changed\&. If the data is changed, then the signature cannot be verified as authentic\&.
+.PP
+To generate an entity\&'s signature for a file, the entity must first have a public/private key pair associated with it and one or more certificates that authenticate its public key\&. A certificate is a digitally signed statement from one entity that says that the public key of another entity has a particular value\&.
+.PP
+The \f3jarsigner\fR command uses key and certificate information from a keystore to generate digital signatures for JAR files\&. A keystore is a database of private keys and their associated X\&.509 certificate chains that authenticate the corresponding public keys\&. The \f3keytool\fR command is used to create and administer keystores\&.
+.PP
+The \f3jarsigner\fR command uses an entity\&'s private key to generate a signature\&. The signed JAR file contains, among other things, a copy of the certificate from the keystore for the public key corresponding to the private key used to sign the file\&. The \f3jarsigner\fR command can verify the digital signature of the signed JAR file using the certificate inside it (in its signature block file)\&.
+.PP
+The \f3jarsigner\fR command can generate signatures that include a time stamp that lets a systems or deployer (including Java Plug-in) to check whether the JAR file was signed while the signing certificate was still valid\&. In addition, APIs allow applications to obtain the timestamp information\&.
+.PP
+At this time, the \f3jarsigner\fR command can only sign JAR files created by the \f3jar\fR command or zip files\&. JAR files are the same as zip files, except they also have a \f3META-INF/MANIFEST\&.MF\fR file\&. A \f3META-INF/MANIFEST\&.MF\fR file is created when the \f3jarsigner\fR command signs a zip file\&.
+.PP
+The default \f3jarsigner\fR command behavior is to sign a JAR or zip file\&. Use the \f3-verify\fR option to verify a signed JAR file\&.
+.PP
+The \f3jarsigner\fR command also attempts to validate the signer\&'s certificate after signing or verifying\&. If there is a validation error or any other problem, the command generates warning messages\&. If you specify the \f3-strict\fR option, then the command treats severe warnings as errors\&. See Errors and Warnings\&.
+.SS KEYSTORE\ ALIASES    
+All keystore entities are accessed with unique aliases\&.
+.PP
+When you use the \f3jarsigner\fR command to sign a JAR file, you must specify the alias for the keystore entry that contains the private key needed to generate the signature\&. For example, the following command signs the JAR file named \f3MyJARFile\&.jar\fR with the private key associated with the alias \f3duke\fR in the keystore named \f3mystore\fR in the \f3working\fR directory\&. Because no output file is specified, it overwrites \f3MyJARFile\&.jar\fR with the signed JAR file\&.
+.sp     
+.nf     
+\f3jarsigner \-keystore /working/mystore \-storepass <keystore password>\fP
+.fi     
+.nf     
+\f3      \-keypass <private key password> MyJARFile\&.jar duke\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+Keystores are protected with a password, so the store password must be specified\&. You are prompted for it when you do not specify it on the command line\&. Similarly, private keys are protected in a keystore with a password, so the private key\&'s password must be specified, and you are prompted for the password when you do not specify it on the command line and it is not the same as the store password\&.
+.SS KEYSTORE\ LOCATION    
+The \f3jarsigner\fR command has a \f3-keystore\fR option for specifying the URL of the keystore to be used\&. The keystore is by default stored in a file named \f3\&.keystore\fR in the user\&'s home directory, as determined by the \f3user\&.home\fR system property\&.
+.PP
+On Oracle Solaris systems, \f3user\&.home\fR defaults to the user\&'s home directory\&.
+.PP
+The input stream from the \f3-keystore\fR option is passed to the \f3KeyStore\&.load\fR method\&. If \f3NONE\fR is specified as the URL, then a null stream is passed to the \f3KeyStore\&.load\fR method\&. \f3NONE\fR should be specified when the \f3KeyStore\fR class is not file based, for example, when it resides on a hardware token device\&.
+.SS KEYSTORE\ IMPLEMENTATION    
+The \f3KeyStore\fR class provided in the \f3java\&.security\fR package supplies a number of well-defined interfaces to access and modify the information in a keystore\&. You can have multiple different concrete implementations, where each implementation is for a particular type of keystore\&.
+.PP
+Currently, there are two command-line tools that use keystore implementations (\f3keytool\fR and \f3jarsigner\fR), and a GUI-based tool named Policy Tool\&. Because the \f3KeyStore\fR class is publicly available, JDK users can write additional security applications that use it\&.
+.PP
+There is a built-in default implementation provided by Oracle that implements the keystore as a file, that uses a proprietary keystore type (format) named JKS\&. The built-in implementation protects each private key with its individual password and protects the integrity of the entire keystore with a (possibly different) password\&.
+.PP
+Keystore implementations are provider-based, which means the application interfaces supplied by the \f3KeyStore\fR class are implemented in terms of a Service Provider Interface (SPI)\&. There is a corresponding abstract \f3KeystoreSpi\fR class, also in the \f3java\&.security package\fR, that defines the Service Provider Interface methods that providers must implement\&. The term provider refers to a package or a set of packages that supply a concrete implementation of a subset of services that can be accessed by the Java Security API\&. To provide a keystore implementation, clients must implement a provider and supply a \f3KeystoreSpi\fR subclass implementation, as described in How to Implement a Provider in the Java Cryptography Architecture at http://docs\&.oracle\&.com/javase/7/docs/technotes/guides/security/crypto/HowToImplAProvider\&.html
+.PP
+Applications can choose different types of keystore implementations from different providers, with the \f3getInstance\fR factory method in the \f3KeyStore\fR class\&. A keystore type defines the storage and data format of the keystore information and the algorithms used to protect private keys in the keystore and the integrity of the keystore itself\&. Keystore implementations of different types are not compatible\&.
+.PP
+The \f3jarsigner\fR and \f3policytool\fR commands can read file-based keystores from any location that can be specified using a URL\&. In addition, these commands can read non-file-based keystores such as those provided by MSCAPI on Windows and PKCS11 on all platforms\&.
+.PP
+For the \f3jarsigner\fR and \f3keytool\fR commands, you can specify a keystore type at the command line with the \f3-storetype\fR option\&. For Policy Tool, you can specify a keystore type with the \fIEdit\fR command in the \fIKeyStore\fR menu\&.
+.PP
+If you do not explicitly specify a keystore type, then the tools choose a keystore implementation based on the value of the \f3keystore\&.type\fR property specified in the security properties file\&. The security properties file is called \f3java\&.security\fR, and it resides in the JDK security properties directory, \f3java\&.home/lib/security\fR, where \f3java\&.home\fR is the runtime environment\&'s directory\&. The \f3jre\fR directory in the JDK or the top-level directory of the Java Runtime Environment (JRE)\&.
+.PP
+Each tool gets the \f3keystore\&.type\fR value and then examines all the installed providers until it finds one that implements keystores of that type\&. It then uses the keystore implementation from that provider\&.
+.PP
+The \f3KeyStore\fR class defines a static method named \f3getDefaultType\fR that lets applications and applets retrieve the value of the \f3keystore\&.type\fR property\&. The following line of code creates an instance of the default keystore type as specified in the \f3keystore\&.type property\fR:
+.sp     
+.nf     
+\f3KeyStore keyStore = KeyStore\&.getInstance(KeyStore\&.getDefaultType());\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+The default keystore type is \f3jks\fR (the proprietary type of the keystore implementation provided by Oracle)\&. This is specified by the following line in the security properties file:
+.sp     
+.nf     
+\f3keystore\&.type=jks\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+Case does not matter in keystore type designations\&. For example, \f3JKS\fR is the same as \f3jks\fR\&.
+.PP
+To have the tools use a keystore implementation other than the default, change that line to specify a different keystore type\&. For example, if you have a provider package that supplies a keystore implementation for a keystore type called \f3pkcs12\fR, then change the line to the following:
+.sp     
+.nf     
+\f3keystore\&.type=pkcs12\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+\fINote:\fR If you use the PKCS 11 provider package, then see "KeyTool" and "JarSigner" in Java PKCS #11 Reference Guide at http://docs\&.oracle\&.com/javase/7/docs/technotes/guides/security/p11guide\&.html
+.SS SUPPORTED\ ALGORITHMS    
+By default, the \f3jarsigner\fR command signs a JAR file using one of the following algorithms:
+.TP 0.2i    
+\(bu
+Digital Signature Algorithm (DSA) with the SHA1 digest algorithm
+.TP 0.2i    
+\(bu
+RSA algorithm with the SHA256 digest algorithm
+.TP 0.2i    
+\(bu
+Elliptic Curve (EC) cryptography algorithm with the SHA256 with Elliptic Curve Digital Signature Algorithm (ECDSA)\&.
+.PP
+If the signer\&'s public and private keys are DSA keys, then \f3jarsigner\fR signs the JAR file with the \f3SHA1withDSA\fR algorithm\&. If the signer\&'s keys are RSA keys, then \f3jarsigner\fR attempts to sign the JAR file with the \f3SHA256withRSA\fR algorithm\&. If the signer\&'s keys are EC keys, then \f3jarsigner\fR signs the JAR file with the \f3SHA256withECDSA\fR algorithm\&.
+.PP
+These default signature algorithms can be overridden using the \f3-sigalg\fR option\&.
+.SS THE\ SIGNED\ JAR\ FILE    
+When the \f3jarsigner\fR command is used to sign a JAR file, the output signed JAR file is exactly the same as the input JAR file, except that it has two additional files placed in the META-INF directory:
+.TP 0.2i    
+\(bu
+A signature file with an \f3\&.SF\fR extension
+.TP 0.2i    
+\(bu
+A signature block file with a \f3\&.DSA\fR, \f3\&.RSA\fR, or \f3\&.EC\fR extension
+.PP
+The base file names for these two files come from the value of the \f3-sigFile\fR option\&. For example, when the option is \f3-sigFile MKSIGN\fR, the files are named \f3MKSIGN\&.SF\fR and \f3MKSIGN\&.DSA\fR
+.PP
+If no \f3-sigfile\fR option appears on the command line, then the base file name for the \f3\&.SF\fR and \f3\&.DSA\fR files is the first 8 characters of the alias name specified on the command line, all converted to uppercase\&. If the alias name has fewer than 8 characters, then the full alias name is used\&. If the alias name contains any characters that are not allowed in a signature file name, then each such character is converted to an underscore (_) character in forming the file name\&. Valid characters include letters, digits, underscores, and hyphens\&.
+.PP
+Signature File
 
-.LP
-.LP
-The default keystore type is "jks" (the proprietary type of the keystore implementation provided by Sun). This is specified by the following line in the security properties file:
-.LP
-.nf
-\f3
-.fl
-    keystore.type=jks
-.fl
-\fP
-.fi
+A signature file (\f3\&.SF\fR file) looks similar to the manifest file that is always included in a JAR file when the \f3jarsigner\fR command is used to sign the file\&. For each source file included in the JAR file, the \f3\&.SF\fR file has three lines, such as in the manifest file, that list the following:
+.TP 0.2i    
+\(bu
+File name
+.TP 0.2i    
+\(bu
+Name of the digest algorithm (SHA)
+.TP 0.2i    
+\(bu
+SHA digest value
+.PP
+In the manifest file, the SHA digest value for each source file is the digest (hash) of the binary data in the source file\&. In the \f3\&.SF\fR file, the digest value for a specified source file is the hash of the three lines in the manifest file for the source file\&.
+.PP
+The signature file, by default, includes a header with a hash of the whole manifest file\&. The header also contains a hash of the manifest header\&. The presence of the header enables verification optimization\&. See JAR File Verification\&.
+.PP
+Signature Block File
 
-.LP
-.LP
-Note: Case doesn't matter in keystore type designations. For example, "JKS" would be considered the same as "jks".
-.LP
-.LP
-To have the tools utilize a keystore implementation other than the default, change that line to specify a different keystore type. For example, if you have a provider package that supplies a keystore implementation for a keystore type called "pkcs12", change the line to
-.LP
-.nf
-\f3
-.fl
-    keystore.type=pkcs12
-.fl
-\fP
-.fi
+The \f3\&.SF\fR file is signed and the signature is placed in the signature block file\&. This file also contains, encoded inside it, the certificate or certificate chain from the keystore that authenticates the public key corresponding to the private key used for signing\&. The file has the extension \f3\&.DSA\fR, \f3\&.RSA\fR, or \f3\&.EC\fR, depending on the digest algorithm used\&.
+.SS SIGNATURE\ TIME\ STAMP    
+The \f3jarsigner\fR command can generate and store a signature time stamp when signing a JAR file\&. In addition, \f3jarsigner\fR supports alternative signing mechanisms\&. This behavior is optional and is controlled by the user at the time of signing through these options\&. See Options\&.
+.sp     
+.nf     
+\f3\-tsa \fIurl\fR\fP
+.fi     
+.nf     
+\f3\-tsacert \fIalias\fR\fP
+.fi     
+.nf     
+\f3\-altsigner \fIclass\fR\fP
+.fi     
+.nf     
+\f3\-altsignerpath \fIclasspathlist\fR\fP
+.fi     
+.nf     
+\f3\-tsapolicyid \fIpolicyid\fR\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+.SS JAR\ FILE\ VERIFICATION    
+A successful JAR file verification occurs when the signatures are valid, and none of the files that were in the JAR file when the signatures were generated have changed since then\&. JAR file verification involves the following steps:
+.TP 0.4i    
+1\&.
+Verify the signature of the \f3\&.SF\fR file\&.
 
-.LP
-.LP
-Note that if you us the PKCS#11 provider package, you should refer to the
-.na
-\f2KeyTool and JarSigner\fP @
-.fi
-http://download.oracle.com/javase/7/docs/technotes/guides/security/p11guide.html#KeyToolJarSigner section of the Java PKCS#11 Reference Guide for details.
-.LP
-.SS
-Supported Algorithms
-.LP
-.LP
-By default, \f3jarsigner\fP signs a JAR file using one of the following:
-.LP
-.RS 3
-.TP 2
-o
-DSA (Digital Signature Algorithm) with the SHA1 digest algorithm
-.TP 2
-o
-RSA algorithm with the SHA256 digest algorithm.
-.TP 2
-o
-EC (Elliptic Curve) cryptography algorithm with the SHA256 with ECDSA (Elliptic Curve Digital Signature Algorithm).
-.RE
+The verification ensures that the signature stored in each signature block (\f3\&.DSA\fR) file was generated using the private key corresponding to the public key whose certificate (or certificate chain) also appears in the \f3\&.DSA\fR file\&. It also ensures that the signature is a valid signature of the corresponding signature (\f3\&.SF\fR) file, and thus the \f3\&.SF\fR file was not tampered with\&.
+.TP 0.4i    
+2\&.
+Verify the digest listed in each entry in the \f3\&.SF\fR file with each corresponding section in the manifest\&.
 
-.LP
-.LP
-That is, if the signer's public and private keys are DSA keys, \f3jarsigner\fP will sign the JAR file using the "SHA1withDSA" algorithm. If the signer's keys are RSA keys, \f3jarsigner\fP will attempt to sign the JAR file using the "SHA256withRSA" algorithm. If the signer's keys are EC keys, \f3jarsigner\fP will sign the JAR file using the "SHA256withECDSA" algorithm.
-.LP
-.LP
-These default signature algorithms can be overridden using the \f2\-sigalg\fP option.
-.LP
-.SS
-The Signed JAR File
-.LP
-.LP
-When \f3jarsigner\fP is used to sign a JAR file, the output signed JAR file is exactly the same as the input JAR file, except that it has two additional files placed in the META\-INF directory:
-.LP
-.RS 3
-.TP 2
-o
-a signature file, with a .SF extension, and
-.TP 2
-o
-a signature block file, with a .DSA, .RSA, or .EC extension.
-.RE
+The \f3\&.SF\fR file by default includes a header that contains a hash of the entire manifest file\&. When the header is present, the verification can check to see whether or not the hash in the header matches the hash of the manifest file\&. If there is a match, then verification proceeds to the next step\&.
 
-.LP
-.LP
-The base file names for these two files come from the value of the \f2\-sigFile\fP option. For example, if the option appears as
-.LP
-.nf
-\f3
-.fl
-\-sigFile MKSIGN
-.fl
-\fP
-.fi
+If there is no match, then a less optimized verification is required to ensure that the hash in each source file information section in the \f3\&.SF\fR file equals the hash of its corresponding section in the manifest file\&. See Signature File\&.
 
-.LP
-.LP
-The files are named "MKSIGN.SF" and "MKSIGN.DSA".
-.LP
-.LP
-If no \f2\-sigfile\fP option appears on the command line, the base file name for the .SF and .DSA files will be the first 8 characters of the alias name specified on the command line, all converted to upper case. If the alias name has fewer than 8 characters, the full alias name is used. If the alias name contains any characters that are not allowed in a signature file name, each such character is converted to an underscore ("_") character in forming the file name. Legal characters include letters, digits, underscores, and hyphens.
-.LP
-\f3The Signature (.SF) File\fP
-.LP
-.LP
-A signature file (the .SF file) looks similar to the manifest file that is always included in a JAR file when \f3jarsigner\fP is used to sign the file. That is, for each source file included in the JAR file, the .SF file has three lines, just as in the manifest file, listing the following:
-.LP
-.RS 3
-.TP 2
-o
-the file name,
-.TP 2
-o
-the name of the digest algorithm used (SHA), and
-.TP 2
-o
-a SHA digest value.
-.RE
+One reason the hash of the manifest file that is stored in the \f3\&.SF\fR file header might not equal the hash of the current manifest file is that one or more files were added to the JAR file (with the \f3jar\fR tool) after the signature and \f3\&.SF\fR file were generated\&. When the \f3jar\fR tool is used to add files, the manifest file is changed by adding sections to it for the new files, but the \f3\&.SF\fR file is not changed\&. A verification is still considered successful when none of the files that were in the JAR file when the signature was generated have been changed since then\&. This happens when the hashes in the non-header sections of the \f3\&.SF\fR file equal the hashes of the corresponding sections in the manifest file\&.
+.TP 0.4i    
+3\&.
+Read each file in the JAR file that has an entry in the \f3\&.SF\fR file\&. While reading, compute the file\&'s digest and compare the result with the digest for this file in the manifest section\&. The digests should be the same or verification fails\&.
 
-.LP
-.LP
-In the manifest file, the SHA digest value for each source file is the digest (hash) of the binary data in the source file. In the .SF file, on the other hand, the digest value for a given source file is the hash of the three lines in the manifest file for the source file.
-.LP
-.LP
-The signature file also, by default, includes a header containing a hash of the whole manifest file. The presence of the header enables verification optimization, as described in JAR File Verification.
-.LP
-\f3The Signature Block File\fP
-.LP
-The .SF file is signed and the signature is placed in the signature block file. This file also contains, encoded inside it, the certificate or certificate chain from the keystore which authenticates the public key corresponding to the private key used for signing. The file has the extension .DSA, .RSA, or .EC depending on the digest algorithm used.
-.SS
-Signature Timestamp
-.LP
-.LP
-\f2jarsigner\fP tool can generate and store a signature timestamp when signing a JAR file. In addition, \f2jarsigner\fP supports alternative signing mechanisms. This behavior is optional and is controlled by the user at the time of signing through these options:
-.LP
-.RS 3
-.TP 2
-o
-\f2\-tsa url\fP
-.TP 2
-o
-\f2\-tsacert alias\fP
-.TP 2
-o
-\f2\-altsigner class\fP
-.TP 2
-o
-\f2\-altsignerpath classpathlist\fP
-.RE
+If any serious verification failures occur during the verification process, then the process is stopped and a security exception is thrown\&. The \f3jarsigner\fR command catches and displays the exception\&.
+.PP
+\fINote:\fR You should read any addition warnings (or errors if you specified the \f3-strict\fR option), as well as the content of the certificate (by specifying the \f3-verbose\fR and \f3-certs\fR options) to determine if the signature can be trusted\&.
+.SS MULTIPLE\ SIGNATURES\ FOR\ A\ JAR\ FILE    
+A JAR file can be signed by multiple people by running the \f3jarsigner\fR command on the file multiple times and specifying the alias for a different person each time, as follows:
+.sp     
+.nf     
+\f3jarsigner myBundle\&.jar susan\fP
+.fi     
+.nf     
+\f3jarsigner myBundle\&.jar kevin\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+When a JAR file is signed multiple times, there are multiple \f3\&.SF\fR and \f3\&.DSA\fR files in the resulting JAR file, one pair for each signature\&. In the previous example, the output JAR file includes files with the following names:
+.sp     
+.nf     
+\f3SUSAN\&.SF\fP
+.fi     
+.nf     
+\f3SUSAN\&.DSA\fP
+.fi     
+.nf     
+\f3KEVIN\&.SF\fP
+.fi     
+.nf     
+\f3KEVIN\&.DSA\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+\fINote:\fR It is also possible for a JAR file to have mixed signatures, some generated by the JDK 1\&.1 by the \f3javakey\fR command and others by \f3jarsigner\fR\&. The \f3jarsigner\fR command can be used to sign JAR files that are already signed with the \f3javakey\fR command\&.
+.SH OPTIONS    
+The following sections describe the various \f3jarsigner\fR options\&. Be aware of the following standards:
+.TP 0.2i    
+\(bu
+All option names are preceded by a minus sign (-)\&.
+.TP 0.2i    
+\(bu
+The options can be provided in any order\&.
+.TP 0.2i    
+\(bu
+Items that are in italics or underlined (option values) represent the actual values that must be supplied\&.
+.TP 0.2i    
+\(bu
+The \f3-storepass\fR, \f3-keypass\fR, \f3-sigfile\fR, \f3-sigalg\fR, \f3-digestalg\fR, \f3-signedjar\fR, and TSA-related options are only relevant when signing a JAR file; they are not relevant when verifying a signed JAR file\&. The \f3-keystore\fR option is relevant for signing and verifying a JAR file\&. In addition, aliases are specified when signing and verifying a JAR file\&.
+.TP
+-keystore \fIurl\fR
+.br
+Specifies the URL that tells the keystore location\&. This defaults to the file \f3\&.keystore\fR in the user\&'s home directory, as determined by the \f3user\&.home\fR system property\&.
 
-.LP
-.LP
-Each of these options is detailed in the Options section below.
-.LP
-.SS
-JAR File Verification
-.LP
-.LP
-A successful JAR file verification occurs if the signature(s) are valid, and none of the files that were in the JAR file when the signatures were generated have been changed since then. JAR file verification involves the following steps:
-.LP
-.RS 3
-.TP 3
-1.
-Verify the signature of the .SF file itself.
+A keystore is required when signing\&. You must explicitly specify a keystore when the default keystore does not exist or if you want to use one other than the default\&.
+
+A keystore is not required when verifying, but if one is specified or the default exists and the \f3-verbose\fR option was also specified, then additional information is output regarding whether or not any of the certificates used to verify the JAR file are contained in that keystore\&.
+
+The \f3-keystore\fR argument can be a file name and path specification rather than a URL, in which case it is treated the same as a file: URL, for example, the following are equivalent:
+.sp     
+.nf     
+\f3\-keystore \fIfilePathAndName\fR\fP
+.fi     
+.nf     
+\f3\-keystore file:\fIfilePathAndName\fR\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+
+
+If the Sun PKCS #11 provider was configured in the \f3java\&.security\fR security properties file (located in the JRE\&'s \f3$JAVA_HOME/lib/security directory\fR), then the \f3keytool\fR and \f3jarsigner\fR tools can operate on the PKCS #11 token by specifying these options:
+.sp     
+.nf     
+\f3\-keystore NONE\fP
+.fi     
+.nf     
+\f3\-storetype PKCS11\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+
+
+For example, the following command lists the contents of the configured PKCS#11 token:
+.sp     
+.nf     
+\f3keytool \-keystore NONE \-storetype PKCS11 \-list\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+
+.TP
+-storetype \fIstoretype\fR
 .br
+Specifies the type of keystore to be instantiated\&. The default keystore type is the one that is specified as the value of the \f3keystore\&.type\fR property in the security properties file, which is returned by the static \f3getDefaultType\fR method in \f3java\&.security\&.KeyStore\fR\&.
+
+The PIN for a PCKS #11 token can also be specified with the \f3-storepass\fR option\&. If none is specified, then the \f3keytool\fR and \f3jarsigner\fR commands prompt for the token PIN\&. If the token has a protected authentication path (such as a dedicated PIN-pad or a biometric reader), then the \f3-protected\fR option must be specified and no password options can be specified\&.
+.TP
+-storepass[:env | :file] \fIargument\fR
 .br
-That is, the verification ensures that the signature stored in each signature block (.DSA) file was in fact generated using the private key corresponding to the public key whose certificate (or certificate chain) also appears in the .DSA file. It also ensures that the signature is a valid signature of the corresponding signature (.SF) file, and thus the .SF file has not been tampered with.
-.TP 3
-2.
-Verify the digest listed in each entry in the .SF file with each corresponding section in the manifest.
+Specifies the password that is required to access the keystore\&. This is only needed when signing (not verifying) a JAR file\&. In that case, if a \f3-storepass\fR option is not provided at the command line, then the user is prompted for the password\&.
+
+If the modifier \f3env\fR or \f3file\fR is not specified, then the password has the value \fIargument\fR\&. Otherwise, the password is retrieved as follows:
+.RS     
+.TP 0.2i    
+\(bu
+\f3env\fR: Retrieve the password from the environment variable named \f3argument\fR\&.
+.TP 0.2i    
+\(bu
+\f3file\fR: Retrieve the password from the file named \f3argument\fR\&.
+.RE     
+
+
+\fINote:\fR The password should not be specified on the command line or in a script unless it is for testing purposes, or you are on a secure system\&.
+.TP
+-keypass [:env | :file] \fIargument\fR
 .br
+Specifies the password used to protect the private key of the keystore entry addressed by the alias specified on the command line\&. The password is required when using \f3jarsigner\fR to sign a JAR file\&. If no password is provided on the command line, and the required password is different from the store password, then the user is prompted for it\&.
+
+If the modifier \f3env\fR or \f3file\fR is not specified, then the password has the value \f3argument\fR\&. Otherwise, the password is retrieved as follows:
+.RS     
+.TP 0.2i    
+\(bu
+\f3env\fR: Retrieve the password from the environment variable named \f3argument\fR\&.
+.TP 0.2i    
+\(bu
+\f3file\fR: Retrieve the password from the file named \f3argument\fR\&.
+.RE     
+
+
+\fINote:\fR The password should not be specified on the command line or in a script unless it is for testing purposes, or you are on a secure system\&.
+.TP
+-sigfile \fIfile\fR
 .br
-The .SF file by default includes a header containing a hash of the entire manifest file. When the header is present, then the verification can check to see whether or not the hash in the header indeed matches the hash of the manifest file. If that is the case, verification proceeds to the next step.
+Specifies the base file name to be used for the generated \f3\&.SF\fR and \f3\&.DSA\fR files\&. For example, if file is \f3DUKESIGN\fR, then the generated \f3\&.SF\fR and \f3\&.DSA\fR files are named \f3DUKESIGN\&.SF\fR and \f3DUKESIGN\&.DSA\fR, and placed in the \f3META-INF\fR directory of the signed JAR file\&.
+
+The characters in the file must come from the set \f3a-zA-Z0-9_-\fR\&. Only letters, numbers, underscore, and hyphen characters are allowed\&. All lowercase characters are converted to uppercase for the \f3\&.SF\fR and \f3\&.DSA\fR file names\&.
+
+If no \f3-sigfile\fR option appears on the command line, then the base file name for the \f3\&.SF\fR and \f3\&.DSA\fR files is the first 8 characters of the alias name specified on the command line, all converted to upper case\&. If the alias name has fewer than 8 characters, then the full alias name is used\&. If the alias name contains any characters that are not valid in a signature file name, then each such character is converted to an underscore (_) character to form the file name\&.
+.TP
+-sigalg \fIalgorithm\fR
 .br
+Specifies the name of the signature algorithm to use to sign the JAR file\&.
+
+For a list of standard signature algorithm names, see "Appendix A: Standard Names" in the Java Cryptography Architecture (JCA) Reference Guide at http://docs\&.oracle\&.com/javase/7/docs/technotes/guides/security/crypto/CryptoSpec\&.html#AppA
+
+This algorithm must be compatible with the private key used to sign the JAR file\&. If this option is not specified, then \f3SHA1withDSA\fR, \f3SHA256withRSA\fR, or \f3SHA256withECDSA\fR are used depending on the type of private key\&. There must either be a statically installed provider supplying an implementation of the specified algorithm or the user must specify one with the \f3-providerClass\fR option; otherwise, the command will not succeed\&.
+.TP
+-digestalg \fIalgorithm\fR
 .br
-If that is not the case, a less optimized verification is required to ensure that the hash in each source file information section in the .SF file equals the hash of its corresponding section in the manifest file (see The Signature (.SF) File).
+Specifies the name of the message digest algorithm to use when digesting the entries of a JAR file\&.
+
+For a list of standard message digest algorithm names, see "Appendix A: Standard Names" in the Java Cryptography Architecture (JCA) Reference Guide at http://docs\&.oracle\&.com/javase/7/docs/technotes/guides/security/crypto/CryptoSpec\&.html#AppA
+
+If this option is not specified, then \f3SHA256\fR is used\&. There must either be a statically installed provider supplying an implementation of the specified algorithm or the user must specify one with the \f3-providerClass\fR option; otherwise, the command will not succeed\&.
+.TP
+-certs
 .br
+If the \f3-certs\fR option appears on the command line with the \f3-verify\fR and \f3-verbose\fR options, then the output includes certificate information for each signer of the JAR file\&. This information includes the name of the type of certificate (stored in the \f3\&.DSA\fR file) that certifies the signer\&'s public key, and if the certificate is an X\&.509 certificate (an instance of the \f3java\&.security\&.cert\&.X509Certificate\fR), then the distinguished name of the signer\&.
+
+The keystore is also examined\&. If no keystore value is specified on the command line, then the default keystore file (if any) is checked\&. If the public key certificate for a signer matches an entry in the keystore, then the alias name for the keystore entry for that signer is displayed in parentheses\&. If the signer comes from a JDK 1\&.1 identity database instead of from a keystore, then the alias name displays in brackets instead of parentheses\&.
+.TP
+-certchain \fIfile\fR
 .br
-One reason the hash of the manifest file that is stored in the .SF file header may not equal the hash of the current manifest file would be because one or more files were added to the JAR file (using the \f2jar\fP tool) after the signature (and thus the .SF file) was generated. When the \f2jar\fP tool is used to add files, the manifest file is changed (sections are added to it for the new files), but the .SF file is not. A verification is still considered successful if none of the files that were in the JAR file when the signature was generated have been changed since then, which is the case if the hashes in the non\-header sections of the .SF file equal the hashes of the corresponding sections in the manifest file.
-.TP 3
-3.
-Read each file in the JAR file that has an entry in the .SF file. While reading, compute the file's digest, and then compare the result with the digest for this file in the manifest section. The digests should be the same, or verification fails.
-.RE
+Specifies the certificate chain to be used when the certificate chain associated with the private key of the keystore entry that is addressed by the alias specified on the command line is not complete\&. This can happen when the keystore is located on a hardware token where there is not enough capacity to hold a complete certificate chain\&. The file can be a sequence of concatenated X\&.509 certificates, or a single PKCS#7 formatted data block, either in binary encoding format or in printable encoding format (also known as Base64 encoding) as defined by the Internet RFC 1421 standard\&. See the section Internet RFC 1421 Certificate Encoding Standard in \f3keytool\fR and http://tools\&.ietf\&.org/html/rfc1421\&.
+.TP
+-verbose
+.br
+When the \f3-verbose\fR option appears on the command line, it indicates verbose mode, which causes \f3jarsigner\fR to output extra information about the progress of the JAR signing or verification\&.
+.TP
+-internalsf
+.br
+In the past, the \f3\&.DSA\fR (signature block) file generated when a JAR file was signed included a complete encoded copy of the \f3\&.SF\fR file (signature file) also generated\&. This behavior has been changed\&. To reduce the overall size of the output JAR file, the \f3\&.DSA\fR file by default does not contain a copy of the \f3\&.SF\fR file anymore\&. If \f3-internalsf\fR appears on the command line, then the old behavior is utilized\&. This option is useful for testing\&. In practice, do not use the \f3-internalsf\fR option because it incurs higher overhead\&.
+.TP
+-sectionsonly
+.br
+If the \f3-sectionsonly\fR option appears on the command line, then the \f3\&.SF\fR file (signature file) generated when a JAR file is signed does not include a header that contains a hash of the whole manifest file\&. It contains only the information and hashes related to each individual source file included in the JAR file\&. See Signature File\&.
 
-.LP
-.LP
-If any serious verification failures occur during the verification process, the process is stopped and a security exception is thrown. It is caught and displayed by \f3jarsigner\fP.
-.LP
-.SS
-Multiple Signatures for a JAR File
-.LP
-.LP
-A JAR file can be signed by multiple people simply by running the \f3jarsigner\fP tool on the file multiple times, specifying the alias for a different person each time, as in:
-.LP
-.nf
-\f3
-.fl
-  jarsigner myBundle.jar susan
-.fl
-  jarsigner myBundle.jar kevin
-.fl
-\fP
-.fi
+By default, this header is added, as an optimization\&. When the header is present, whenever the JAR file is verified, the verification can first check to see whether the hash in the header matches the hash of the whole manifest file\&. When there is a match, verification proceeds to the next step\&. When there is no match, it is necessary to do a less optimized verification that the hash in each source file information section in the \f3\&.SF\fR file equals the hash of its corresponding section in the manifest file\&. See JAR File Verification\&.
 
-.LP
-.LP
-When a JAR file is signed multiple times, there are multiple .SF and .DSA files in the resulting JAR file, one pair for each signature. Thus, in the example above, the output JAR file includes files with the following names:
-.LP
-.nf
-\f3
-.fl
-  SUSAN.SF
-.fl
-  SUSAN.DSA
-.fl
-  KEVIN.SF
-.fl
-  KEVIN.DSA
-.fl
-\fP
-.fi
+The \f3-sectionsonly\fR option is primarily used for testing\&. It should not be used other than for testing because using it incurs higher overhead\&.
+.TP
+-protected
+.br
+Values can be either \f3true\fR or \f3false\fR\&. Specify \f3true\fR when a password must be specified through a protected authentication path such as a dedicated PIN reader\&.
+.TP
+-providerClass \fIprovider-class-name\fR
+.br
+Used to specify the name of cryptographic service provider\&'s master class file when the service provider is not listed in the \f3java\&.security\fR security properties file\&.
 
-.LP
-.LP
-Note: It is also possible for a JAR file to have mixed signatures, some generated by the JDK 1.1 \f3javakey\fP tool and others by \f3jarsigner\fP. That is, \f3jarsigner\fP can be used to sign JAR files already previously signed using \f3javakey\fP.
-.LP
-.SH "OPTIONS"
-.LP
-.LP
-The various \f3jarsigner\fP options are listed and described below. Note:
-.LP
-.RS 3
-.TP 2
-o
-All option names are preceded by a minus sign (\-).
-.TP 2
-o
-The options may be provided in any order.
-.TP 2
-o
-Items in italics (option values) represent the actual values that must be supplied.
-.TP 2
-o
-The \f2\-keystore\fP, \f2\-storepass\fP, \f2\-keypass\fP, \f2\-sigfile\fP, \f2\-sigalg\fP, \f2\-digestalg\fP, and \f2\-signedjar\fP options are only relevant when signing a JAR file, not when verifying a signed JAR file. Similarly, an alias is only specified on the command line when signing a JAR file.
-.RE
+Used with the \f3-providerArg ConfigFilePath\fR option, the \f3keytool\fR and \f3jarsigner\fR tools install the provider dynamically and use \fIConfigFilePath\fR for the path to the token configuration file\&. The following example shows a command to list a \f3PKCS #11\fR keystore when the Oracle PKCS #11 provider was not configured in the security properties file\&.
+.sp     
+.nf     
+\f3jarsigner \-keystore NONE \-storetype PKCS11 \e\fP
+.fi     
+.nf     
+\f3          \-providerClass sun\&.security\&.pkcs11\&.SunPKCS11 \e\fP
+.fi     
+.nf     
+\f3          \-providerArg /mydir1/mydir2/token\&.config \e\fP
+.fi     
+.nf     
+\f3          \-list\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
 
-.LP
-.RS 3
-.TP 3
-\-keystore url
-Specifies the URL that tells the keystore location. This defaults to the file \f2.keystore\fP in the user's home directory, as determined by the "user.home" system property.
+.TP
+-providerName \fIproviderName\fR
 .br
+If more than one provider was configured in the \f3java\&.security\fR security properties file, then you can use the \f3-providerName\fR option to target a specific provider instance\&. The argument to this option is the name of the provider\&.
+
+For the Oracle PKCS #11 provider, \fIproviderName\fR is of the form \f3SunPKCS11-\fR\fITokenName\fR, where \fITokenName\fR is the name suffix that the provider instance has been configured with, as detailed in the configuration attributes table\&. For example, the following command lists the contents of the \f3PKCS #11\fR keystore provider instance with name suffix \f3SmartCard\fR:
+.sp     
+.nf     
+\f3jarsigner \-keystore NONE \-storetype PKCS11 \e\fP
+.fi     
+.nf     
+\f3        \-providerName SunPKCS11\-SmartCard \e\fP
+.fi     
+.nf     
+\f3        \-list\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+
+.TP
+-J\fIjavaoption\fR
 .br
-A keystore is required when signing, so you must explicitly specify one if the default keystore does not exist (or you want to use one other than the default).
+Passes through the specified \fIjavaoption\fR string directly to the Java interpreter\&. The \f3jarsigner\fR command is a wrapper around the interpreter\&. This option should not contain any spaces\&. It is useful for adjusting the execution environment or memory usage\&. For a list of possible interpreter options, type \f3java -h\fR or \f3java -X\fR at the command line\&.
+.TP
+-tsa \fIurl\fR
 .br
+If \f3-tsa http://example\&.tsa\&.url\fR appears on the command line when signing a JAR file then a time stamp is generated for the signature\&. The URL, \f3http://example\&.tsa\&.url\fR, identifies the location of the Time Stamping Authority (TSA) and overrides any URL found with the \f3-tsacert\fR option\&. The \f3-tsa\fR option does not require the TSA public key certificate to be present in the keystore\&.
+
+To generate the time stamp, \f3jarsigner\fR communicates with the TSA with the Time-Stamp Protocol (TSP) defined in RFC 3161\&. When successful, the time stamp token returned by the TSA is stored with the signature in the signature block file\&.
+.TP
+-tsacert \fIalias\fR
 .br
-A keystore is \f2not\fP required when verifying, but if one is specified, or the default exists, and the \f2\-verbose\fP option was also specified, additional information is output regarding whether or not any of the certificates used to verify the JAR file are contained in that keystore.
+When \f3-tsacert alias\fR appears on the command line when signing a JAR file, a time stamp is generated for the signature\&. The alias identifies the TSA public key certificate in the keystore that is in effect\&. The entry\&'s certificate is examined for a Subject Information Access extension that contains a URL identifying the location of the TSA\&.
+
+The TSA public key certificate must be present in the keystore when using the \f3-tsacert\fR option\&.
+.TP
+-tsapolicyid \fIpolicyid\fR
 .br
+Specifies the object identifier (OID) that identifies the policy ID to be sent to the TSA server\&. If this option is not specified, no policy ID is sent and the TSA server will choose a default policy ID\&.
+
+Object identifiers are defined by X\&.696, which is an ITU Telecommunication Standardization Sector (ITU-T) standard\&. These identifiers are typically period-separated sets of non-negative digits like \f31\&.2\&.3\&.4\fR, for example\&.
+.TP
+-altsigner \fIclass\fR
 .br
-Note: the \f2\-keystore\fP argument can actually be a file name (and path) specification rather than a URL, in which case it will be treated the same as a "file:" URL. That is,
-.nf
-\f3
-.fl
-  \-keystore \fP\f4filePathAndName\fP\f3
-.fl
-\fP
-.fi
-is treated as equivalent to
-.nf
-\f3
-.fl
-  \-keystore file:\fP\f4filePathAndName\fP\f3
-.fl
-\fP
-.fi
-If the Sun PKCS#11 provider has been configured in the \f2java.security\fP security properties file (located in the JRE's \f2$JAVA_HOME/lib/security\fP directory), then keytool and jarsigner can operate on the PKCS#11 token by specifying these options:
-.RS 3
-.TP 2
-o
-\f2\-keystore NONE\fP
-.TP 2
-o
-\f2\-storetype PKCS11\fP
-.RE
-For example, this command lists the contents of the configured PKCS#11 token:
-.nf
-\f3
-.fl
-   jarsigner \-keystore NONE \-storetype PKCS11 \-list
-.fl
-\fP
-.fi
-.TP 3
-\-storetype storetype
-Specifies the type of keystore to be instantiated. The default keystore type is the one that is specified as the value of the "keystore.type" property in the security properties file, which is returned by the static \f2getDefaultType\fP method in \f2java.security.KeyStore\fP.
+This option specifies an alternative signing mechanism\&. The fully qualified class name identifies a class file that extends the \f3com\&.sun\&.jarsigner\&.ContentSigner\fR abstract class\&. The path to this class file is defined by the \f3-altsignerpath\fR option\&. If the \f3-altsigner\fR option is used, then the \f3jarsigner\fR command uses the signing mechanism provided by the specified class\&. Otherwise, the \f3jarsigner\fR command uses its default signing mechanism\&.
+
+For example, to use the signing mechanism provided by a class named \f3com\&.sun\&.sun\&.jarsigner\&.AuthSigner\fR, use the jarsigner option \f3-altsigner com\&.sun\&.jarsigner\&.AuthSigner\fR\&.
+.TP
+-altsignerpath \fIclasspathlist\fR
 .br
+Specifies the path to the class file and any JAR file it depends on\&. The class file name is specified with the \f3-altsigner\fR option\&. If the class file is in a JAR file, then this option specifies the path to that JAR file\&.
+
+An absolute path or a path relative to the current directory can be specified\&. If \fIclasspathlist\fR contains multiple paths or JAR files, then they should be separated with a colon (:) on Oracle Solaris and a semicolon (;) on Windows\&. This option is not necessary when the class is already in the search path\&.
+
+The following example shows how to specify the path to a JAR file that contains the class file\&. The JAR file name is included\&.
+.sp     
+.nf     
+\f3\-altsignerpath /home/user/lib/authsigner\&.jar\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+
+
+The following example shows how to specify the path to the JAR file that contains the class file\&. The JAR file name is omitted\&.
+.sp     
+.nf     
+\f3\-altsignerpath /home/user/classes/com/sun/tools/jarsigner/\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+
+.TP
+-strict
 .br
-The PIN for a PCKS#11 token can also be specified using the \f2\-storepass\fP option. If none has been specified, keytool and jarsigner will prompt for the token PIN. If the token has a protected authentication path (such as a dedicated PIN\-pad or a biometric reader), then the \f2\-protected\fP option must be specified and no password options can be specified.
-.TP 3
-\-storepass[:env | :file] argument
-Specifies the password which is required to access the keystore. This is only needed when signing (not verifying) a JAR file. In that case, if a \f2\-storepass\fP option is not provided at the command line, the user is prompted for the password.
+During the signing or verifying process, the command may issue warning messages\&. If you specify this option, the exit code of the tool reflects the severe warning messages that this command found\&. See Errors and Warnings\&.
+.TP
+-verbose \fIsuboptions\fR
 .br
-.br
-If the modifier \f2env\fP or \f2file\fP is not specified, then the password has the value \f2argument\fP. Otherwise, the password is retrieved as follows:
-.RS 3
-.TP 2
-o
-\f2env\fP: Retrieve the password from the environment variable named \f2argument\fP
-.TP 2
-o
-\f2file\fP: Retrieve the password from the file named \f2argument\fP
-.RE
-Note: The password shouldn't be specified on the command line or in a script unless it is for testing purposes, or you are on a secure system.
-.TP 3
-\-keypass[:env | :file] argument
-Specifies the password used to protect the private key of the keystore entry addressed by the alias specified on the command line. The password is required when using \f3jarsigner\fP to sign a JAR file. If no password is provided on the command line, and the required password is different from the store password, the user is prompted for it.
-.br
-.br
-If the modifier \f2env\fP or \f2file\fP is not specified, then the password has the value \f2argument\fP. Otherwise, the password is retrieved as follows:
-.RS 3
-.TP 2
-o
-\f2env\fP: Retrieve the password from the environment variable named \f2argument\fP
-.TP 2
-o
-\f2file\fP: Retrieve the password from the file named \f2argument\fP
-.RE
-Note: The password shouldn't be specified on the command line or in a script unless it is for testing purposes, or you are on a secure system.
-.TP 3
-\-sigfile file
-Specifies the base file name to be used for the generated .SF and .DSA files. For example, if \f2file\fP is "DUKESIGN", the generated .SF and .DSA files will be named "DUKESIGN.SF" and "DUKESIGN.DSA", and will be placed in the "META\-INF" directory of the signed JAR file.
-.br
-.br
-The characters in \f2file\fP must come from the set "a\-zA\-Z0\-9_\-". That is, only letters, numbers, underscore, and hyphen characters are allowed. Note: All lowercase characters will be converted to uppercase for the .SF and .DSA file names.
-.br
-.br
-If no \f2\-sigfile\fP option appears on the command line, the base file name for the .SF and .DSA files will be the first 8 characters of the alias name specified on the command line, all converted to upper case. If the alias name has fewer than 8 characters, the full alias name is used. If the alias name contains any characters that are not legal in a signature file name, each such character is converted to an underscore ("_") character in forming the file name.
-.TP 3
-\-sigalg algorithm
-Specifies the name of the signature algorithm to use to sign the JAR file.
-.br
-.br
-See
-.na
-\f2Appendix A\fP @
-.fi
-http://download.oracle.com/javase/7/docs/technotes/guides/security/crypto/CryptoSpec.html#AppA of the Java Cryptography Architecture for a list of standard signature algorithm names. This algorithm must be compatible with the private key used to sign the JAR file. If this option is not specified, SHA1withDSA, SHA256withRSA, or SHA256withECDSA will be used depending on the type of private key. There must either be a statically installed provider supplying an implementation of the specified algorithm or the user must specify one with the \f2\-providerClass\fP option, otherwise the command will not succeed.
-.TP 3
-\-digestalg algorithm
-Specifies the name of the message digest algorithm to use when digesting the entries of a jar file.
-.br
-.br
-See
-.na
-\f2Appendix A\fP @
-.fi
-http://download.oracle.com/javase/7/docs/technotes/guides/security/crypto/CryptoSpec.html#AppA of the Java Cryptography Architecture for a list of standard message digest algorithm names. If this option is not specified, SHA256 will be used. There must either be a statically installed provider supplying an implementation of the specified algorithm or the user must specify one with the \f2\-providerClass\fP option, otherwise the command will not succeed.
-.TP 3
-\-signedjar file
-Specifies the name to be used for the signed JAR file.
-.br
-.br
-If no name is specified on the command line, the name used is the same as the input JAR file name (the name of the JAR file to be signed); in other words, that file is overwritten with the signed JAR file.
-.TP 3
-\-verify
-If this appears on the command line, the specified JAR file will be verified, not signed. If the verification is successful, "jar verified" will be displayed. If you try to verify an unsigned JAR file, or a JAR file signed with an unsupported algorithm (e.g., RSA when you don't have an RSA provider installed), the following is displayed: "jar is unsigned. (signatures missing or not parsable)"
-.br
-.br
-It is possible to verify JAR files signed using either \f3jarsigner\fP or the JDK 1.1 \f3javakey\fP tool, or both.
-.br
-.br
-For further information on verification, see JAR File Verification.
-.TP 3
-\-certs
-If this appears on the command line, along with the \f2\-verify\fP and \f2\-verbose\fP options, the output includes certificate information for each signer of the JAR file. This information includes
-.RS 3
-.TP 2
-o
-the name of the type of certificate (stored in the .DSA file) that certifies the signer's public key
-.TP 2
-o
-if the certificate is an X.509 certificate (more specifically, an instance of \f2java.security.cert.X509Certificate\fP): the distinguished name of the signer
-.RE
-The keystore is also examined. If no keystore value is specified on the command line, the default keystore file (if any) will be checked. If the public key certificate for a signer matches an entry in the keystore, then the following information will also be displayed:
-.RS 3
-.TP 2
-o
-in parentheses, the alias name for the keystore entry for that signer. If the signer actually comes from a JDK 1.1 identity database instead of from a keystore, the alias name will appear in brackets instead of parentheses.
-.RE
-.TP 3
-\-certchain file
-Specifies the certificate chain to be used, if the certificate chain associated with the private key of the keystore entry, addressed by the alias specified on the command line, is not complete. This may happen if the keystore is located on a hardware token where there is not enough capacity to hold a complete certificate chain. The file can be a sequence of X.509 certificates concatenated together, or a single PKCS#7 formatted data block, either in binary encoding format or in printable encoding format (also known as BASE64 encoding) as defined by the Internet RFC 1421 standard.
-.TP 3
-\-verbose
-If this appears on the command line, it indicates "verbose" mode, which causes \f3jarsigner\fP to output extra information as to the progress of the JAR signing or verification.
-.TP 3
-\-internalsf
-In the past, the .DSA (signature block) file generated when a JAR file was signed used to include a complete encoded copy of the .SF file (signature file) also generated. This behavior has been changed. To reduce the overall size of the output JAR file, the .DSA file by default doesn't contain a copy of the .SF file anymore. But if \f2\-internalsf\fP appears on the command line, the old behavior is utilized. \f3This option is mainly useful for testing; in practice, it should not be used, since doing so eliminates a useful optimization.\fP
-.TP 3
-\-sectionsonly
-If this appears on the command line, the .SF file (signature file) generated when a JAR file is signed does \f2not\fP include a header containing a hash of the whole manifest file. It just contains information and hashes related to each individual source file included in the JAR file, as described in The Signature (.SF) File .
-.br
-.br
-By default, this header is added, as an optimization. When the header is present, then whenever the JAR file is verified, the verification can first check to see whether or not the hash in the header indeed matches the hash of the whole manifest file. If so, verification proceeds to the next step. If not, it is necessary to do a less optimized verification that the hash in each source file information section in the .SF file equals the hash of its corresponding section in the manifest file.
-.br
-.br
-For further information, see JAR File Verification.
-.br
-.br
-\f3This option is mainly useful for testing; in practice, it should not be used, since doing so eliminates a useful optimization.\fP
-.TP 3
-\-protected
-Either \f2true\fP or \f2false\fP. This value should be specified as \f2true\fP if a password must be given via a protected authentication path such as a dedicated PIN reader.
-.TP 3
-\-providerClass provider\-class\-name
-Used to specify the name of cryptographic service provider's master class file when the service provider is not listed in the security properties file, \f2java.security\fP.
-.br
-.br
-Used in conjunction with the \f2\-providerArg\fP \f2ConfigFilePath\fP option, keytool and jarsigner will install the provider dynamically (where \f2ConfigFilePath\fP is the path to the token configuration file). Here's an example of a command to list a PKCS#11 keystore when the Sun PKCS#11 provider has not been configured in the security properties file.
-.nf
-\f3
-.fl
-jarsigner \-keystore NONE \-storetype PKCS11 \\
-.fl
-          \-providerClass sun.security.pkcs11.SunPKCS11 \\
-.fl
-          \-providerArg /foo/bar/token.config \\
-.fl
-          \-list
-.fl
-\fP
-.fi
-.TP 3
-\-providerName providerName
-If more than one provider has been configured in the \f2java.security\fP security properties file, you can use the \f2\-providerName\fP option to target a specific provider instance. The argument to this option is the name of the provider.
-.br
-.br
-For the Sun PKCS#11 provider, \f2providerName\fP is of the form \f2SunPKCS11\-\fP\f2TokenName\fP, where \f2TokenName\fP is the name suffix that the provider instance has been configured with, as detailed in the
-.na
-\f2configuration attributes table\fP @
-.fi
-http://download.oracle.com/javase/7/docs/technotes/guides/security/p11guide.html#ATTRS. For example, the following command lists the contents of the PKCS#11 keystore provider instance with name suffix \f2SmartCard\fP:
-.nf
-\f3
-.fl
-jarsigner \-keystore NONE \-storetype PKCS11 \\
-.fl
-        \-providerName SunPKCS11\-SmartCard \\
-.fl
-        \-list
-.fl
-\fP
-.fi
-.TP 3
-\-Jjavaoption
-Passes through the specified \f2javaoption\fP string directly to the Java interpreter. (\f3jarsigner\fP is actually a "wrapper" around the interpreter.) This option should not contain any spaces. It is useful for adjusting the execution environment or memory usage. For a list of possible interpreter options, type \f2java \-h\fP or \f2java \-X\fP at the command line.
-.TP 3
-\-tsa url
-If \f2"\-tsa http://example.tsa.url"\fP appears on the command line when signing a JAR file then a timestamp is generated for the signature. The URL, \f2http://example.tsa.url\fP, identifies the location of the Time Stamping Authority (TSA). It overrides any URL found via the \f2\-tsacert\fP option. The \f2\-tsa\fP option does not require the TSA's public key certificate to be present in the keystore.
-.br
-.br
-To generate the timestamp, \f2jarsigner\fP communicates with the TSA using the Time\-Stamp Protocol (TSP) defined in
-.na
-\f2RFC 3161\fP @
-.fi
-http://www.ietf.org/rfc/rfc3161.txt. If successful, the timestamp token returned by the TSA is stored along with the signature in the signature block file.
-.TP 3
-\-tsacert alias
-If \f2"\-tsacert alias"\fP appears on the command line when signing a JAR file then a timestamp is generated for the signature. The \f2alias\fP identifies the TSA's public key certificate in the keystore that is currently in effect. The entry's certificate is examined for a Subject Information Access extension that contains a URL identifying the location of the TSA.
-.br
-.br
-The TSA's public key certificate must be present in the keystore when using \f2\-tsacert\fP.
-.TP 3
-\-altsigner class
-Specifies that an alternative signing mechanism be used. The fully\-qualified class name identifies a class file that extends the \f2com.sun.jarsigner.ContentSigner abstract class\fP. The path to this class file is defined by the \f2\-altsignerpath\fP option. If the \f2\-altsigner\fP option is used, \f2jarsigner\fP uses the signing mechanism provided by the specified class. Otherwise, \f2jarsigner\fP uses its default signing mechanism.
-.br
-.br
-For example, to use the signing mechanism provided by a class named \f2com.sun.sun.jarsigner.AuthSigner\fP, use the \f2jarsigner\fP option \f2"\-altsigner com.sun.jarsigner.AuthSigner"\fP
-.TP 3
-\-altsignerpath classpathlist
-Specifies the path to the class file (the class file name is specified with the \f2\-altsigner\fP option described above) and any JAR files it depends on. If the class file is in a JAR file, then this specifies the path to that JAR file, as shown in the example below.
-.br
-.br
-An absolute path or a path relative to the current directory may be specified. If \f2classpathlist\fP contains multiple paths or JAR files, they should be separated with a colon (\f2:\fP) on Solaris and a semi\-colon (\f2;\fP) on Windows. This option is not necessary if the class is already in the search path.
-.br
-.br
-Example of specifying the path to a jar file that contains the class file:
-.nf
-\f3
-.fl
-\-altsignerpath /home/user/lib/authsigner.jar
-.fl
-\fP
-.fi
-Note that the JAR file name is included.
-.br
-.br
-Example of specifying the path to the jar file that contains the class file:
-.nf
-\f3
-.fl
-\-altsignerpath /home/user/classes/com/sun/tools/jarsigner/
-.fl
-\fP
-.fi
-Note that the JAR file name is omitted.
-.TP 3
-\-strict
-During the signing or verifying process, some warning messages may be shown. If this option appears on the command line, the exit code of the tool will reflect the warning messages that are found. Read the "WARNINGS" section for details.
-.TP 3
-\-verbose:sub\-options
-For the verifying process, the \f2\-verbose\fP option takes sub\-options to determine how much information will be shown. If \f2\-certs\fP is also specified, the default mode (or sub\-option all) displays each entry as it is being processed and following that, the certificate information for each signer of the JAR file. If \f2\-certs\fP and the \f2\-verbose:grouped\fP sub\-option are specified, entries with the same signer info are grouped and displayed together along with their certificate information. If \f2\-certs\fP and the \f2\-verbose:summary\fP sub\-option are specified, then entries with the same signer info are grouped and displayed together along with their certificate information but details about each entry are summarized and displayed as "one entry (and more)". See the examples section for more information.
-.RE
+For the verifying process, the \f3-verbose\fR option takes suboptions to determine how much information is shown\&. If the \f3-certs\fR option is also specified, then the default mode (or suboption \f3all\fR) displays each entry as it is being processed, and after that, the certificate information for each signer of the JAR file\&. If the \f3-certs\fR and the \f3-verbose:grouped\fR suboptions are specified, then entries with the same signer info are grouped and displayed together with their certificate information\&. If \f3-certs\fR and the \f3-verbose:summary\fR suboptions are specified, then entries with the same signer information are grouped and displayed together with their certificate information\&. Details about each entry are summarized and displayed as \fIone entry (and more)\fR\&. See Examples\&.
+.SH ERRORS\ AND\ WARNINGS    
+During the signing or verifying process, the \f3jarsigner\fR command may issue various errors or warnings\&.
+.PP
+If there is a failure, the \f3jarsigner\fR command exits with code 1\&. If there is no failure, but there are one or more severe warnings, the \f3jarsigner\fR command exits with code 0 when the \f3-strict\fR option is \fInot\fR specified, or exits with the OR-value of the warning codes when the \f3-strict\fR is specified\&. If there is only informational warnings or no warning at all, the command always exits with code 0\&.
+.PP
+For example, if a certificate used to sign an entry is expired and has a KeyUsage extension that does not allow it to sign a file, the \f3jarsigner\fR command exits with code 12 (=4+8) when the \f3-strict\fR option is specified\&.
+.PP
+\fINote:\fR Exit codes are reused because only the values from 0 to 255 are legal on Unix-based operating systems\&.
+.PP
+The following sections describes the names, codes, and descriptions of the errors and warnings that the \f3jarsigner\fR command can issue\&.
+.SS FAILURE    
+Reasons why the \f3jarsigner\fR command fails include (but are not limited to) a command line parsing error, the inability to find a keypair to sign the JAR file, or the verification of a signed JAR fails\&.
+.TP     
+failure
+Code 1\&. The signing or verifying fails\&.
+.SS SEVERE\ WARNINGS    
+\fINote:\fR Severe warnings are reported as errors if you specify the \f3-strict\fR option\&.
+.PP
+Reasons why the \f3jarsigner\fR command issues a severe warning include the certificate used to sign the JAR file has an error or the signed JAR file has other problems\&.
+.TP     
+hasExpiredCert
+Code 4\&. This jar contains entries whose signer certificate has expired\&.
+.TP     
+notYetValidCert
+Code 4\&. This jar contains entries whose signer certificate is not yet valid\&.
+.TP     
+chainNotValidated
+Code 4\&. This jar contains entries whose certificate chain cannot be correctly validated\&.
+.TP     
+badKeyUsage
+Code 8\&. This jar contains entries whose signer certificate\&'s KeyUsage extension doesn\&'t allow code signing\&.
+.TP     
+badExtendedKeyUsage
+Code 8\&. This jar contains entries whose signer certificate\&'s ExtendedKeyUsage extension doesn\&'t allow code signing\&.
+.TP     
+badNetscapeCertType
+Code 8\&. This jar contains entries whose signer certificate\&'s NetscapeCertType extension doesn\&'t allow code signing\&.
+.TP     
+hasUnsignedEntry
+Code 16\&. This jar contains unsigned entries which have not been integrity-checked\&.
+.TP     
+notSignedByAlias
+Code 32\&. This jar contains signed entries which are not signed by the specified alias(es)\&.
+.TP     
+aliasNotInStore
+Code 32\&. This jar contains signed entries that are not signed by alias in this keystore\&.
+.SS INFORMATIONAL\ WARNINGS    
+Informational warnings include those that are not errors but regarded as bad practice\&. They do not have a code\&.
+.TP     
+hasExpiringCert
+This jar contains entries whose signer certificate will expire within six months\&.
+.TP     
+noTimestamp
+This jar contains signatures that does not include a timestamp\&. Without a timestamp, users may not be able to validate this JAR file after the signer certificate\&'s expiration date (\f3YYYY-MM-DD\fR) or after any future revocation date\&.
+.SH EXAMPLES    
+.SS SIGN\ A\ JAR\ FILE    
+Use the following command to sign bundle\&.jar with the private key of a user whose keystore alias is \f3jane\fR in a keystore named \f3mystore\fR in the \f3working\fR directory and name the signed JAR file \f3sbundle\&.jar\fR:
+.sp     
+.nf     
+\f3jarsigner \-keystore /working/mystore\fP
+.fi     
+.nf     
+\f3    \-storepass <keystore password>\fP
+.fi     
+.nf     
+\f3    \-keypass <private key password>\fP
+.fi     
+.nf     
+\f3    \-signedjar sbundle\&.jar bundle\&.jar jane\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+There is no \f3-sigfile\fR specified in the previous command so the generated \f3\&.SF\fR and \f3\&.DSA\fR files to be placed in the signed JAR file have default names based on the alias name\&. They are named \f3JANE\&.SF\fR and \f3JANE\&.DSA\fR\&.
+.PP
+If you want to be prompted for the store password and the private key password, then you could shorten the previous command to the following:
+.sp     
+.nf     
+\f3jarsigner \-keystore /working/mystore\fP
+.fi     
+.nf     
+\f3    \-signedjar sbundle\&.jar bundle\&.jar jane\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+If the keystore is the default keystore (\&.keystore in your home directory), then you do not need to specify a keystore, as follows:
+.sp     
+.nf     
+\f3jarsigner \-signedjar sbundle\&.jar bundle\&.jar jane\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+If you want the signed JAR file to overwrite the input JAR file (bundle\&.jar), then you do not need to specify a \f3-signedjar\fR option, as follows:
+.sp     
+.nf     
+\f3jarsigner bundle\&.jar jane\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+.SS VERIFY\ A\ SIGNED\ JAR\ FILE    
+To verify a signed JAR file to ensure that the signature is valid and the JAR file was not been tampered with, use a command such as the following:
+.sp     
+.nf     
+\f3jarsigner \-verify sbundle\&.jar\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+When the verification is successful, \f3jar verified\fR is displayed\&. Otherwise, an error message is displayed\&. You can get more information when you use the \f3-verbose\fR option\&. A sample use of \f3jarsigner\fR with the\f3-verbose\fR option follows:
+.sp     
+.nf     
+\f3jarsigner \-verify \-verbose sbundle\&.jar\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.nf     
+\f3           198 Fri Sep 26 16:14:06 PDT 1997 META\-INF/MANIFEST\&.MF\fP
+.fi     
+.nf     
+\f3           199 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE\&.SF\fP
+.fi     
+.nf     
+\f3          1013 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE\&.DSA\fP
+.fi     
+.nf     
+\f3    smk   2752 Fri Sep 26 16:12:30 PDT 1997 AclEx\&.class\fP
+.fi     
+.nf     
+\f3    smk    849 Fri Sep 26 16:12:46 PDT 1997 test\&.class\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.nf     
+\f3      s = signature was verified\fP
+.fi     
+.nf     
+\f3      m = entry is listed in manifest\fP
+.fi     
+.nf     
+\f3      k = at least one certificate was found in keystore\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.nf     
+\f3    jar verified\&.\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+.SS VERIFICATION\ WITH\ CERTIFICATE\ INFORMATION    
+If you specify the \f3-certs\fR option with the \f3-verify\fR and \f3-verbose\fR options, then the output includes certificate information for each signer of the JAR file\&. The information includes the certificate type, the signer distinguished name information (when it is an X\&.509 certificate), and in parentheses, the keystore alias for the signer when the public key certificate in the JAR file matches the one in a keystore entry, for example:
+.sp     
+.nf     
+\f3jarsigner \-keystore /working/mystore \-verify \-verbose \-certs myTest\&.jar\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.nf     
+\f3           198 Fri Sep 26 16:14:06 PDT 1997 META\-INF/MANIFEST\&.MF\fP
+.fi     
+.nf     
+\f3           199 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE\&.SF\fP
+.fi     
+.nf     
+\f3          1013 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE\&.DSA\fP
+.fi     
+.nf     
+\f3           208 Fri Sep 26 16:23:30 PDT 1997 META\-INF/JAVATEST\&.SF\fP
+.fi     
+.nf     
+\f3          1087 Fri Sep 26 16:23:30 PDT 1997 META\-INF/JAVATEST\&.DSA\fP
+.fi     
+.nf     
+\f3    smk   2752 Fri Sep 26 16:12:30 PDT 1997 Tst\&.class\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.nf     
+\f3      X\&.509, CN=Test Group, OU=Java Software, O=Oracle, L=CUP, S=CA, C=US (javatest)\fP
+.fi     
+.nf     
+\f3      X\&.509, CN=Jane Smith, OU=Java Software, O=Oracle, L=cup, S=ca, C=us (jane)\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.nf     
+\f3      s = signature was verified\fP
+.fi     
+.nf     
+\f3      m = entry is listed in manifest\fP
+.fi     
+.nf     
+\f3      k = at least one certificate was found in keystore\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.nf     
+\f3    jar verified\&.\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+If the certificate for a signer is not an X\&.509 certificate, then there is no distinguished name information\&. In that case, just the certificate type and the alias are shown\&. For example, if the certificate is a PGP certificate, and the alias is \f3bob\fR, then you would get: \f3PGP, (bob)\fR\&.
+.SS VERIFICATION\ THAT\ INCLUDES\ IDENTITY\ DATABASE\ SIGNERS    
+If a JAR file was signed with the JDK 1\&.1 \f3javakey\fR tool, and the signer is an alias in an identity database, then the verification output includes an \f3i\fR\&. If the JAR file was signed by both an alias in an identity database and an alias in a keystore, then both \f3k\fR and \f3i\fR appear\&.
+.PP
+When the \f3-certs\fR option is used, any identity database aliases are shown in brackets rather than the parentheses used for keystore aliases, for example:
+.sp     
+.nf     
+\f3    jarsigner \-keystore /working/mystore \-verify \-verbose \-certs writeFile\&.jar\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.nf     
+\f3           198 Fri Sep 26 16:14:06 PDT 1997 META\-INF/MANIFEST\&.MF\fP
+.fi     
+.nf     
+\f3           199 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE\&.SF\fP
+.fi     
+.nf     
+\f3          1013 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE\&.DSA\fP
+.fi     
+.nf     
+\f3           199 Fri Sep 27 12:22:30 PDT 1997 META\-INF/DUKE\&.SF\fP
+.fi     
+.nf     
+\f3          1013 Fri Sep 27 12:22:30 PDT 1997 META\-INF/DUKE\&.DSA\fP
+.fi     
+.nf     
+\f3   smki   2752 Fri Sep 26 16:12:30 PDT 1997 writeFile\&.html\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.nf     
+\f3      X\&.509, CN=Jane Smith, OU=Java Software, O=Oracle, L=cup, S=ca, C=us (jane)\fP
+.fi     
+.nf     
+\f3      X\&.509, CN=Duke, OU=Java Software, O=Oracle, L=cup, S=ca, C=us [duke]\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.nf     
+\f3      s = signature was verified\fP
+.fi     
+.nf     
+\f3      m = entry is listed in manifest\fP
+.fi     
+.nf     
+\f3      k = at least one certificate was found in keystore\fP
+.fi     
+.nf     
+\f3      i = at least one certificate was found in identity scope\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.nf     
+\f3    jar verified\&.\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+\fINote:\fR The alias \f3duke\fR is in brackets to denote that it is an identity database alias, and not a keystore alias\&.
+.SH JDK\ 1\&.1\ COMPATIBILITY    
+The \f3keytool\fR and \f3jarsigner\fR tools replace the \f3javakey\fR tool in JDK 1\&.1\&. These new tools provide more features than \f3javakey\fR, including the ability to protect the keystore and private keys with passwords, and the ability to verify signatures in addition to generating them\&.
+.PP
+The new keystore architecture replaces the identity database that \f3javakey\fR created and managed\&. There is no backward compatibility between the keystore format and the database format used by \f3javakey\fR in JDK 1\&.1\&. However, be aware of the following:
+.TP 0.2i    
+\(bu
+It is possible to import the information from an identity database into a keystore through the \f3keytool -identitydb\fR command\&.
+.TP 0.2i    
+\(bu
+The \f3jarsigner\fR command can sign JAR files that were signed with the \f3javakey\fR command\&.
+.TP 0.2i    
+\(bu
+The \f3jarsigner\fR command can verify JAR files signed with \f3javakey\fR\&. The \f3jarsigner\fR command recognizes and can work with signer aliases that are from a JDK 1\&.1 identity database rather than a JDK keystore\&.
+.SS UNSIGNED\ JARS    
+Unsigned JARs have the default privileges that are granted to all code\&.
+.SS SIGNED\ JARS    
+Signed JARs have the privilege configurations based on their JDK 1\&.1\&.\fIn\fR identity and policy file status as described\&. Only trusted identities can be imported into the JDK keystore\&.
+.PP
+Default Privileges Granted to All Code
 
-.LP
-.SH "EXAMPLES"
-.LP
-.SS
-Signing a JAR File
-.LP
-.LP
-Suppose you have a JAR file named "bundle.jar" and you'd like to sign it using the private key of the user whose keystore alias is "jane" in the keystore named "mystore" in the "working" directory. You can use the following to sign the JAR file and name the signed JAR file "sbundle.jar":
-.LP
-.nf
-\f3
-.fl
-    jarsigner \-keystore /working/mystore \-storepass \fP\f4<keystore password>\fP\f3
-.fl
-      \-keypass \fP\f4<private key password>\fP\f3 \-signedjar sbundle.jar bundle.jar jane
-.fl
-\fP
-.fi
+Identity in 1\&.1 database: \fINo\fR
+.br     
+Trusted identity imported into Java keystore from 1\&.1\&. database: \fINo\fR
+.br     
+Policy file grants privileges to identity/alias: \fINo\fR
+.PP
 
-.LP
-.LP
-Note that there is no \f2\-sigfile\fP specified in the command above, so the generated .SF and .DSA files to be placed in the signed JAR file will have default names based on the alias name. That is, they will be named \f2JANE.SF\fP and \f2JANE.DSA\fP.
-.LP
-.LP
-If you want to be prompted for the store password and the private key password, you could shorten the above command to
-.LP
-.nf
-\f3
-.fl
-    jarsigner \-keystore /working/mystore
-.fl
-      \-signedjar sbundle.jar bundle.jar jane
-.fl
-\fP
-.fi
+.PP
+Identity in 1\&.1 database: \fINo\fR
+.br     
+Trusted identity imported into Java keystore from 1\&.1\&. database: \fIYes\fR
+.br     
+Policy file grants privileges to identity/alias: \fINo\fR
+.PP
 
-.LP
-.LP
-If the keystore to be used is the default keystore (the one named ".keystore" in your home directory), you don't need to specify a keystore, as in:
-.LP
-.nf
-\f3
-.fl
-    jarsigner \-signedjar sbundle.jar bundle.jar jane
-.fl
-\fP
-.fi
+.PP
+Identity in 1\&.1 database: Yes/Untrusted
+.br     
+Trusted identity imported into Java keystore from 1\&.1\&. database: \fINo\fR
+.br     
+Policy file grants privileges to identity/alias: \fINo\fR
+.br     
+See 3 in Notes Regarding Privileges of Signed JARs\&.
+.PP
 
-.LP
-.LP
-Finally, if you want the signed JAR file to simply overwrite the input JAR file (\f2bundle.jar\fP), you don't need to specify a \f2\-signedjar\fP option:
-.LP
-.nf
-\f3
-.fl
-    jarsigner bundle.jar jane
-.fl
-\fP
-.fi
+.PP
+Identity in 1\&.1 database: Yes/Untrusted
+.br     
+Trusted identity imported into Java keystore from 1\&.1\&. database: \fINo\fR
+.br     
+Policy file grants privileges to identity/alias: \fIYes\fR
+.br     
+See 1 and 3 in Notes Regarding Privileges of Signed JARs\&.
+.PP
+Default Privileges and Policy File Privileges Granted
 
-.LP
-.SS
-Verifying a Signed JAR File
-.LP
-.LP
-To verify a signed JAR file, that is, to verify that the signature is valid and the JAR file has not been tampered with, use a command such as the following:
-.LP
-.nf
-\f3
-.fl
-    jarsigner \-verify sbundle.jar
-.fl
-\fP
-.fi
+Identity in 1\&.1 database: \fINo\fR
+.br     
+Trusted identity imported into Java keystore from 1\&.1\&. database: \fIYes\fR
+.br     
+Policy file grants privileges to identity/alias: \fIYes\fR
+.PP
 
-.LP
-.LP
-If the verification is successful,
-.LP
-.nf
-\f3
-.fl
-    jar verified.
-.fl
-\fP
-.fi
+.PP
+Identity in 1\&.1 database: \fIYes/Trusted\fR
+.br     
+Trusted identity imported into Java keystore from 1\&.1\&. database: \fIYes\fR
+.br     
+Policy file grants privileges to identity/alias: \fIYes\fR
+.br     
+See 2 in Notes Regarding Privileges of Signed JARs\&.
+.PP
+All Privileges Granted
 
-.LP
-.LP
-is displayed. Otherwise, an error message appears.
-.LP
-.LP
-You can get more information if you use the \f2\-verbose\fP option. A sample use of \f3jarsigner\fP with the \f2\-verbose\fP option is shown below, along with sample output:
-.LP
-.nf
-\f3
-.fl
-    jarsigner \-verify \-verbose sbundle.jar
-.fl
+Identity in 1\&.1 database: \fIYes/Trusted\fR
+.br     
+Trusted identity imported into Java keystore from 1\&.1\&. database: \fINo\fR
+.br     
+Policy file grants privileges to identity/alias: \fINo\fR
+.PP
 
-.fl
-           198 Fri Sep 26 16:14:06 PDT 1997 META\-INF/MANIFEST.MF
-.fl
-           199 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE.SF
-.fl
-          1013 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE.DSA
-.fl
-    smk   2752 Fri Sep 26 16:12:30 PDT 1997 AclEx.class
-.fl
-    smk    849 Fri Sep 26 16:12:46 PDT 1997 test.class
-.fl
-
-.fl
-      s = signature was verified
-.fl
-      m = entry is listed in manifest
-.fl
-      k = at least one certificate was found in keystore
-.fl
-
-.fl
-    jar verified.
-.fl
-\fP
-.fi
-
-.LP
-.SS
-Verification with Certificate Information
-.LP
-.LP
-If you specify the \f2\-certs\fP option when verifying, along with the \f2\-verify\fP and \f2\-verbose\fP options, the output includes certificate information for each signer of the JAR file, including the certificate type, the signer distinguished name information (if and only if it's an X.509 certificate), and, in parentheses, the keystore alias for the signer if the public key certificate in the JAR file matches that in a keystore entry. For example,
-.LP
-.nf
-\f3
-.fl
-    jarsigner \-keystore /working/mystore \-verify \-verbose \-certs myTest.jar
-.fl
-
-.fl
-           198 Fri Sep 26 16:14:06 PDT 1997 META\-INF/MANIFEST.MF
-.fl
-           199 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE.SF
-.fl
-          1013 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE.DSA
-.fl
-           208 Fri Sep 26 16:23:30 PDT 1997 META\-INF/JAVATEST.SF
-.fl
-          1087 Fri Sep 26 16:23:30 PDT 1997 META\-INF/JAVATEST.DSA
-.fl
-    smk   2752 Fri Sep 26 16:12:30 PDT 1997 Tst.class
-.fl
-
-.fl
-      X.509, CN=Test Group, OU=Java Software, O=Sun Microsystems, L=CUP, S=CA, C=US (javatest)
-.fl
-      X.509, CN=Jane Smith, OU=Java Software, O=Sun, L=cup, S=ca, C=us (jane)
-.fl
-
-.fl
-      s = signature was verified
-.fl
-      m = entry is listed in manifest
-.fl
-      k = at least one certificate was found in keystore
-.fl
-
-.fl
-    jar verified.
-.fl
-\fP
-.fi
-
-.LP
-.LP
-If the certificate for a signer is not an X.509 certificate, there is no distinguished name information. In that case, just the certificate type and the alias are shown. For example, if the certificate is a PGP certificate, and the alias is "bob", you'd get
-.LP
-.nf
-\f3
-.fl
-      PGP, (bob)
-.fl
-\fP
-.fi
-
-.LP
-.SS
-Verification of a JAR File that Includes Identity Database Signers
-.LP
-.LP
-If a JAR file has been signed using the JDK 1.1 \f3javakey\fP tool, and thus the signer is an alias in an identity database, the verification output includes an "i" symbol. If the JAR file has been signed by both an alias in an identity database and an alias in a keystore, both "k" and "i" appear.
-.LP
-.LP
-When the \f2\-certs\fP option is used, any identity database aliases are shown in square brackets rather than the parentheses used for keystore aliases. For example:
-.LP
-.nf
-\f3
-.fl
-    jarsigner \-keystore /working/mystore \-verify \-verbose \-certs writeFile.jar
-.fl
-
-.fl
-           198 Fri Sep 26 16:14:06 PDT 1997 META\-INF/MANIFEST.MF
-.fl
-           199 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE.SF
-.fl
-          1013 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE.DSA
-.fl
-           199 Fri Sep 27 12:22:30 PDT 1997 META\-INF/DUKE.SF
-.fl
-          1013 Fri Sep 27 12:22:30 PDT 1997 META\-INF/DUKE.DSA
-.fl
-   smki   2752 Fri Sep 26 16:12:30 PDT 1997 writeFile.html
-.fl
-
-.fl
-      X.509, CN=Jane Smith, OU=Java Software, O=Sun, L=cup, S=ca, C=us (jane)
-.fl
-      X.509, CN=Duke, OU=Java Software, O=Sun, L=cup, S=ca, C=us [duke]
-.fl
-
-.fl
-      s = signature was verified
-.fl
-      m = entry is listed in manifest
-.fl
-      k = at least one certificate was found in keystore
-.fl
-      i = at least one certificate was found in identity scope
-.fl
-
-.fl
-    jar verified.
-.fl
-\fP
-.fi
-
-.LP
-.LP
-Note that the alias "duke" is in brackets to denote that it is an identity database alias, not a keystore alias.
-.LP
-.SH "WARNINGS"
-.LP
-During the signing/verifying process, jarsigner may display various warnings. These warning codes are defined as follows:
-.nf
-\f3
-.fl
-         hasExpiringCert         2
-.fl
-             This jar contains entries whose signer certificate will expire within six months
-.fl
-
-.fl
-         hasExpiredCert          4
-.fl
-             This jar contains entries whose signer certificate has expired.
-.fl
-
-.fl
-         notYetValidCert         4
-.fl
-             This jar contains entries whose signer certificate is not yet valid.
-.fl
-
-.fl
-         chainNotValidated       4
-.fl
-             This jar contains entries whose certificate chain cannot be correctly validated.
-.fl
-
-.fl
-         badKeyUsage             8
-.fl
-             This jar contains entries whose signer certificate's KeyUsage extension doesn't allow code signing.
-.fl
-
-.fl
-         badExtendedKeyUsage     8
-.fl
-             This jar contains entries whose signer certificate's ExtendedKeyUsage extension
-.fl
-             doesn't allow code signing.
-.fl
-
-.fl
-         badNetscapeCertType     8
-.fl
-             This jar contains entries whose signer certificate's NetscapeCertType extension
-.fl
-             doesn't allow code signing.
-.fl
-
-.fl
-         hasUnsignedEntry        16
-.fl
-             This jar contains unsigned entries which have not been integrity\-checked.
-.fl
-
-.fl
-         notSignedByAlias        32
-.fl
-             This jar contains signed entries which are not signed by the specified alias(es)
-.fl
-
-.fl
-         aliasNotInStore         32
-.fl
-             This jar contains signed entries that are not signed by alias in this keystore
-.fl
-
-.fl
-\fP
-.fi
-
-.LP
-.LP
-When the \f2\-strict\fP option is provided, an OR\-value of warnings detected will be returned as the exit code of the tool. For example, if a certificate used to sign an entry is expired and has a keyUsage extension that does not allow it to sign a file, an exit code 12 (=4+8) will be returned.
-.LP
-.LP
-\f3Note\fP: Exit codes are reused because only 0\-255 is legal for Unix. In any case, if the signing/verifying process fails, the following exit code will be returned:
-.LP
-.nf
-\f3
-.fl
-failure                 1
-.fl
-\fP
-.fi
-
-.LP
-.SS
-Compatibility with JDK 1.1
-.LP
-.LP
-The \f3keytool\fP and \f3jarsigner\fP tools completely replace the \f3javakey\fP tool provided in JDK 1.1. These new tools provide more features than \f3javakey\fP, including the ability to protect the keystore and private keys with passwords, and the ability to verify signatures in addition to generating them.
-.LP
-.LP
-The new keystore architecture replaces the identity database that \f3javakey\fP created and managed. There is no backwards compatibility between the keystore format and the database format used by \f3javakey\fP in 1.1. However,
-.LP
-.RS 3
-.TP 2
-o
-It is possible to import the information from an identity database into a keystore, via the \f3keytool\fP \f2\-identitydb\fP command.
-.TP 2
-o
-\f3jarsigner\fP can sign JAR files also previously signed using \f3javakey\fP.
-.TP 2
-o
-\f3jarsigner\fP can verify JAR files signed using \f3javakey\fP. Thus, it recognizes and can work with signer aliases that are from a JDK 1.1 identity database rather than a Java 2 SDK keystore.
-.RE
-
-.LP
-.LP
-The following table explains how JAR files that were signed in JDK 1.1.x are treated in the Java 2 platform.
-.LP
-.LP
-.if \n+(b.=1 .nr d. \n(.c-\n(c.-1
-.de 35
-.ps \n(.s
-.vs \n(.vu
-.in \n(.iu
-.if \n(.u .fi
-.if \n(.j .ad
-.if \n(.j=0 .na
-..
-.nf
-.nr #~ 0
-.if n .nr #~ 0.6n
-.ds #d .d
-.if \(ts\n(.z\(ts\(ts .ds #d nl
-.fc
-.nr 33 \n(.s
-.rm 80 81 82 83 84
-.nr 34 \n(.lu
-.eo
-.am 82
-.br
-.di a+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(82 .ll \n(82u
-.in 0
-\f3Trusted Identity imported into Java 2 Platform keystore from 1.1 database (4)\fP
-.br
-.di
-.nr a| \n(dn
-.nr a- \n(dl
-..
-.ec \
-.eo
-.am 83
-.br
-.di b+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(83 .ll \n(83u
-.in 0
-\f3Policy File grants privileges to Identity/Alias\fP
-.br
-.di
-.nr b| \n(dn
-.nr b- \n(dl
-..
-.ec \
-.eo
-.am 84
-.br
-.di c+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(84 .ll \n(84u
-.in 0
-Default privileges granted to all code.
-.br
-.di
-.nr c| \n(dn
-.nr c- \n(dl
-..
-.ec \
-.eo
-.am 84
-.br
-.di d+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(84 .ll \n(84u
-.in 0
-Default privileges granted to all code.
-.br
-.di
-.nr d| \n(dn
-.nr d- \n(dl
-..
-.ec \
-.eo
-.am 84
-.br
-.di e+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(84 .ll \n(84u
-.in 0
-Default privileges granted to all code.
-.br
-.di
-.nr e| \n(dn
-.nr e- \n(dl
-..
-.ec \
-.eo
-.am 84
-.br
-.di f+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(84 .ll \n(84u
-.in 0
-Default privileges granted to all code. (3)
-.br
-.di
-.nr f| \n(dn
-.nr f- \n(dl
-..
-.ec \
-.eo
-.am 84
-.br
-.di g+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(84 .ll \n(84u
-.in 0
-Default privileges granted to all code. (1,3)
-.br
-.di
-.nr g| \n(dn
-.nr g- \n(dl
-..
-.ec \
-.eo
-.am 84
-.br
-.di h+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(84 .ll \n(84u
-.in 0
-Default privileges granted to all code plus privileges granted in policy file.
-.br
-.di
-.nr h| \n(dn
-.nr h- \n(dl
-..
-.ec \
-.eo
-.am 84
-.br
-.di i+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(84 .ll \n(84u
-.in 0
-Default privileges granted to all code plus privileges granted in policy file. (2)
-.br
-.di
-.nr i| \n(dn
-.nr i- \n(dl
-..
-.ec \
-.35
-.nf
-.ll \n(34u
-.nr 80 0
-.nr 38 \w\f3JAR File Type\fP
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \wSigned JAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \wUnsigned JAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \wSigned JAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \wSigned JAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \wSigned JAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \wSigned JAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \wSigned JAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \wSigned JAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \wSigned JAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \wSigned JAR
-.if \n(80<\n(38 .nr 80 \n(38
-.80
-.rm 80
-.nr 81 0
-.nr 38 \w\f3Identity in 1.1 database\fP
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wNO
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wNO
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wNO
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wYES/Untrusted
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wYES/Untrusted
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wNO
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wYES/Trusted
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wYES/Trusted
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wYES/Trusted
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wYES/Trusted
-.if \n(81<\n(38 .nr 81 \n(38
-.81
-.rm 81
-.nr 82 0
-.nr 38 \wNO
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wNO
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wYES
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wNO
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wNO
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wYES
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wYES
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wNO
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wYES
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wNO
-.if \n(82<\n(38 .nr 82 \n(38
-.82
-.rm 82
-.nr 38 \n(a-
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 83 0
-.nr 38 \wNO
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wNO
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wNO
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wNO
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wYES
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wYES
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wYES
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wNO
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wNO
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wYES
-.if \n(83<\n(38 .nr 83 \n(38
-.83
-.rm 83
-.nr 38 \n(b-
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 84 0
-.nr 38 \w\f3Privileges Granted\fP
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \wAll privileges
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \wAll privileges (1)
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \wAll privileges (1)
-.if \n(84<\n(38 .nr 84 \n(38
-.84
-.rm 84
-.nr 38 \n(c-
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \n(d-
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \n(e-
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \n(f-
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \n(g-
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \n(h-
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \n(i-
-.if \n(84<\n(38 .nr 84 \n(38
-.35
-.nf
-.ll \n(34u
-.nr 38 1n
-.nr 79 0
-.nr 40 \n(79+(0*\n(38)
-.nr 80 +\n(40
-.nr 41 \n(80+(3*\n(38)
-.nr 81 +\n(41
-.nr 42 \n(81+(3*\n(38)
-.nr 82 +\n(42
-.nr 43 \n(82+(3*\n(38)
-.nr 83 +\n(43
-.nr 44 \n(83+(3*\n(38)
-.nr 84 +\n(44
-.nr TW \n(84
-.if t .if \n(TW>\n(.li .tm Table at line 1082 file Input is too wide - \n(TW units
-.fc  
-.nr #T 0-1
-.nr #a 0-1
-.eo
-.de T#
-.ds #d .d
-.if \(ts\n(.z\(ts\(ts .ds #d nl
-.mk ##
-.nr ## -1v
-.ls 1
-.ls
-..
-.ec
-.ne \n(a|u+\n(.Vu
-.ne \n(b|u+\n(.Vu
-.if (\n(a|+\n(#^-1v)>\n(#- .nr #- +(\n(a|+\n(#^-\n(#--1v)
-.if (\n(b|+\n(#^-1v)>\n(#- .nr #- +(\n(b|+\n(#^-\n(#--1v)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'\f3JAR File Type\fP\h'|\n(41u'\f3Identity in 1.1 database\fP\h'|\n(42u'\h'|\n(43u'\h'|\n(44u'\f3Privileges Granted\fP
-.mk ##
-.nr 31 \n(##
-.sp |\n(##u-1v
-.nr 37 \n(42u
-.in +\n(37u
-.a+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(##u-1v
-.nr 37 \n(43u
-.in +\n(37u
-.b+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(31u
-.ne \n(c|u+\n(.Vu
-.if (\n(c|+\n(#^-1v)>\n(#- .nr #- +(\n(c|+\n(#^-\n(#--1v)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'Signed JAR\h'|\n(41u'NO\h'|\n(42u'NO\h'|\n(43u'NO\h'|\n(44u'
-.mk ##
-.nr 31 \n(##
-.sp |\n(##u-1v
-.nr 37 \n(44u
-.in +\n(37u
-.c+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(31u
-.ne \n(d|u+\n(.Vu
-.if (\n(d|+\n(#^-1v)>\n(#- .nr #- +(\n(d|+\n(#^-\n(#--1v)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'Unsigned JAR\h'|\n(41u'NO\h'|\n(42u'NO\h'|\n(43u'NO\h'|\n(44u'
-.mk ##
-.nr 31 \n(##
-.sp |\n(##u-1v
-.nr 37 \n(44u
-.in +\n(37u
-.d+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(31u
-.ne \n(e|u+\n(.Vu
-.if (\n(e|+\n(#^-1v)>\n(#- .nr #- +(\n(e|+\n(#^-\n(#--1v)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'Signed JAR\h'|\n(41u'NO\h'|\n(42u'YES\h'|\n(43u'NO\h'|\n(44u'
-.mk ##
-.nr 31 \n(##
-.sp |\n(##u-1v
-.nr 37 \n(44u
-.in +\n(37u
-.e+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(31u
-.ne \n(f|u+\n(.Vu
-.if (\n(f|+\n(#^-1v)>\n(#- .nr #- +(\n(f|+\n(#^-\n(#--1v)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'Signed JAR\h'|\n(41u'YES/Untrusted\h'|\n(42u'NO\h'|\n(43u'NO\h'|\n(44u'
-.mk ##
-.nr 31 \n(##
-.sp |\n(##u-1v
-.nr 37 \n(44u
-.in +\n(37u
-.f+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(31u
-.ne \n(g|u+\n(.Vu
-.if (\n(g|+\n(#^-1v)>\n(#- .nr #- +(\n(g|+\n(#^-\n(#--1v)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'Signed JAR\h'|\n(41u'YES/Untrusted\h'|\n(42u'NO\h'|\n(43u'YES\h'|\n(44u'
-.mk ##
-.nr 31 \n(##
-.sp |\n(##u-1v
-.nr 37 \n(44u
-.in +\n(37u
-.g+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(31u
-.ne \n(h|u+\n(.Vu
-.if (\n(h|+\n(#^-1v)>\n(#- .nr #- +(\n(h|+\n(#^-\n(#--1v)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'Signed JAR\h'|\n(41u'NO\h'|\n(42u'YES\h'|\n(43u'YES\h'|\n(44u'
-.mk ##
-.nr 31 \n(##
-.sp |\n(##u-1v
-.nr 37 \n(44u
-.in +\n(37u
-.h+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(31u
-.ne \n(i|u+\n(.Vu
-.if (\n(i|+\n(#^-1v)>\n(#- .nr #- +(\n(i|+\n(#^-\n(#--1v)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'Signed JAR\h'|\n(41u'YES/Trusted\h'|\n(42u'YES\h'|\n(43u'YES\h'|\n(44u'
-.mk ##
-.nr 31 \n(##
-.sp |\n(##u-1v
-.nr 37 \n(44u
-.in +\n(37u
-.i+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(31u
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'Signed JAR\h'|\n(41u'YES/Trusted\h'|\n(42u'NO\h'|\n(43u'NO\h'|\n(44u'All privileges
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'Signed JAR\h'|\n(41u'YES/Trusted\h'|\n(42u'YES\h'|\n(43u'NO\h'|\n(44u'All privileges (1)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'Signed JAR\h'|\n(41u'YES/Trusted\h'|\n(42u'NO\h'|\n(43u'YES\h'|\n(44u'All privileges (1)
-.fc
-.nr T. 1
-.T# 1
-.35
-.rm a+
-.rm b+
-.rm c+
-.rm d+
-.rm e+
-.rm f+
-.rm g+
-.rm h+
-.rm i+
-.if \n-(b.=0 .nr c. \n(.c-\n(d.-42
-
-.LP
-.LP
-Notes:
-.LP
-.RS 3
-.TP 3
-1.
-If an identity/alias is mentioned in the policy file, it must be imported into the keystore for the policy file to have any effect on privileges granted.
-.TP 3
-2.
-The policy file/keystore combination has precedence over a trusted identity in the identity database.
-.TP 3
-3.
-Untrusted identities are ignored in the Java 2 platform.
-.TP 3
-4.
-Only trusted identities can be imported into Java 2 SDK keystores.
-.RE
-
-.LP
-.SH "SEE ALSO"
-.LP
-.RS 3
-.TP 2
-o
-jar(1) tool documentation
-.TP 2
-o
-keytool(1) tool documentation
-.TP 2
-o
-the
-.na
-\f4Security\fP @
-.fi
-http://download.oracle.com/javase/tutorial/security/index.html trail of the
-.na
-\f4Java Tutorial\fP @
-.fi
-http://download.oracle.com/javase/tutorial/index.html for examples of the use of the \f3jarsigner\fP tool
-.RE
-
-.LP
-
+.PP
+Identity in 1\&.1 database: \fIYes/Trusted\fR
+.br     
+Trusted identity imported into Java keystore from 1\&.1\&. database: \fIYes\fR
+.br     
+Policy file grants privileges to identity/alias: \fINo\fR
+.br     
+See 1 in Notes Regarding Privileges of Signed JARs\&.
+.PP
+Identity in 1\&.1 database: \fIYes/Trusted\fR
+.br     
+Trusted identity imported into Java keystore from 1\&.1\&. database: \fINo\fR
+.br     
+Policy file grants privileges to identity/alias: \fIYes\fR
+.br     
+See 1 in Notes Regarding Privileges of Signed JARs\&.
+.PP
+Notes Regarding Privileges of Signed JARs
+.TP 0.4i    
+1\&.
+If an identity or alias is mentioned in the policy file, then it must be imported into the keystore for the policy file to have any effect on privileges granted\&.
+.TP 0.4i    
+2\&.
+The policy file/keystore combination has precedence over a trusted identity in the identity database\&.
+.TP 0.4i    
+3\&.
+Untrusted identities are ignored in the Java platform\&.
+.SH SEE\ ALSO    
+.TP 0.2i    
+\(bu
+\f3jar\fR
+.TP 0.2i    
+\(bu
+\f3keytool\fR
+.TP 0.2i    
+\(bu
+Trail: Security Features in Java SE at http://docs\&.oracle\&.com/javase/tutorial/security/index\&.html
+.RE
+.br
+'pl 8.5i
+'bp
--- a/src/linux/doc/man/ja/jarsigner.1	Fri Jan 10 15:10:25 2014 +0000
+++ b/src/linux/doc/man/ja/jarsigner.1	Thu Jan 23 19:23:55 2014 +0000
@@ -1,1673 +1,1403 @@
-." Copyright (c) 1998, 2011, Oracle and/or its affiliates. All rights reserved.
-." DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-."
-." This code is free software; you can redistribute it and/or modify it
-." under the terms of the GNU General Public License version 2 only, as
-." published by the Free Software Foundation.
-."
-." This code is distributed in the hope that it will be useful, but WITHOUT
-." ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-." FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-." version 2 for more details (a copy is included in the LICENSE file that
-." accompanied this code).
-."
-." You should have received a copy of the GNU General Public License version
-." 2 along with this work; if not, write to the Free Software Foundation,
-." Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-."
-." Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-." or visit www.oracle.com if you need additional information or have any
-." questions.
-."
-.TH jarsigner 1 "05 Jul 2012"
-
-.LP
-.SH "名前"
-jarsigner \- JAR署名および検証ツール
-.LP
-.LP
-Java ARchive(JAR)ファイルの署名を生成し、署名付きJARファイルの署名を検証します。
-.LP
+'\" t
+.\" Copyright (c) 1998, 2013, Oracle and/or its affiliates. All rights reserved.
+.\" Title: jarsigner
+.\" Language: English
+.\" Date: 2013年8月6日
+.\" SectDesc: セキュリティ・ツール
+.\" Software: JDK 7
+.\" Arch: 汎用
+.\"
+.\" DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+.\"
+.\" This code is free software; you can redistribute it and/or modify it
+.\" under the terms of the GNU General Public License version 2 only, as
+.\" published by the Free Software Foundation.
+.\"
+.\" This code is distributed in the hope that it will be useful, but WITHOUT
+.\" ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+.\" FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+.\" version 2 for more details (a copy is included in the LICENSE file that
+.\" accompanied this code).
+.\"
+.\" You should have received a copy of the GNU General Public License version
+.\" 2 along with this work; if not, write to the Free Software Foundation,
+.\" Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+.\"
+.\" Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+.\" or visit www.oracle.com if you need additional information or have any
+.\" questions.
+.\"
+.pl 99999
+.TH "jarsigner" "1" "2013年8月6日" "JDK 7" "セキュリティ・ツール"
+.\" -----------------------------------------------------------------
+.\" * Define some portability stuff
+.\" -----------------------------------------------------------------
+.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.\" http://bugs.debian.org/507673
+.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
+.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.ie \n(.g .ds Aq \(aq
+.el       .ds Aq '
+.\" -----------------------------------------------------------------
+.\" * set default formatting
+.\" -----------------------------------------------------------------
+.\" disable hyphenation
+.nh
+.\" disable justification (adjust text to left margin only)
+.ad l
+.\" -----------------------------------------------------------------
+.\" * MAIN CONTENT STARTS HERE *
+.\" -----------------------------------------------------------------
+.SH "NAME"
+jarsigner \- Javaアーカイブ(JAR)ファイルに対して署名および検証を行います。
 .SH "形式"
-.LP
+.sp
+.if n \{\
+.RS 4
+.\}
 .nf
-\f3
-.fl
-\fP\f3jarsigner\fP [ options ] jar\-file alias
-.fl
-\f3jarsigner\fP \-verify [ options ] jar\-file [alias...]
-.fl
+\fIjarsigner\fR [ \fIoptions\fR ] \fIjar\-file\fR \fIalias\fR
 .fi
-
-.LP
-.LP
-jarsignerの\-verifyコマンドでは、JARファイル名の後に0個以上のキーストア別名を指定できます。キーストア別名が指定された場合、jarsignerは、JARファイル内の各署名付きエンティティの検証に使用される証明書が、いずれかのキーストア別名に一致することをチェックします。別名は、\-keystoreで指定されたキーストア内またはデフォルトのキーストア内に定義されます。
-.LP
+.if n \{\
+.RE
+.\}
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+\fIjarsigner\fR \fI\-verify\fR [ \fIoptions\fR ] \fIjar\-file\fR [\fIalias \&.\&.\&.\fR]
+.fi
+.if n \{\
+.RE
+.\}
+.PP
+\fIoptions\fR
+.RS 4
+コマンドライン・オプション。オプションを参照してください。
+.RE
+.PP
+\-verify
+.RS 4
+\fI\-verify\fRオプションでは、JARファイル名の後に0個以上のキーストア別名を指定できます。\fI\-verify\fRオプションが指定された場合、\fIjarsigner\fRコマンドでは、JARファイル内の各署名付きエンティティの検証に使用される証明書が、いずれかのキーストア別名に一致することをチェックします。別名は、\fI\-keystore\fRで指定されたキーストア内またはデフォルトのキーストア内に定義されます。
+.sp
+\fI\-strict\fRオプションも指定した場合、\fIjarsigner\fRコマンドにより重大な警告が検出されると、メッセージ「jarが検証されました。署名者エラー」が表示されます。
+.RE
+.PP
+\fIjar\-file\fR
+.RS 4
+署名されるJARファイル。
+.RE
+.PP
+\fIalias\fR
+.RS 4
+別名は、\fI\-keystore\fRで指定されたキーストア内またはデフォルトのキーストア内に定義されます。
+.RE
 .SH "説明"
-.LP
-.LP
-\f3jarsigner\fPツールは、次の2つの目的で使用します。
-.LP
-.RS 3
-.TP 3
-1.
-Java ARchive(JAR)ファイルに署名する目的 
-.TP 3
-2.
-署名付きJARファイルの署名と整合性を検証する目的 
+.PP
+\fIjarsigner\fRツールには、次の2つの目的があります。
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+Javaアーカイブ(JAR)ファイルに署名する目的。
 .RE
-
-.LP
-.LP
-JAR機能を使用すると、クラス・ファイル、イメージ、サウンドおよびその他のデジタル・データを単一のファイルにパッケージ化できるので、ファイルを迅速かつ容易に配布できます。開発者は、jar(1)という名前のツールを使用してJARファイルを作成できます。(技術的な観点から言えば、すべてのZIPファイルもJARファイルとみなすことができます。ただし、\f3jar\fPによって作成されたJARファイル、または\f3jarsigner\fPによって処理されたJARファイルには、META\-INF/MANIFEST.MFファイルが含まれています。)
-.LP
-.LP
-\f2デジタル署名\fPは、なんらかのデータ(「署名」の対象となるデータ)と、エンティティ(人、会社など)の秘密鍵とに基づいて計算されるビット列です。手書きの署名同様、デジタル署名には多くの利点があります。
-.LP
-.RS 3
-.TP 2
-o
-署名の生成に使用された秘密鍵と対になる公開鍵を使用して計算を行うことで、デジタル署名が本物かどうかを検証できます。 
-.TP 2
-o
-秘密鍵が他人に知られない限り、デジタル署名の偽造は不可能です。 
-.TP 2
-o
-デジタル署名は、その署名が付いたデータのみを対象とするものであり、他のデータの署名として機能することはありません。 
-.TP 2
-o
-署名付きのデータは変更できません。データが変更された場合は、その署名によってデータが本物ではないことが検証されます。 
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+署名付きJARファイルの署名と整合性を検証する目的。
 .RE
-
-.LP
-.LP
-ファイルに対してエンティティの署名を生成するには、まず、エンティティは、そのエンティティに関連する公開鍵と秘密鍵のペアを持つ必要があります。また、公開鍵を認証する1つまたは複数の証明書も必要です。\f2証明書\fPとは、あるエンティティが発行したデジタル署名付きの文書で、別なエンティティの公開鍵が特定の値であることを証明しています。
-.LP
-.LP
-\f3jarsigner\fPは、\f2キーストア\fPに含まれる鍵と証明書情報を使用して、JARファイルのデジタル署名を生成します。キーストアは、秘密鍵、および対応する公開鍵を認証するためのX.509証明書チェーンが収められたデータベースです。キーストアの作成と管理には、keytool(1)ユーティリティを使用します。
-.LP
-.LP
-\f3jarsigner\fPは、エンティティの秘密鍵を使用して署名を生成します。署名付きJARファイルには、ファイルの署名に使用された秘密鍵に対応する公開鍵に対する、キーストア内の証明書のコピーなどが含まれています。\f3jarsigner\fPは、署名付きJARファイル内(署名ブロック・ファイル内)にある証明書を使用してそのファイルのデジタル署名を検証できます。
-.LP
-.LP
-\f3jarsigner\fPはタイムスタンプを含む署名を生成するので、システムやデプロイヤ(Java Plug\-inを含む)はJARファイルが署名証明書の有効期間中に署名されたかどうかをチェックできます。さらに、APIを使用すると、アプリケーションからタイムスタンプ情報を取得できます。
-.LP
-.LP
-現時点では、\f3jarsigner\fPで署名できるのは、SDKのjar(1)ツールで作成されたJARファイル、またはZIPファイルのみです。(JARファイルはZIPファイルと同じですが、JARファイルにはMETA\-INF/MANIFEST.MFファイルが含まれている点が異なります。このファイルは、\f3jarsigner\fPがZIPファイルに署名を付けるときに自動的に作成されます。)
-.LP
-.LP
-デフォルトでは、\f3jarsigner\fPはJAR(またはZIP)ファイルに\f2署名します\fP。署名付きJARファイルを\f2検証\fPする場合は、\f2\-verify\fPオプションを指定します。
-.LP
-.SS 
-キーストアの別名
-.LP
-.LP
-キーストアのすべてのエントリは、一意の\f2別名\fPを介してアクセスされます。
-.LP
-.LP
-\f3jarsigner\fPを使用してJARファイルに署名を付けるときは、署名の生成に必要な秘密鍵を含むキーストア・エントリの別名を指定する必要があります。たとえば、次の例は、workingディレクトリのmystoreという名前のキーストアに含まれる別名dukeに関連付けられた秘密鍵を使用して、MyJARFile.jarという名前のJARファイルに署名を付けます。出力ファイルは指定されていないので、MyJARFile.jarは署名付きのJARファイルによって上書きされます。
-.LP
+.PP
+JAR機能を使用すると、クラス・ファイル、イメージ、サウンドおよびその他のデジタル・データを単一のファイルにパッケージ化できるので、ファイルを迅速かつ容易に配布できます。\fIjar\fRという名前のツールを使用して、開発者はJARファイルを作成できます。(技術的な観点から言えば、すべてのZIPファイルもJARファイルとみなすことができます。ただし、jarによって作成されたJARファイル、または\fIjarsigner\fRによって処理されたJARファイルには、\fIMETA\-INF/MANIFEST\&.MF\fRファイルが含まれています。)
+.PP
+デジタル署名は、なんらかのデータ(署名の対象となるデータ)、およびエンティティ(人、会社など)の秘密鍵から計算されるビットの文字列です。手書きの署名同様、デジタル署名には多くの利点があります。
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+署名の生成に使用された秘密鍵に対応する公開鍵を使用する計算によって、それが本物であることを検証できます。
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+秘密鍵が他人に知られない限り、デジタル署名の偽造は不可能です。
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+これは、署名が付いたデータの機能であり、他のデータの署名となるように要求できません。
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+署名付きデータは変更できません。データが変更された場合、署名によって本物であると検証できません。
+.RE
+.PP
+ファイルに対してエンティティの署名を生成するには、まず、エンティティは、そのエンティティに関連する公開鍵/秘密鍵のペアと、公開鍵を認証する1つ以上の証明書を持つ必要があります。証明書とは、あるエンティティからのデジタル署名付きの文書で、別のエンティティの公開鍵が特定の値を持つことを示しています。
+.PP
+\fIjarsigner\fRコマンドは、キーストアからの鍵と証明書情報を使用して、JARファイルのデジタル署名を生成します。キーストアは、秘密鍵、および対応する公開鍵を認証する、秘密鍵に関連したX\&.509証明書チェーンのデータベースです。\fIkeytool\fRコマンドを使用して、キーストアを作成および管理します。
+.PP
+\fIjarsigner\fRコマンドでは、エンティティの秘密鍵を使用して署名を生成します。署名付きJARファイルには、特に、ファイルへの署名に使用する秘密鍵に対応する公開鍵のキーストアからの証明書のコピーが含まれます。\fIjarsigner\fRコマンドでは、内部(署名ブロック・ファイル内)の証明書を使用して、署名付きJARファイルのデジタル署名を検証できます。
+.PP
+\fIjarsigner\fRコマンドでは、署名証明書の有効期間中にJARファイルが署名されたされたかどうかをシステムやデプロイヤ(Java Plug\-inを含む)がチェックできる、タイムスタンプを含む署名を生成できます。さらに、APIを使用すると、アプリケーションでタイムスタンプ情報を取得できます。
+.PP
+現時点では、\fIjarsigner\fRコマンドでは、\fIjar\fRコマンドまたはZIPファイルによって作成されたJARファイルのみに署名できます。JARファイルはZIPファイルと同じですが、JARファイルには\fIMETA\-INF/MANIFEST\&.MF\fRファイルも含まれている点が異なります。\fIMETA\-INF/MANIFEST\&.MF\fRファイルは、\fIjarsigner\fRコマンドによってZIPファイルに署名する際に作成されます。
+.PP
+デフォルトの\fIjarsigner\fRコマンドの動作では、JARまたはZIPファイルに署名します。\fI\-verify\fRオプションを使用して、署名付きJARファイルを検証します。
+.PP
+\fIjarsigner\fRコマンドは、署名または検証の後に署名者の証明書の検証も試行します。検証エラーまたはその他の問題が発生すると、コマンドにより警告メッセージが生成されます。\fI\-strict\fRオプションを指定した場合、コマンドにより重大な警告がエラーとして処理されます。エラーと警告を参照してください。
+.SS "キーストアの別名"
+.PP
+キーストアのすべてのエンティティは、一意の別名を使用してアクセスされます。
+.PP
+\fIjarsigner\fRコマンドを使用してJARファイルに署名するときは、署名の生成に必要な秘密鍵を含むキーストア・エントリの別名を指定する必要があります。たとえば、次のコマンドでは、\fIworking\fRディレクトリの\fImystore\fRという名前のキーストアに含まれる別名\fIduke\fRに関連付けられた秘密鍵を使用して、\fIMyJARFile\&.jar\fRという名前のJARファイルに署名します。出力ファイルは指定されていないため、\fIMyJARFile\&.jar\fRは署名付きのJARファイルによって上書きされます。
+.sp
+.if n \{\
+.RS 4
+.\}
 .nf
-\f3
-.fl
-    jarsigner \-keystore /working/mystore \-storepass \fP\f4<keystore password>\fP\f3
-.fl
-      \-keypass \fP\f4<private key password>\fP\f3 MyJARFile.jar duke
-.fl
-\fP
+jarsigner \-keystore /working/mystore \-storepass <keystore password>
+      \-keypass <private key password> MyJARFile\&.jar duke
 .fi
-
-.LP
-.LP
-キーストアはパスワードで保護されているので、ストアのパスワードを指定する必要があります。コマンドラインでストアのパスワードを指定しないと、パスワードの入力を求められます。同様に、秘密鍵もキーストア内でパスワードによって保護されているため、秘密鍵のパスワードを指定する必要があります。コマンドラインで秘密鍵のパスワードを指定していない場合、または指定したパスワートが保存されているパスワードと違っている場合には、秘密鍵のパスワードの入力を求められます。
-.LP
-.SS 
-キーストアの場所
-.LP
-.LP
-\f3jarsigner\fPには、使用するキーストアのURLを指定する\f2\-keystore\fPオプションがあります。キーストアはデフォルトで、\f2user.home\fPシステム・プロパティで決まるユーザーのホーム・ディレクトリの\f2.keystore\fPという名前のファイル内に格納されます。Solarisシステムの場合、\f2user.home\fPのデフォルトはユーザーのhomeディレクトリになります。
-.LP
-.LP
-\f2\-keystore\fPオプションからの入力ストリームは、\f2KeyStore.load\fPメソッドに渡されます。URLとして\f2NONE\fPが指定されている場合は、nullのストリームが\f2KeyStore.load\fPメソッドに渡されます。\f2NONE\fPは、\f2KeyStore\fPがファイルベースではない場合、たとえば、ハードウェア・トークン・デバイス上に存在している場合などに指定してください。
-.LP
-.SS 
-キーストアの実装
-.LP
-.LP
-\f2java.security\fPパッケージで提供されている\f2KeyStore\fPクラスは、キーストア内の情報へのアクセスおよび情報の変更を行うための、明確に定義されたインタフェースを提供します。キーストアの固定実装としては、それぞれが特定の\f2タイプ\fPのキーストアを対象とする複数の異なる実装が存在可能です。
-.LP
-.LP
-現在、キーストアの実装を使用するものとして、\f3keytool\fPと\f3jarsigner\fPの2つのコマンドライン・ツールと、\f3Policy Tool\fPという名前の1つのGUIベースのツールがあります。\f2KeyStore\fPは公開されているので、Java 2 SDKユーザーはKeyStoreを使用する他のセキュリティ・アプリケーションも作成できます。
-.LP
-.LP
-キーストアには、Sun Microsystemsが提供する組込みのデフォルトの実装があります。これは、JKSという名前の独自のキーストア・タイプ(形式)を利用するもので、キーストアをファイルとして実装しています。この実装では、個々の秘密鍵は個別のパスワードによって保護され、キーストア全体の整合性も(秘密鍵とは別の)パスワードによって保護されます。
-.LP
-.LP
-キーストアの実装は、プロバイダベースです。具体的には、\f2KeyStore\fPによって提供されるアプリケーション・インタフェースが「サービス・プロバイダ・インタフェース」(SPI)に基づいて実装されます。つまり、対応する\f2KeystoreSpi\fP抽象クラス(これも\f2java.security\fPパッケージに含まれています)があり、このクラスが、「プロバイダ」が実装する必要のあるService Provider Interfaceのメソッドを定義しています。(ここで、「プロバイダ」とは、Java Security APIによってアクセス可能なサービスのサブセットに対し、その固定実装を提供するパッケージまたはパッケージの集合のことです。)したがって、キーストアの実装を提供するには、
-.na
-\f2Java暗号化アーキテクチャ用プロバイダの実装方法\fP @
+.if n \{\
+.RE
+.\}
+.PP
+キーストアはパスワードで保護されているので、ストアのパスワードを指定する必要があります。コマンドラインで指定しないと、入力を求められます。同様に、秘密鍵もキーストア内でパスワードによって保護されているため、秘密鍵のパスワードを指定する必要があります。コマンドラインでパスワードを指定していない場合、または指定したパスワートが保存されているパスワードと同じではない場合は、パスワードの入力を求められます。
+.SS "キーストアの場所"
+.PP
+\fIjarsigner\fRコマンドには、使用するキーストアのURLを指定する\fI\-keystore\fRオプションがあります。キーストアはデフォルトで、\fIuser\&.home\fRシステム・プロパティで決まるユーザーのホーム・ディレクトリの\fI\&.keystore\fRという名前のファイル内に格納されます。Oracle Solarisシステムの場合、\fIuser\&.home\fRは、ユーザーのホーム・ディレクトリにデフォルト設定されます。
+.PP
+\fI\-keystore\fRオプションからの入力ストリームは、\fIKeyStore\&.load\fRメソッドに渡されます。URLとして\fINONE\fRが指定されている場合は、nullのストリームが\fIKeyStore\&.load\fRメソッドに渡されます。\fINONE\fRは、\fIKeyStore\fRクラスがファイルベースではない場合、たとえば、ハードウェア・トークン・デバイスに置かれている場合に指定します。
+.SS "キーストアの実装"
+.PP
+\fIjava\&.security package\fRで提供されている\fIKeyStore\fRクラスは、キーストア内の情報へのアクセスおよび情報の変更を行うための、明確に定義された多くのインタフェースを提供します。複数の異なる固定実装を指定することができ、各実装は特定のタイプのキーストアを対象とします。
+.PP
+現在、キーストアの実装を使用する2つのコマンドライン・ツール(\fIkeytool\fRと\fIjarsigner\fR)、およびポリシー・ツールという名前の1つのGUIベースのツールがあります。\fIKeyStore\fRクラスは公開されているため、JDKユーザーは、それを使用する他のセキュリティ・アプリケーションを書き込むことができます。
+.PP
+Oracleが提供する組込みのデフォルトの実装があります。これは、KSという名前の独自のキーストア・タイプ(形式)を使用するもので、キーストアをファイルとして実装しています。組込みの実装では、各秘密鍵は個別のパスワードによって保護され、キーストア全体の整合性は(秘密鍵とは別の)パスワードによって保護されます。
+.PP
+キーストアの実装はプロバイダベースで、つまり、\fIKeyStore\fRクラスにより提供されるアプリケーション・インタフェースは、サービス・プロバイダ・インタフェース(SPI)に関して実装されます。対応する\fIKeystoreSpi\fR抽象クラスがあり、これも\fIjava\&.security package\fRに含まれています。このクラスが、プロバイダが実装する必要のあるサービス・プロバイダ・インタフェースのメソッドを定義しています。ここで、プロバイダとは、Java Security APIによってアクセス可能なサービスのサブセットに対し、その固定実装を提供するパッケージまたはパッケージの集合のことです。キーストアの実装を提供するには、http://docs\&.oracle\&.com/javase/7/docs/technotes/guides/security/crypto/HowToImplAProvider\&.htmlにある
+Java暗号化アーキテクチャのプロバイダの実装方法で説明しているように、クライアントはプロバイダを実装し、\fIKeystoreSpi\fRサブクラスの実装を提供する必要があります。
+.PP
+アプリケーションでは、\fIKeyStore\fRクラスの\fIgetInstance\fRファクトリ・メソッドを使用して、様々なプロバイダから異なるタイプのキーストアの実装を選択できます。キーストアのタイプは、キーストア情報の格納形式とデータ形式を定義するとともに、キーストア内の秘密鍵とキーストア自体の整合性を保護するために使用されるアルゴリズムを定義します。異なるタイプのキーストアの実装には、互換性はありません。
+.PP
+\fIkeytool\fRコマンドは、任意のファイルベースのキーストア実装で動作します。これは、コマンドラインで渡されたキーストアの場所をファイル名として扱い、これを\fIFileInputStream\fRに変換して、そこからキーストアの情報をロードします。\fIjarsigner\fRツールおよび\fIpolicytool\fRツールは、URLを使用して指定可能な任意の場所からキーストアを読み取ることができます。
+.PP
+\fIjarsigner\fRコマンドおよび\fIkeytool\fRコマンドの場合、\fI\-storetype\fRオプションを使用して、コマンドラインでキーストアのタイプを指定できます。ポリシー・ツールの場合、「編集」メニューのChange Keystoreコマンドを使用して、キーストアのタイプを指定できます。
+.PP
+ユーザーがキーストアのタイプを明示的に指定しなかった場合、セキュリティ・プロパティ・ファイルで指定された\fIkeystore\&.type\fRプロパティの値に基づいて、ツールによってキーストアの実装が選択されます。このセキュリティ・プロパティ・ファイルは\fIjava\&.security\fRと呼ばれ、JDKセキュリティ・プロパティ・ディレクトリ\fIjava\&.home/lib/security\fR内に存在しています。ここで、java\&.homeは実行時環境のディレクトリです。\fIjre\fRディレクトリは、JDKまたはJava Runtime Environment (JRE)の最上位のディレクトリにあります。
+.PP
+各ツールは、\fIkeystore\&.type\fRの値を取得し、そのタイプのキーストアを実装しているプロバイダが見つかるまで、インストールされているすべてのプロバイダを調べます。目的のプロバイダが見つかると、そのプロバイダからのキーストアの実装を使用します。
+.PP
+\fIKeyStore\fRクラスでは、\fIgetDefaultType\fRという名前のstaticメソッドを定義し、これを使用すると、アプリケーションおよびアプレットから\fIkeystore\&.type property\fRの値を取得できます。次のコードの行では、\fIkeystore\&.type property\fRで指定された、デフォルトのキーストア・タイプのインスタンスを作成します。
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+KeyStore keyStore = KeyStore\&.getInstance(KeyStore\&.getDefaultType());
 .fi
-http://docs.oracle.com/javase/7/docs/technotes/guides/security/crypto/HowToImplAProvider.htmlで説明しているように、クライアントが「プロバイダ」を実装し、KeystoreSpiサブクラスの実装を提供する必要があります。
-.LP
-.LP
-アプリケーションでは、\f2KeyStore\fPクラスが提供するgetInstanceファクトリ・メソッドを使用することで、様々なプロバイダから異なる\f2タイプ\fPのキーストアの実装を選択できます。キーストアのタイプは、キーストア情報の格納形式とデータ形式を定義するとともに、キーストア内の秘密鍵とキーストア自体の整合性を保護するために使用されるアルゴリズムを定義します。異なるタイプのキーストアの実装には、互換性はありません。
-.LP
-.LP
-\f3keytool\fPは、任意のファイルベースのキーストア実装で動作します。(これは、コマンドラインから渡されたキーストアの場所をファイル名として扱い、これをFileInputStreamに変換して、FileInputStreamからキーストアの情報をロードします。)一方、\f3jarsigner\fPツールと\f3policytool\fPツールは、URLで指定可能な任意の場所からキーストアを読み込むことができます。
-.LP
-.LP
-\f3jarsigner\fPと\f3keytool\fPの場合、\f2\-storetype\fPオプションを使用してコマンドラインでキーストアのタイプを指定できます。\f3Policy Tool\fPの場合は、「Edit」メニューの「Change Keystore」コマンドを使用してキーストアのタイプを指定できます。
-.LP
-.LP
-ユーザーがキーストアのタイプを明示的に指定しなかった場合は、単純にセキュリティ・プロパティ・ファイルで指定された\f2keystore.type\fPプロパティの値に基づいて、キーストアの実装が選択されます。このセキュリティ・プロパティ・ファイルは\f2java.security\fPと呼ばれ、SDKセキュリティ・プロパティ・ディレクトリ\f2java.home\fP/lib/security内に存在しています。ここで、\f2java.home\fPは実行時環境のディレクトリ(SDKの\f2jre\fPディレクトリまたはJava 2 Runtime Environmentのトップレベル・ディレクトリ)です。
-.LP
-.LP
-各ツールは、\f2keystore.type\fPの値を取得し、この値で指定されたタイプのキーストアを実装しているプロバイダが見つかるまで、現在インストールされているすべてのプロバイダを調べます。目的のプロバイダが見つかると、そのプロバイダからのキーストアの実装を使用します。
-.LP
-.LP
-\f2KeyStore\fPクラスに定義されているstaticメソッド\f2getDefaultType\fPを使用すると、アプリケーションやアプレットから\f2keystore.type\fPプロパティの値を取得できます。次のコードは、デフォルトのキーストア・タイプ(\f2keystore.type\fPプロパティで指定されたタイプ)のインスタンスを生成します。
-.LP
+.if n \{\
+.RE
+.\}
+.PP
+デフォルトのキーストア・タイプは、\fIjks\fR
+(Oracleが提供する独自のタイプのキーストアの実装)です。これは、セキュリティ・プロパティ・ファイル内の次の行によって指定されています。
+.sp
+.if n \{\
+.RS 4
+.\}
 .nf
-\f3
-.fl
-    KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
-.fl
-\fP
+keystore\&.type=jks
 .fi
-
-.LP
-.LP
-デフォルトのキーストア・タイプはjks(Sunが提供する独自のタイプのキーストアの実装)です。これは、セキュリティ・プロパティ・ファイル内の次の行によって指定されています。
-.LP
+.if n \{\
+.RE
+.\}
+.PP
+キーストアのタイプの指定では、大文字と小文字は区別されません。たとえば、\fIJKS\fRは\fIjks\fRと同じになります。
+.PP
+ツールでデフォルト以外のキーストアの実装を使用するには、その行を変更して別のキーストアのタイプを指定します。たとえば、\fIpkcs12\fRと呼ばれるキーストアのタイプのキーストアの実装を提供するプロバイダ・パッケージがある場合、行を次のように変更します。
+.sp
+.if n \{\
+.RS 4
+.\}
 .nf
-\f3
-.fl
-    keystore.type=jks
-.fl
-\fP
+keystore\&.type=pkcs12
 .fi
-
-.LP
-.LP
-注意: キーストアのタイプの指定では、大文字と小文字は区別されません。たとえば、JKSとjksは同じものとして扱われます。
-.LP
-.LP
-各ツールでデフォルト以外のキーストアの実装を使用するには、上の行を変更して別のキーストアのタイプを指定します。たとえば、pkcs12と呼ばれるタイプのキーストアの実装を提供しているプロバイダ・パッケージを使用するには、上の行を次のように変更します。
-.LP
+.if n \{\
+.RE
+.\}
+.PP
+\fB注意: \fRPKCS 11プロバイダ・パッケージを使用する場合、http://docs\&.oracle\&.com/javase/7/docs/technotes/guides/security/p11guide\&.htmlにある
+Java PKCS #11リファレンス・ガイドの「KeyTool」および「JarSigner」を参照してください。
+.SS "サポートされるアルゴリズム"
+.PP
+デフォルトで、\fIjarsigner\fRコマンドでは次のいずれかのアルゴリズムを使用してJARファイルに署名します。
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+SHA1ダイジェスト・アルゴリズムを使用したデジタル署名アルゴリズム(DSA)
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+SHA256ダイジェスト・アルゴリズムを使用したRSAアルゴリズム。
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+SHA256と楕円曲線デジタル署名アルゴリズム(ECDSA)を使用した楕円曲線(EC)暗号方式アルゴリズム
+.RE
+.PP
+署名者の公開鍵と秘密鍵がDSA鍵である場合、\fIjarsigner\fRはSHAとDSAアルゴリズムを使用してJARファイルに署名します。署名者の鍵がRSA鍵である場合、\fIjarsigner\fRはSHA256とRSAアルゴリズムを使用してJARファイルに署名しようとします。署名者の鍵がEC鍵である場合、\fIjarsigner\fRはSHA256とECDSAアルゴリズムを使用してJARファイルに署名します。
+.PP
+これらのデフォルトの署名アルゴリズムは、\fI\-sigalg\fRオプションを使用してオーバーライドできます。
+.SS "署名付きJARファイル"
+.PP
+\fIjarsigner\fRコマンドを使用してJARファイルに署名する場合、出力される署名付きJARファイルは入力JARファイルと同じですが、次の2つの追加ファイルがMETA\-INFディレクトリに置かれる点が異なります。
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fI\&.SF\fR拡張子の付いた署名ファイル
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fI\&.DSA\fR、\fI\&.RSA\fRまたは\fI\&.EC\fR拡張子の付いた署名ブロック・ファイル
+.RE
+.PP
+これら2つのファイルのベース・ファイル名は、\fI\-sigFile\fRオプションの値から作成されます。たとえば、オプションが\fI\-sigFile MKSIGN\fRの場合、ファイルは\fIMKSIGN\&.SF\fRおよび\fIMKSIGN\&.DSA\fRという名前になります。
+.PP
+コマンドラインで\fI\-sigfile\fRオプションを指定しなかった場合、\fI\&.SF\fRファイルと\fI\&.DSA\fRファイルのベース・ファイル名は、コマンドラインで指定された別名の先頭の8文字をすべて大文字に変換したものになります。別名が8文字未満の場合は、別名がそのまま使用されます。別名に、署名ファイル名で使用できない文字が含まれている場合、ファイル名の作成時に、該当する文字が下線(_)文字に変換されます。有効な文字は、アルファベット、数字、下線およびハイフンです。
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.ps +1
+\fB署名ファイル\fR
+.RS 4
+.PP
+署名ファイル(\fI\&.SF\fRファイル)は、\fIjarsigner\fRコマンドを使用してファイルに署名する際にJARファイルに常に含まれるマニフェスト・ファイルと似ています。JARファイルに含まれているソース・ファイルごとに、\fI\&.SF\fRファイルには、マニフェスト・ファイルにあるような、次に示す3つの行があります。
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+ファイル名
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+ダイジェスト・アルゴリズム(SHA)の名前
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+SHAダイジェストの値
+.RE
+.PP
+マニフェスト・ファイルでは、各ソース・ファイルのSHAダイジェストの値は、ソース・ファイルのバイナリ・データのダイジェスト(ハッシュ)になります。\fI\&.SF\fRファイルでは、指定されたソース・ファイルのダイジェストの値は、ソース・ファイルのマニフェスト・ファイル内のその3行のハッシュになります。
+.PP
+署名ファイルには、デフォルトで、マニフェスト・ファイル全体のハッシュが格納されたヘッダーが含まれています。ヘッダーが存在すると、検証の最適化が有効になります。JARファイルの検証を参照してください。
+.RE
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.ps +1
+\fB署名ブロック・ファイル\fR
+.RS 4
+.PP
+\fI\&.SF\fRファイルには署名が付けられ、署名は署名ブロック・ファイルに置かれます。このファイルには、署名に使用された秘密鍵に対応する公開鍵を認証するキーストアからの証明書または証明書チェーンも、内部でエンコードされて含まれています。ファイルの拡張子は、使用されるダイジェスト・アルゴリズムに応じて、\fI\&.DSA\fR、\fI\&.RSA\fRまたは\fI\&.EC\fRになります。
+.RE
+.SS "署名タイムスタンプ"
+.PP
+\fIjarsigner\fRコマンドでは、JARファイルの署名時に署名タイムスタンプを生成および保存できます。さらに、\fIjarsigner\fRは代替署名機構をサポートします。この動作は省略可能で、署名時に次の各オプションによって制御されます。オプションを参照してください。
+.sp
+.if n \{\
+.RS 4
+.\}
 .nf
-\f3
-.fl
-    keystore.type=pkcs12
-.fl
-\fP
+\-tsa \fIurl\fR
+\-tsacert \fIalias\fR
+\-altsigner \fIclass\fR
+\-altsignerpath \fIclasspathlist\fR
+\-tsapolicyid \fIpolicyid\fR
 .fi
-
-.LP
-.LP
-PKCS#11プロバイダ・パッケージを使用する場合の詳細は、Java PKCS#11リファレンス・ガイドにある
-.na
-\f2KeyToolとJarSigner\fP @
+.if n \{\
+.RE
+.\}
+.SS "JARファイルの検証"
+.PP
+JARファイルの検証が成功するのは、署名が有効であり、かつ署名の生成以降にJARファイル内のどのファイルも変更されていない場合です。JARファイルの検証は、次の手順で行われます。
+.sp
+.RS 4
+.ie n \{\
+\h'-04' 1.\h'+01'\c
+.\}
+.el \{\
+.sp -1
+.IP "  1." 4.2
+.\}
+\fI\&.SF\fRファイルの署名を検証します。
+.sp
+検証では、各署名ブロック(\fI\&.DSA\fR)ファイルに格納された署名が、証明書(または証明書チェーン)も\fI\&.DSA\fRファイルに示される公開鍵に対応する秘密鍵を使用して生成されたことを確認します。また、署名が対応する署名(\fI\&.SF\fR)ファイルの有効な署名であることが確認され、それにより、\fI\&.SF\fRファイルが改ざんされていないことも確認されます。
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04' 2.\h'+01'\c
+.\}
+.el \{\
+.sp -1
+.IP "  2." 4.2
+.\}
+\fI\&.SF\fRファイル内の各エントリに示されるダイジェストを、マニフェスト内の対応する各セクションと突きあわせて検証します。
+.sp
+\fI\&.SF\fRファイルには、マニフェスト・ファイル全体のハッシュが格納されたヘッダーがデフォルトで含まれています。ヘッダーが存在する場合、検証では、ヘッダー内のハッシュがマニフェスト・ファイルのハッシュと一致するかどうかを確認するためにチェックできます。一致する場合、検証は次の手順に進みます。
+.sp
+一致しない場合、\fI\&.SF\fRファイル内の各ソース・ファイル情報セクションのハッシュが、マニフェスト・ファイル内の対応するセクションのハッシュと一致することを確認するために、あまり最適化されていない検証が必要になります。署名ファイルを参照してください。
+.sp
+\fI\&.SF\fRファイルのヘッダーに格納されたマニフェスト・ファイルのハッシュが、現在のマニフェスト・ファイルのハッシュに一致しない理由の1つは、署名および\fI\&.SF\fRファイルの生成後に、(\fIjar\fRツールを使用して)1つ以上のファイルがJARファイルに追加されたことです。\fIjar\fRツールを使用してファイルを追加した場合、新しいファイル用のセクションが追加されることにより、マニフェスト・ファイルは変更されますが、\fI\&.SF\fRファイルは変更されません。検証がまだ成功しているとみなされるのは、署名の生成以降にJARファイル内のどのファイルも変更されていない場合です。これが発生するのは、\fI\&.SF\fRファイルのヘッダー以外のセクションのハッシュが、マニフェスト・ファイル内の対応するセクションのハッシュと一致する場合です。
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04' 3.\h'+01'\c
+.\}
+.el \{\
+.sp -1
+.IP "  3." 4.2
+.\}
+\fI\&.SF\fRファイル内にエントリを持つJARファイル内の各ファイルを読み取ります。読取り中にファイルのダイジェストを計算し、結果をマニフェスト・セクション内のこのファイルのダイジェストと比較します。ダイジェストは同じである必要があり、そうでない場合は検証が失敗します。
+.sp
+検証プロセス中になんらかの重大な検証エラーが発生した場合、そのプロセスは停止され、セキュリティ例外がスローされます。\fIjarsigner\fRコマンドでは、例外を捕捉および表示します。
+.RE
+.if n \{\
+.sp
+.\}
+.RS 4
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.ps +1
+\fBNote\fR
+.ps -1
+.br
+.TS
+allbox tab(:);
+l.
+T{
+ノート
+.PP
+追加の警告(または、\fI\-strict\fRオプションを指定した場合はエラー)はすべて読む必要があります。同様に、証明が信頼できるかを決定するために、(\fI\-verbose\fRおよび\fI\-certs\fRオプションを指定して)証明書の内容も読む必要があります。
+T}
+.TE
+.sp 1
+.sp .5v
+.RE
+.SS "1つのJARファイルを対象とする複数の署名"
+.PP
+次のように、\fIjarsigner\fRコマンドをファイルで複数回実行し、実行のたびに異なるユーザーの別名を指定することによって、1つのJARファイルに複数のユーザーの署名を付けることができます。
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+jarsigner myBundle\&.jar susan
+jarsigner myBundle\&.jar kevin
 .fi
-http://docs.oracle.com/javase/7/docs/technotes/guides/security/p11guide.html#KeyToolJarSignerの項を参照してください。
-.LP
-.SS 
-サポートされるアルゴリズム
-.LP
-.LP
-\f3jarsigner\fPはデフォルトで、次のいずれかを使用してJARファイルに署名します。
-.LP
-.RS 3
-.TP 2
-o
-SHA1ダイジェスト・アルゴリズムを使用したDSA(デジタル署名アルゴリズム) 
-.TP 2
-o
-SHA256ダイジェスト・アルゴリズムを使用したRSAアルゴリズム 
-.TP 2
-o
-SHA256とECDSA(楕円曲線デジタル署名アルゴリズム)を使用したEC(楕円曲線)暗号方式アルゴリズム 
+.if n \{\
 .RE
-
-.LP
-.LP
-具体的には、署名者の公開鍵と秘密鍵がDSA鍵である場合、\f3jarsigner\fPはSHA1withDSAアルゴリズムを使用してJARファイルに署名を付けます。署名者の鍵がRSA鍵である場合、\f3jarsigner\fPはSHA256withRSAアルゴリズムを使用してJARファイルに署名を付けます。署名者の鍵がEC鍵である場合、\f3jarsigner\fPはSHA256withECDSAアルゴリズムを使用してJARファイルに署名を付けます。
-.LP
-.LP
-これらのデフォルトの署名アルゴリズムは、\f2\-sigalg\fPオプションを使用してオーバーライドできます。
-.LP
-.SS 
-署名付きJARファイル
-.LP
-.LP
-\f3jarsigner\fPを使用してJARファイルに署名を付けた場合、出力される署名付きJARファイルは入力JARファイルと同じですが、次の2つの追加ファイルがMETA\-INFディレクトリに置かれる点が異なります。
-.LP
-.RS 3
-.TP 2
-o
-.SF拡張子の付いた署名ファイル 
-.TP 2
-o
-.DSA、.RSAまたは.ECを拡張子の付いた署名ブロック・ファイル 
+.\}
+.PP
+JARファイルが複数回署名されている場合、そのJARファイルには、複数の\fI\&.SF\fRファイルと\fI\&.DSA\fRファイルが含まれており、1回の署名に対して1つのペアとなります。前述の例では、出力JARファイルには、次の名前のファイルが含まれています。
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+SUSAN\&.SF
+SUSAN\&.DSA
+KEVIN\&.SF
+KEVIN\&.DSA
+.fi
+.if n \{\
 .RE
-
-.LP
-.LP
-これら2つのファイルのベース・ファイル名は、\f2\-sigFile\fPオプションの値から作成されます。たとえば、次のようにオプションを指定したとします。
-.LP
+.\}
+.PP
+\fB注意: \fRJARファイルには、JDK 1\&.1の\fIjavakey\fRコマンドにより生成された署名と、\fIjarsigner\fRにより生成された署名を混在させることもできます。\fIjarsigner\fRコマンドを使用して、\fIjavakey\fRコマンドですでに署名されているJARファイルに署名できます。
+.SH "オプション"
+.PP
+次の各項では、様々な\fIjarsigner\fRオプションについて説明します。次の標準に注意してください。
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+どのオプション名にも先頭にマイナス記号(\-)が付きます。
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+オプションは任意の順序で指定できます。
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+イタリック体の項目の実際の値(オプションの値)は、指定する必要があります。
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fI\-keystore\fR、\fI\-storepass\fR、\fI\-keypass\fR、\fI\-sigfile\fR、\fI\-sigalg\fR、\fI\-digestalg\fRおよび\fI\-signedjar\fRオプションを使用できるのは、JARファイルに署名する場合のみです。署名付きJARファイルの検証時には、これらは関係ありません。同様に、別名をコマンドラインで指定するのは、JARファイルへの署名時のみです。
+.RE
+.PP
+\-keystore \fIurl\fR
+.RS 4
+キーストアの場所を示すURLを指定します。これにより、\fIuser\&.home\fRシステム・プロパティで決定されたユーザーのホーム・ディレクトリ内のファイル\fI\&.keystore\fRにデフォルト設定されます。
+.sp
+キーストアは署名時には必要です。デフォルトのキーストアが存在しない場合、またはデフォルト以外のキーストアを使用する場合は、キーストアを明示的に指定する必要があります。
+.sp
+検証するときはキーストアは必要ありません。ただし、キーストアが指定されているか、あるいはデフォルトのキーストアが存在していて、さらに\fI\-verbose\fRオプションも指定されていた場合、JARファイルの検証に使用される証明書がそのキーストアに1つでも含まれているかどうかに関する追加情報が出力されます。
+.sp
+\fI\-keystore\fR引数には、URLではなくファイル名とパスを指定でき、この場合、ファイル: URLと同じように処理されます。たとえば、次にように指定すると同等になります。
+.sp
+.if n \{\
+.RS 4
+.\}
 .nf
-\f3
-.fl
-\-sigFile MKSIGN
-.fl
-\fP
+\-keystore \fIfilePathAndName\fR
 .fi
-
-.LP
-.LP
-この場合、ファイル名はそれぞれMKSIGN.SFとMKSIGN.DSAになります。
-.LP
-.LP
-コマンドラインで\f2\-sigfile\fPオプションを指定しなかった場合、.SFファイルと.DSAファイルのベース・ファイル名は、コマンドラインで指定された別名の先頭の8文字をすべて大文字に変換したものになります。別名が8文字未満の場合は、別名がそのまま使用されます。別名の中に、署名ファイル名に使用できない文字が含まれている場合は、該当する文字を下線(_)に置き換えてファイル名が作成されます。使用できる文字は、アルファベット、数字、下線(_)、ハイフンです。
-.LP
-\f3署名(.SF)ファイル\fP
-.LP
-.LP
-署名ファイル(.SFファイル)は、\f3jarsigner\fPで署名を付けたJARファイルに常に含まれるマニフェスト・ファイルと似ています。つまり、マニフェスト・ファイル同様、.SFファイルには、JARファイルに含まれているソース・ファイルごとに、次の3つの行があります。
-.LP
-.RS 3
-.TP 2
-o
-ファイル名 
-.TP 2
-o
-使用されているダイジェスト・アルゴリズム(SHA)の名前 
-.TP 2
-o
-SHAダイジェストの値 
+.if n \{\
 .RE
-
-.LP
-.LP
-マニフェスト・ファイルでは、各ソース・ファイルのSHAダイジェストの値は、ソース・ファイルのバイナリ・データのダイジェスト(ハッシュ)になります。一方、.SFファイルでは、ソース・ファイルのダイジェストの値は、ソース・ファイルのマニフェスト・ファイル内のこれら3行のハッシュになります。
-.LP
-.LP
-署名ファイルには、デフォルトでマニフェスト・ファイル全体のハッシュが格納されたヘッダーも含まれています。JARファイルの検証で説明するように、このヘッダーの存在によって検証の最適化が可能になっています。
-.LP
-\f3署名ブロック・ファイル\fP
-.LP
-.SFファイルには署名が付けられ、署名は署名ブロック・ファイルに置かれます。このファイルには、キーストアからの証明書または証明書チェーンも符号化された形で含まれています。証明書または証明書チェーンは、署名に使用された秘密鍵に対応する公開鍵を認証します。ファイルの拡張子は、使用されるダイジェスト・アルゴリズムに応じて.DSA、.RSA、.ECのいずれかになります。 
-.SS 
-署名タイムスタンプ
-.LP
-.LP
-\f2jarsigner\fPツールでは、JARファイルの署名時に署名タイムスタンプを生成して保存できます。さらに、\f2jarsigner\fPは代替署名機構をサポートします。この動作は省略可能で、署名時に次の各オプションによって制御されます。
-.LP
-.RS 3
-.TP 2
-o
-\f2\-tsa url\fP 
-.TP 2
-o
-\f2\-tsacert alias\fP 
-.TP 2
-o
-\f2\-altsigner class\fP 
-.TP 2
-o
-\f2\-altsignerpath classpathlist\fP 
+.\}
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+\-keystore file:\fIfilePathAndName\fR
+.fi
+.if n \{\
 .RE
-
-.LP
-.LP
-これらの各オプションの詳細は、オプションの項を参照してください。
-.LP
-.SS 
-JARファイルの検証
-.LP
-.LP
-JARファイルの検証が成功するのは、署名が有効であり、かつ署名の生成以後にJARファイル内のどのファイルも変更されていない場合です。JARファイルの検証は、次の手順で行われます。
-.LP
-.RS 3
-.TP 3
-1.
-.SFファイル自体の署名を検証します。
+.\}
+(JREの\fI$JAVA_HOME/lib/security directory\fRにある)
+\fIjava\&.security\fRセキュリティ・プロパティ・ファイル内でSun PKCS #11プロバイダが構成された場合、\fIkeytool\fRおよび\fIjarsigner\fRツールはPKCS#11トークンに基づいて動作できます。次のオプションを指定します。
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+\-keystore NONE
+\-storetype PKCS11
+.fi
+.if n \{\
+.RE
+.\}
+たとえば、次のコマンドは、構成されたPKCS#11トークンの内容を一覧表示します。
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+jarsigner \-keystore NONE \-storetype PKCS11 \-list
+.fi
+.if n \{\
+.RE
+.\}
+.RE
+.PP
+\-storetype \fIstoretype\fR
+.RS 4
+インスタンスを生成するキーストアのタイプを指定します。デフォルトのキーストア・タイプは、セキュリティ・プロパティ・ファイル内の\fIkeystore\&.type\fRプロパティの値で指定されたタイプで、この値は、\fIjava\&.security\&.KeyStore\fRのstatic
+\fIgetDefaultType\fRメソッドによって返されます。
+.sp
+\fI\-storepass\fRオプションを使用して、PCKS #11トークンのPINを指定することもできます。何も指定しない場合、\fIkeytool\fRおよび\fIjarsigner\fRコマンドによって、トークンPINの指定を求められます。トークンに保護された認証パス(専用のPINパッドや生体読取り機など)がある場合、\fI\-protected\fRオプションを指定する必要がありますが、パスワード・オプションは指定できません。
+.RE
+.PP
+\-storepass[:env | :file} \fIargument\fR
+.RS 4
+キーストアにアクセスするのに必要なパスワードを指定します。これが必要なのは、JARファイルに署名を付けるときのみです(検証するときには不要です)。その場合、\fI\-storepass\fRオプションをコマンドラインで指定しないと、パスワードの入力を求められます。
+.sp
+修飾子\fIenv\fRまたは\fIfile\fRが指定されていない場合、パスワードの値は\fIargument\fRになります。それ以外の場合、パスワードは次のようにして取得されます。
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fIenv\fR:
+\fIargument\fRという名前の環境変数からパスワードを取得します。
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fIfile\fR:
+\fIargument\fRという名前のファイルからパスワードを取得します。
+.RE
+.sp
+\fB注意:\fRテストを目的とする場合またはセキュリティ保護されたシステムを使用している場合以外は、コマンドラインやスクリプトでパスワードを指定しないでください。
+.RE
+.PP
+\-keypass [:env | :file] \fIargument\fR
+.RS 4
+コマンドラインで指定された別名に対応するキーストア・エントリの秘密鍵を保護するのに使用するパスワードを指定します。\fIjarsigner\fRを使用してJARファイルに署名を付けるときは、パスワードが必要です。コマンドラインでパスワードが指定されておらず、必要なパスワードがストアのパスワードと異なる場合は、パスワードの入力を求められます。
+.sp
+修飾子\fIenv\fRまたは\fIfile\fRが指定されていない場合、パスワードの値は\fIargument\fRになります。それ以外の場合、パスワードは次のようにして取得されます。
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fIenv\fR:
+\fIargument\fRという名前の環境変数からパスワードを取得します。
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fIfile\fR:
+\fIargument\fRという名前のファイルからパスワードを取得します。
+.RE
+.sp
+\fB注意: \fRテストを目的とする場合またはセキュリティ保護されたシステムを使用している場合以外は、コマンドラインやスクリプトでパスワードを指定しないでください。
+.RE
+.PP
+\-sigfile \fIfile\fR
+.RS 4
+生成された\fI\&.SF\fRファイルおよび\fI\&.DSA\fRファイルに使用するベース・ファイル名を指定します。たとえば、ファイルが\fIDUKESIGN\fRの場合、生成される\fI\&.SF\fRおよび\fI\&.DSA\fRファイルは、\fIDUKESIGN\&.SF\fRおよび\fIDUKESIGN\&.DSA\fRという名前で、署名付きJARファイルの\fIMETA\-INF\fRディレクトリに格納されます。
+.sp
+ファイル内の文字は、セット\fIa\-zA\-Z0\-9_\-\fRから指定される必要があります。アルファベット、数字、下線およびハイフン文字のみを使用できます。\fI\&.SF\fRおよび\fI\&.DSA\fRのファイル名では、小文字はすべて大文字に変換されます。
+.sp
+コマンドラインで\fI\-sigfile\fRオプションを指定しなかった場合、\fI\&.SF\fRファイルと\fI\&.DSA\fRファイルのベース・ファイル名は、コマンドラインで指定された別名の先頭の8文字をすべて大文字に変換したものになります。別名が8文字未満の場合は、別名がそのまま使用されます。別名に、署名ファイル名で無効な文字が含まれている場合、ファイル名を作成するために、該当する文字が下線(_)文字に変換されます。
+.RE
+.PP
+\-sigalg \fIalgorithm\fR
+.RS 4
+JARファイルの署名に使用する署名アルゴリズムの名前を指定します。
+.sp
+標準的な署名アルゴリズム名のリストは、http://docs\&.oracle\&.com/javase/7/docs/technotes/guides/security/crypto/CryptoSpec\&.html#AppAにある
+Java Cryptography Architecture (JCA)リファレンス・ガイドの「付録A: 標準名」を参照してください。
+.sp
+このアルゴリズムには、JARファイルの署名に使用する秘密鍵との互換性が必要です。このオプションを指定しない場合、秘密鍵のタイプに応じて、\fISHA1withDSA\fR、\fISHA256withRSA\fRまたは\fISHA256withECDSA\fRが使用されます。指定されたアルゴリズムの実装を提供するプロバイダが静的にインストールされているか、\fI\-providerClass\fRオプションを使用してそのようなプロバイダをユーザーが指定する必要があります。そうでない場合、コマンドは失敗します。
+.RE
+.PP
+\-digestalg \fIalgorithm\fR
+.RS 4
+JARファイルのエントリをダイジェストする際に使用するメッセージ・ダイジェスト・アルゴリズムの名前を指定します。
+.sp
+標準的なメッセージ・ダイジェスト・アルゴリズム名のリストは、http://docs\&.oracle\&.com/javase/7/docs/technotes/guides/security/crypto/CryptoSpec\&.html#AppAにある
+Java Cryptography Architecture (JCA)リファレンス・ガイドの「付録A: 標準名」を参照してください。
+.sp
+このオプションを指定しない場合、\fISHA256\fRが使用されます。指定されたアルゴリズムの実装を提供するプロバイダが静的にインストールされているか、\fI\-providerClass\fRオプションを使用してそのようなプロバイダをユーザーが指定する必要があります。そうでない場合、コマンドは失敗します。
+.RE
+.PP
+\-certs
+.RS 4
+コマンドラインで、\fI\-certs\fRオプションを\fI\-verify\fRおよび\fI\-verbose\fRオプションとともに指定した場合、JARファイルの各署名者の証明書情報が出力に含まれます。この情報には、署名者の公開鍵を証明する証明書(\fI\&.DSA\fRファイルに格納)のタイプの名前が含まれ、証明書がX\&.509証明書(\fIjava\&.security\&.cert\&.X509Certificate\fRのインスタンス)の場合、署名者の識別名が含まれます。
+.sp
+キーストアの確認も行われます。コマンドラインでキーストアの値が指定されていない場合、デフォルトのキーストア・ファイル(ある場合)がチェックされます。署名者の公開鍵の証明書がキーストア内のエントリと一致する場合、その署名者のキーストアのエントリの別名が丸カッコ内に表示されます。キーストアではなくJDK 1\&.1のアイデンティティ・データベースに由来する署名者の場合、別名は丸カッコではなく大カッコ内に表示されます。
+.RE
+.PP
+\-certchain \fIfile\fR
+.RS 4
+コマンドラインで指定した別名によって表されるキーストア・エントリの秘密鍵に関連付けられた証明書チェーンが完全ではない場合に、使用する証明書チェーンを指定します。これは、証明書チェーン全体を保持するのに十分な領域がないハードウェア・トークン上にキーストアが格納されている場合に発生します。このファイルは一連の連結されたX\&.509証明書、PKCS#7形式の単一データ・ブロックのいずれかとなり、そのエンコーディング形式はバイナリ・エンコーディング形式、Internet RFC 1421標準で規定される印刷可能エンコーディング形式(Base64エンコーディングとも呼ばれる)のいずれかになります。インターネットRFC 1421証明書符号化規格を参照してください。
+.RE
+.PP
+\-verbose
+.RS 4
+コマンドラインで\fI\-verbose\fRオプションを指定した場合、冗長モードで動作し、このモードでは、\fIjarsigner\fRは、JARの署名または検証の進行状況に関する追加情報を出力します。
+.RE
+.PP
+\-internalsf
+.RS 4
+以前は、JARファイルの署名時に生成された\fI\&.DSA\fR
+(署名ブロック)ファイルに、生成された\fI\&.SF\fRファイル(署名ファイル)のエンコードされた完全なコピーが含まれていました。 この動作は変更されました。出力JARファイル全体のサイズを小さくするために、デフォルトでは\fI\&.DSA\fRファイルには\fI\&.SF\fRファイルのコピーが含まれないようになっています。コマンドラインで\fI\-internalsf\fRを指定した場合、以前と同じように動作します。このオプションは、テストを行う場合に便利です。実際には、\fI\-internalsf\fRオプションは、オーバーヘッドが大きくなるため、使用しないでください。
+.RE
+.PP
+\-sectionsonly
+.RS 4
+コマンドラインで\fI\-sectionsonly\fRオプションを指定した場合、JARファイルの署名時に生成される\fI\&.SF\fRファイル(署名ファイル)には、マニフェスト・ファイル全体のハッシュを含むヘッダーは含まれません。これに含まれるのは、JARファイル内の各ソース・ファイルに関連する情報およびハッシュのみです。署名ファイルを参照してください。
+.sp
+デフォルトでは、最適化のために、このヘッダーが追加されます。ヘッダーが存在する場合、JARファイルを検証するたびに、検証では、まずヘッダー内のハッシュがマニフェスト・ファイル全体のハッシュと一致するかどうかを確認するためにチェックできます。一致する場合、検証は次の手順に進みます。一致しない場合、\fI\&.SF\fRファイル内の各ソース・ファイル情報セクションのハッシュが、マニフェスト・ファイル内の対応するセクションのハッシュと一致するという、あまり最適化されていない検証を実行する必要があります。JARファイルの検証を参照してください。
+.sp
+\fI\-sectionsonly\fRオプションは、主にテスト用に使用されます。これを使用するとオーバーヘッドが大きくなるため、テスト用以外では使用しないでください。
+.RE
+.PP
+\-protected
+.RS 4
+\fItrue\fRまたは\fIfalse\fRのいずれかの値を指定できます。専用PINリーダーなどの保護された認証パスによってパスワードを指定する必要がある場合、\fItrue\fRを指定します。
+.RE
+.PP
+\-providerClass \fIprovider\-class\-name\fR
+.RS 4
+暗号化サービス・プロバイダが\fIjava\&.security\fRセキュリティ・プロパティ・ファイルに指定されていないときは、そのマスター・クラス・ファイルの名前を指定するときに使用されます。
+.sp
+\fI\-providerArg \fR\fIConfigFilePath\fRオプションとともに使用し、\fIkeytool\fRおよび\fIjarsigner\fRツールは、プロバイダを動的にインストールし、トークン構成ファイルへのパスに\fIConfigFilePath\fRを使用します。次の例は、Oracle PKCS #11プロバイダがセキュリティ・プロパティ・ファイルに構成されていなかった場合に\fIPKCS #11\fRキーストアを一覧表示するコマンドを示しています。
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+jarsigner \-keystore NONE \-storetype PKCS11 \e
+          \-providerClass sun\&.security\&.pkcs11\&.SunPKCS11 \e
+          \-providerArg /mydir1/mydir2/token\&.config \e
+          \-list
+.fi
+.if n \{\
+.RE
+.\}
+.RE
+.PP
+\-providerName \fIproviderName\fR
+.RS 4
+\fIjava\&.security\fRセキュリティ・プロパティ・ファイル内で2つ以上のプロバイダが構成された場合、\fI\-providerName\fRオプションを使用して、特定のプロバイダ・インスタンスを対象にすることができます。このオプションの引数は、プロバイダの名前です。
+.sp
+Oracle PKCS #11プロバイダの場合、\fIproviderName\fRは\fISunPKCS11\-\fR\fITokenName\fRという形式になります。ここで、構成属性の表で詳細に説明されているように、\fITokenName\fRは、プロバイダ・インスタンスが構成された名前の接尾辞です。たとえば、次のコマンドは、名前接尾辞\fISmartCard\fRの\fIPKCS #11\fRキーストア・プロバイダ・インスタンスの内容を一覧表示します。
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+jarsigner \-keystore NONE \-storetype PKCS11 \e
+        \-providerName SunPKCS11\-SmartCard \e
+        \-list
+.fi
+.if n \{\
+.RE
+.\}
+.RE
+.PP
+\-J\fIjavaoption\fR
+.RS 4
+指定された\fIjavaoption\fR文字列をJavaインタプリタに直接渡します。\fIjarsigner\fRコマンドは、インタプリタに対するラッパーです。このオプションには、空白を含めることはできません。このオプションは、実行環境またはメモリー使用を調整する場合に便利です。指定できるインタプリタ・オプションを一覧表示するには、コマンドラインで\fIjava \-h\fRまたは\fIjava \-X\fRと入力してください。
+.RE
+.PP
+\-tsa \fIurl\fR
+.RS 4
+\fI\-tsa http://example\&.tsa\&.url\fRがJARファイルの署名時にコマンドラインにある場合、署名のタイムスタンプが生成されます。URL
+\fIhttp://example\&.tsa\&.url\fRは、Time Stamping Authority (TSA)の場所を特定し、\fI\-tsacert\fRオプションを指定して検出されたURLをオーバーライドします。\fI\-tsa\fRオプションでは、TSAの公開鍵証明書をキーストアに配置する必要はありません。
+.sp
+タイムスタンプを生成するために、\fIjarsigner\fRは、RFC 3161で定義されているタイムスタンプ・プロトコル(TSP)を使用してTSAと通信します。成功すると、TSAによって返されたタイムスタンプ・トークンは、署名ブロック・ファイルの署名とともに保存されます。
+.RE
+.PP
+\-tsacert \fIalias\fR
+.RS 4
+\fI\-tsacert\fR
+\fIalias\fRがJARファイルの署名時にコマンドラインにある場合、署名のタイムスタンプが生成されます。別名は、キーストア内の有効なTSAの公開鍵証明書を特定します。エントリの証明書で、TSAの場所を特定するURLを含むSubject Information Access拡張機能が確認されます。
+.sp
+\fI\-tsacert\fRオプションを使用する場合は、TSAの公開鍵証明書がキーストアに配置されている必要があります。
+.RE
+.PP
+\-tsapolicyid \fIpolicyid\fR
+.RS 4
+TSAサーバーに送信するポリシーIDを識別するオブジェクト識別子(OID)を指定します。このオプションを指定しない場合、ポリシーIDは送信されず、TSAサーバーはデフォルトのポリシーIDを選択します。
+.sp
+オブジェクト識別子は、ITU Telecommunication Standardization Sector (ITU\-T)標準であるX\&.696によって定義されます。これらの識別子は、通常、\fI1\&.2\&.3\&.4\fRなどの、負ではない数字のピリオド区切りのセットです。
+.RE
+.PP
+\-altsigner \fIclass\fR
+.RS 4
+このオプションは、代替署名メカニズムを指定します。完全修飾クラス名は、\fIcom\&.sun\&.jarsigner\&.ContentSigner\fR抽象クラスを拡張するクラス・ファイルを識別します。このクラス・ファイルへのパスは、\fI\-altsignerpath\fRオプションによって定義されます。\fI\-altsigner\fRオプションを使用した場合、\fIjarsigner\fRコマンドでは、指定されたクラスによって提供される署名メカニズムを使用します。それ以外の場合、\fIjarsigner\fRコマンドはデフォルトの署名メカニズムを使用します。
+.sp
+たとえば、\fIcom\&.sun\&.sun\&.jarsigner\&.AuthSigner\fRという名前のクラスが提供する署名メカニズムを使用するには、jarsignerのオプション\fI\-altsigner com\&.sun\&.jarsigner\&.AuthSigner\fRを使用します。
+.RE
+.PP
+\-altsignerpath \fIclasspathlist\fR
+.RS 4
+クラス・ファイルおよびそれが依存するJARファイルへのパスを指定します。\fI\-altsigner\fRオプションを使用して、クラス・ファイル名を指定します。クラス・ファイルがJARファイル内にある場合、このオプションでは、そのJARファイルへのパスを指定します。
+.sp
+絶対パスまたは現在のディレクトリへの相対パスを指定できます。\fIclasspathlist\fRに複数のパスやJARファイルが含まれる場合、それらを、Oracle Solarisの場合はコロン(:)で、Windowsの場合はセミコロン(;)で、それぞれ区切ります。目的のクラスがすでに検索パス内にある場合は、このオプションは不要です。
+.sp
+次の例では、クラス・ファイルを含むJARファイルへのパスを指定する方法を示します。JARファイル名を含めます。
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+\-altsignerpath /home/user/lib/authsigner\&.jar
+.fi
+.if n \{\
+.RE
+.\}
+次の例では、クラス・ファイルを含むJARファイルへのパスを指定する方法を示します。JARファイル名を省略します。
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+\-altsignerpath /home/user/classes/com/sun/tools/jarsigner/
+.fi
+.if n \{\
+.RE
+.\}
+.RE
+.PP
+\-strict
+.RS 4
+署名または検証処理中に、コマンドにより警告メッセージが発行される場合があります。このオプションを指定すると、コマンドにより検出された重大な警告メッセージがツールの終了コードに反映されます。エラーと警告を参照してください。
+.RE
+.PP
+\-verbose \fIsuboptions\fR
+.RS 4
+検証処理の場合、\fI\-verbose\fRオプションには、表示する情報の量を決定するサブオプションを指定します。\fI\-certs\fRオプションも指定した場合、デフォルト・モード(またはサブオプション\fIall\fR)では、エントリが処理されるたびに各エントリが表示され、その後にJARファイルの各署名者の証明書情報も表示されます。\fI\-certs\fRおよび\fI\-verbose:grouped\fRサブオプションを指定した場合、同じ署名者情報を持つエントリが、その証明書情報とともに、グループ化されて表示されます。\fI\-certs\fRおよび\fI\-verbose:summary\fRサブオプションを指定した場合、同じ署名者情報を持つエントリが、その証明書情報とともに、グループ化されて表示されます。各エントリの詳細は、\fI1つのエントリ(以上)\fRにまとめられて表示されます。例を参照してください。
+.RE
+.SH "エラーと警告"
+.PP
+署名または検証プロセス中に、\fIjarsigner\fRコマンドで、様々なエラーまたは警告が発行される可能性があります。
+.PP
+障害がある場合、\fIjarsigner\fRコマンドはコード1で終了します。障害はないが、1つ以上の重大な警告がある場合、\fI\-strict\fRオプションが指定されて\fBいない\fR場合は、\fIjarsigner\fRコマンドはコード0で終了し、\fI\-strict\fRが指定されている場合は警告コードのOR値で終了します。情報警告のみがある、または警告がまったくない場合、コマンドは常にコード0で終了します。
+.PP
+たとえば、エントリの署名に使用される証明書が期限切れで、ファイルの署名を許可しないKeyUsage拡張機能を使用している場合、\fI\-strict\fRオプションが指定されていると、\fIjarsigner\fRコマンドはコード12 (=4+8)で終了します。
+.if n \{\
+.sp
+.\}
+.RS 4
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
 .br
+.ps +1
+\fBNote\fR
+.ps -1
 .br
-この手順では、各署名ブロック(.DSA)ファイルに格納されている署名が、実際に、公開鍵に対応する秘密鍵を使用して生成されたものであることが確認されます。.DSAファイルには、公開鍵の証明書(または証明書チェーン)も含まれています。また、この手順では、目的の署名が、対応する署名(.SF)ファイル内の有効な署名であるかどうかを調べ、.SFファイルが改変されていないことも確認されます。 
-.TP 3
-2.
-.SFファイル内の各エントリのダイジェストをマニフェスト内の対応する各セクションと突きあわせて検証します。
+.TS
+allbox tab(:);
+l.
+T{
+ノート
+.PP
+Unixベースのオペレーティング・システムでは0から255までの値のみが有効のため、終了コードは再利用されます。
+T}
+.TE
+.sp 1
+.sp .5v
+.RE
+.PP
+次のセクションでは、\fIjarsigner\fRコマンドにより発行できるエラーおよび警告の名前、コード、説明を記述します。
+.SS "障害"
+.PP
+コマンドライン解析エラー、JARファイルに署名する鍵ペアを検索できない、または署名付きJARファイルの検証失敗など(限定されません)、\fIjarsigner\fRコマンドの失敗理由。
+.PP
+failure
+.RS 4
+コード1。署名または検証が失敗します。
+.RE
+.SS "重大な警告"
+.if n \{\
+.sp
+.\}
+.RS 4
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
 .br
+.ps +1
+\fBNote\fR
+.ps -1
 .br
-.SFファイルには、マニフェスト・ファイル全体のハッシュが格納されたヘッダーがデフォルトで含まれています。このヘッダーが存在する場合は、ヘッダー内のハッシュが実際にマニフェスト・ファイルのハッシュと一致するかどうかを検証することができます。ハッシュが一致する場合は、次の手順に検証が進みます。
+.TS
+allbox tab(:);
+l.
+T{
+ノート
+.PP
+\fI\-strict\fRオプションを指定した場合、重大な警告はエラーとして報告されます。
+T}
+.TE
+.sp 1
+.sp .5v
+.RE
+.PP
+JARファイルの署名に使用する証明書にエラーがある、または署名付きJARファイルに他の問題があるなど、\fIjarsigner\fRコマンドが重大な警告を発行する理由。
+.PP
+hasExpiredCert
+.RS 4
+コード4。このjarには、署名者証明書が期限切れのエントリが含まれています。
+.RE
+.PP
+notYetValidCert
+.RS 4
+コード4。このjarには、署名者証明書がまだ有効になっていないエントリが含まれています。
+.RE
+.PP
+chainNotValidated
+.RS 4
+コード4。このjarには、証明書チェーンが正しく検証できないエントリが含まれています。
+.RE
+.PP
+badKeyUsage
+.RS 4
+コード8。このJARには、署名者証明書のKeyUsage拡張機能がコード署名を許可しないエントリが含まれています。
+.RE
+.PP
+badExtendedKeyUsage
+.RS 4
+コード8。このjarには、署名者証明書のExtendedKeyUsage拡張機能がコード署名を許可しないエントリが含まれています。
+.RE
+.PP
+badNetscapeCertType
+.RS 4
+コード8。このjarには、署名者証明書のNetscapeCertType拡張機能がコード署名を許可しないエントリが含まれています。
+.RE
+.PP
+hasUnsignedEntry
+.RS 4
+コード16。このjarには、整合性チェックをしていない未署名のエントリが含まれています。
+.RE
+.PP
+notSignedByAlias
+.RS 4
+コード32。このjarには、指定された別名によって署名されていない署名済エントリが含まれています。
+.RE
+.PP
+aliasNotInStore
+.RS 4
+コード32。このjarには、このキーストア内の別名によって署名されていない署名済エントリが含まれます。
+.RE
+.SS "情報警告"
+.PP
+情報警告には、エラーではないが不適切とみなされるものが含まれます。コードはありません。
+.PP
+hasExpiringCert
+.RS 4
+このjarには、署名者証明書が6か月以内に期限切れとなるエントリが含まれています。
+.RE
+.PP
+noTimestamp
+.RS 4
+このjarには、タイムスタンプを含まない署名が含まれています。タイムスタンプなしでは、署名者証明書の有効期限(形式は\fIYYYY\-MM\-DD\fR)後または将来の取消日後、ユーザーはこのJARファイルを検証できない場合があります。
+.RE
+.SH "例"
+.SS "JARファイルの署名"
+.PP
+次のコマンドを使用して、キーストア別名が\fIworking\fRディレクトリの\fImystore\fRという名前のキーストアにある\fIjane\fRであるユーザーの秘密鍵でbundle\&.jarに署名し、署名付きJARファイルにsbundle\&.jarという名前を付けます。
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+jarsigner \-keystore /working/mystore \-storepass <keystore password>
+      \-keypass <private key password> \-signedjar sbundle\&.jar bundle\&.jar jane
+.fi
+.if n \{\
+.RE
+.\}
+.PP
+前述のコマンドでは\fI\-sigfile\fRが指定されていないため、署名付きJARファイルに格納される生成された\fI\&.SF\fRファイルおよび\fI\&.DSA\fRファイルの名前は、別名に基づいたデフォルトの名前になります。これらは、名前付きの\fIJANE\&.SF\fRおよび\fIJANE\&.DSA\fRです。
+.PP
+ストアのパスワードおよび秘密鍵のパスワードを求められる場合、前述のコマンドを短縮して、次のことを実行できます。
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+jarsigner \-keystore /working/mystore
+      \-signedjar sbundle\&.jar bundle\&.jar jane
+.fi
+.if n \{\
+.RE
+.\}
+.PP
+キーストアがデフォルトのキーストア(ホーム・ディレクトリ内の\&.keystore)である場合、次に示すように、キーストアを指定する必要がありません。
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+jarsigner \-signedjar sbundle\&.jar bundle\&.jar jane
+.fi
+.if n \{\
+.RE
+.\}
+.PP
+入力JARファイル(bundle\&.jar)を署名付きJARファイルで上書きする場合、次のように\fI\-signedjar\fRオプションを指定する必要はありません。
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+jarsigner bundle\&.jar jane
+.fi
+.if n \{\
+.RE
+.\}
+.SS "署名付きJARファイルの検証"
+.PP
+署名付きJARファイルを検証して、署名が有効でJARファイルが改ざんされなかったことを確認するには、次のようなコマンドを使用します。
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+jarsigner \-verify sbundle\&.jar
+.fi
+.if n \{\
+.RE
+.\}
+.PP
+検証が成功すると、\fIjar verified\fRが表示されます。有効でない場合は、エラー・メッセージが表示されます。\fI\-verbose\fRオプションを使用すると、詳細情報を取得できます。\fIjarsigner\fRを\fI\-verbose\fRオプションとともに使用するサンプルを、次に示します。
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+jarsigner \-verify \-verbose sbundle\&.jar
+ 
+           198 Fri Sep 26 16:14:06 PDT 1997 META\-INF/MANIFEST\&.MF
+           199 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE\&.SF
+          1013 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE\&.DSA
+    smk   2752 Fri Sep 26 16:12:30 PDT 1997 AclEx\&.class
+    smk    849 Fri Sep 26 16:12:46 PDT 1997 test\&.class
+ 
+      s = signature was verified
+      m = entry is listed in manifest
+      k = at least one certificate was found in keystore
+ 
+    jar verified\&.
+.fi
+.if n \{\
+.RE
+.\}
+.SS "証明書情報を使用した検証"
+.PP
+\fI\-certs\fRオプションを\fI\-verify\fRおよび\fI\-verbose\fRオプションとともに指定した場合、JARファイルの各署名者の証明書情報が出力に含まれます。この情報には、証明書タイプ、署名者の識別名情報(X\&.509証明書の場合)が含まれ、丸カッコ内には、JARファイルの公開鍵証明書がキーストア・エントリの公開鍵証明書に一致する場合の署名者のキーストア別名が含まれます。たとえば、次のようになります。
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+jarsigner \-keystore /working/mystore \-verify \-verbose \-certs myTest\&.jar
+ 
+           198 Fri Sep 26 16:14:06 PDT 1997 META\-INF/MANIFEST\&.MF
+           199 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE\&.SF
+          1013 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE\&.DSA
+           208 Fri Sep 26 16:23:30 PDT 1997 META\-INF/JAVATEST\&.SF
+          1087 Fri Sep 26 16:23:30 PDT 1997 META\-INF/JAVATEST\&.DSA
+    smk   2752 Fri Sep 26 16:12:30 PDT 1997 Tst\&.class
+ 
+      X\&.509, CN=Test Group, OU=Java Software, O=Oracle, L=CUP, S=CA, C=US (javatest)
+      X\&.509, CN=Jane Smith, OU=Java Software, O=Oracle, L=cup, S=ca, C=us (jane)
+ 
+      s = signature was verified
+      m = entry is listed in manifest
+      k = at least one certificate was found in keystore
+ 
+    jar verified\&.
+.fi
+.if n \{\
+.RE
+.\}
+.PP
+署名者の証明書がX\&.509証明書ではない場合、識別名情報は表示されません。その場合には、証明書のタイプと別名のみが表示されます。たとえば、証明書がPGP証明書で、別名が\fIbob\fRである場合、\fIPGP, (bob)\fRを取得します。
+.SS "アイデンティティ・データベースの署名者を含む検証"
+.PP
+JARファイルがJDK 1\&.1の\fIjavakey\fRツールを使用して署名され、署名者がアイデンティティ・データベース内の別名である場合、検証の出力には\fIi\fRが含まれます。JARファイルがアイデンティティ・データベース内の別名とキーストア内の別名の両方によって署名された場合、\fIk\fRと\fIi\fRの両方が表示されます。
+.PP
+\fI\-certs\fRオプションを使用した場合、アイデンティティ・データベースの別名は、キーストアの別名に使用される丸カッコではなく、大カッコで囲みます。たとえば、次のようになります。
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+    jarsigner \-keystore /working/mystore \-verify \-verbose \-certs writeFile\&.jar
+ 
+           198 Fri Sep 26 16:14:06 PDT 1997 META\-INF/MANIFEST\&.MF
+           199 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE\&.SF
+          1013 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE\&.DSA
+           199 Fri Sep 27 12:22:30 PDT 1997 META\-INF/DUKE\&.SF
+          1013 Fri Sep 27 12:22:30 PDT 1997 META\-INF/DUKE\&.DSA
+   smki   2752 Fri Sep 26 16:12:30 PDT 1997 writeFile\&.html
+ 
+      X\&.509, CN=Jane Smith, OU=Java Software, O=Oracle, L=cup, S=ca, C=us (jane)
+      X\&.509, CN=Duke, OU=Java Software, O=Oracle, L=cup, S=ca, C=us [duke]
+ 
+      s = signature was verified
+      m = entry is listed in manifest
+      k = at least one certificate was found in keystore
+      i = at least one certificate was found in identity scope
+ 
+    jar verified\&.
+.fi
+.if n \{\
+.RE
+.\}
+.PP
+\fB注意: \fR別名がキーストアの別名ではなく、アイデンティティ・データベースの別名であることを示すには、別名\fIduke\fRを大カッコで囲みます。
+.SH "JDK 1.1の互換性"
+.PP
+\fIkeytool\fRおよび\fIjarsigner\fRツールは、JDK 1\&.1における\fIjavakey\fRツールを置き換えたものです。これらの新しいツールは、キーストアと秘密鍵をパスワードで保護する機能や、署名の生成に加えて署名を検証する機能など、\fIjavakey\fRより多くのを機能を備えています。
+.PP
+新しいキーストア・アーキテクチャは、\fIjavakey\fRが作成して管理していたアイデンティティ・データベースに代わるものです。キーストア形式と、JDK 1\&.1の\fIjavakey\fRが使用していたデータベース形式との間には、下位互換性はありません。ただし、次の点に注意してください。
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fIkeytool \-identitydb\fRコマンドを使用して、アイデンティティ・データベースからキーストアに情報をインポートできます。
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fIjarsigner\fRコマンドでは、\fIjavakey\fRコマンドで署名されたJARファイルに署名できます。
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fIjarsigner\fRコマンドでは、\fIjavakey\fRで署名されたJARファイルを検証できます。\fIjarsigner\fRコマンドでは、JDKのキーストアではなくJDK 1\&.1のアイデンティティ・データベースからの署名者別名を認識し、それを対象に処理を行うことができます。
+.RE
+.SS "署名のないJAR"
+.PP
+署名のないJARには、すべてのコードに付与されるデフォルトの権限があります。
+.SS "署名付きJAR"
+.PP
+署名付きJARには、記述どおりのJDK 1\&.1\&.\fIn\fRアイデンティティおよびポリシー・ファイルのステータスに基づいた権限構成があります。JDKキーストアにインポートできるのは、信頼できるアイデンティティのみです。
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
 .br
+.ps +1
+\fBすべてのコードに付与されるデフォルトの権限\fR
+.RS 4
+.RS 4
+1\&.1データベースのアイデンティティ: \fBいいえ\fR
+.RE
+.RS 4
+1\&.1\&.データベースからJavaキーストアにインポートされた信頼できるアイデンティティ: \fBいいえ\fR
+.RE
+.RS 4
+ポリシー・ファイルによるアイデンティティ/別名への権限の付与: \fBいいえ\fR
+.RE
+.PP
+.RS 4
+1\&.1データベースのアイデンティティ: \fBいいえ\fR
+.RE
+.RS 4
+1\&.1\&.データベースからJavaキーストアにインポートされた信頼できるアイデンティティ: \fBはい\fR
+.RE
+.RS 4
+ポリシー・ファイルによるアイデンティティ/別名への権限の付与: \fBいいえ\fR
+.RE
+.PP
+.RS 4
+1\&.1データベースのアイデンティティ: はい/信頼されない
+.RE
+.RS 4
+1\&.1\&.データベースからJavaキーストアにインポートされた信頼できるアイデンティティ: \fBいいえ\fR
+.RE
+.RS 4
+ポリシー・ファイルによるアイデンティティ/別名への権限の付与: \fBいいえ\fR
+.RE
+.RS 4
+注意の3を参照してください。
+.RE
+.PP
+.RS 4
+1\&.1データベースのアイデンティティ: はい/信頼されない
+.RE
+.RS 4
+1\&.1\&.データベースからJavaキーストアにインポートされた信頼できるアイデンティティ: \fBいいえ\fR
+.RE
+.RS 4
+ポリシー・ファイルによるアイデンティティ/別名への権限の付与: \fBはい\fR
+.RE
+.RS 4
+注意の1および3を参照してください。
+.RE
+.RE
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
 .br
-ハッシュが一致しない場合は、効率的には劣る方法を使用した検証が必要になります。具体的には、.SFファイル内の各ソース・ファイル情報セクションのハッシュが、マニフェスト・ファイル内の対応するセクションのハッシュと一致するかどうかが確認されます(署名(.SF)ファイルを参照)。
+.ps +1
+\fB付与されるデフォルトの権限およびポリシー・ファイル権限\fR
+.RS 4
+.RS 4
+1\&.1データベースのアイデンティティ: \fBいいえ\fR
+.RE
+.RS 4
+1\&.1\&.データベースからJavaキーストアにインポートされた信頼できるアイデンティティ: \fBはい\fR
+.RE
+.RS 4
+ポリシー・ファイルによるアイデンティティ/別名への権限の付与: \fBはい\fR
+.RE
+.PP
+.RS 4
+1\&.1データベースのアイデンティティ: \fBはい/信頼される\fR
+.RE
+.RS 4
+1\&.1\&.データベースからJavaキーストアにインポートされた信頼できるアイデンティティ: \fBはい\fR
+.RE
+.RS 4
+ポリシー・ファイルによるアイデンティティ/別名への権限の付与: \fBはい\fR
+.RE
+.RS 4
+注意の2を参照してください。
+.RE
+.RE
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
 .br
+.ps +1
+\fB付与されるすべての権限\fR
+.RS 4
+.RS 4
+1\&.1データベースのアイデンティティ: \fBはい/信頼される\fR
+.RE
+.RS 4
+1\&.1\&.データベースからJavaキーストアにインポートされた信頼できるアイデンティティ: \fBいいえ\fR
+.RE
+.RS 4
+ポリシー・ファイルによるアイデンティティ/別名への権限の付与: \fBいいえ\fR
+.RE
+.PP
+.RS 4
+1\&.1データベースのアイデンティティ: \fBはい/信頼される\fR
+.RE
+.RS 4
+1\&.1\&.データベースからJavaキーストアにインポートされた信頼できるアイデンティティ: \fBはい\fR
+.RE
+.RS 4
+ポリシー・ファイルによるアイデンティティ/別名への権限の付与: \fBいいえ\fR
+.RE
+.RS 4
+注意の1を参照してください。
+.RE
+.RS 4
+1\&.1データベースのアイデンティティ: \fBはい/信頼される\fR
+.RE
+.RS 4
+1\&.1\&.データベースからJavaキーストアにインポートされた信頼できるアイデンティティ: \fBいいえ\fR
+.RE
+.RS 4
+ポリシー・ファイルによるアイデンティティ/別名への権限の付与: \fBはい\fR
+.RE
+.RS 4
+注意の1を参照してください。
+.RE
+.RE
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
 .br
-.SFファイルのヘッダーに格納されたマニフェスト・ファイルのハッシュと、実際のマニフェスト・ファイルのハッシュとが一致しない場合は、署名(つまり.SFファイル)の生成後に、JARファイルに1つ以上のファイルが(\f2jar\fPツールを使用して)追加された可能性があります。\f2jar\fPツールを使用してファイルを追加した場合、マニフェスト・ファイルは変更されます(新しいファイル用のセクションが追加されます)が、.SFファイルは変更されません。この場合、.SFファイルのヘッダー以外のセクションに格納されたハッシュが、マニフェスト・ファイル内の対応するセクションのハッシュと一致するときは、署名の生成時にJARファイル内に存在していたファイルのうち、どのファイルも変更されていないことになり、検証は成功したものとして扱われます。 
-.TP 3
-3.
-JARファイル内のファイルのうち、.SFファイル内にエントリを持つ各ファイルを読み込みます。読込み中にファイルのダイジェストを計算し、結果をマニフェスト・セクション内の該当するファイルのダイジェストと比較します。2つのダイジェストは同じである必要があり、そうでない場合は検証が失敗します。 
+.ps +1
+\fB注意\fR
+.RS 4
+.sp
+.RS 4
+.ie n \{\
+\h'-04' 1.\h'+01'\c
+.\}
+.el \{\
+.sp -1
+.IP "  1." 4.2
+.\}
+ポリシー・ファイル内にアイデンティティまたは別名についての言及がある場合、それをキーストアにインポートして、付与された権限にポリシー・ファイルの設定が反映されるようにする必要があります。
 .RE
-
-.LP
-.LP
-検証プロセスの途中でなんらかの重大な検証エラーが発生した場合、検証プロセスは中止され、セキュリティ例外がスローされます。例外は、\f3jarsigner\fPがキャッチして表示します。
-.LP
-.SS 
-1つのJARファイルを対象とする複数の署名
-.LP
-.LP
-1つのJARファイルに対して\f3jarsigner\fPツールを複数回実行し、実行のたびに、異なるユーザーの別名を指定すれば、JARファイルに複数のユーザーの署名を付けることができます。
-.LP
-.nf
-\f3
-.fl
-  jarsigner myBundle.jar susan
-.fl
-  jarsigner myBundle.jar kevin
-.fl
-\fP
-.fi
-
-.LP
-.LP
-JARファイルが複数回署名されている場合、そのJARファイルには.SFファイルと.DSAファイルのペアが複数含まれることになります。.SFファイルと.DSAファイルのペアは、1回の署名に対して1つ作成されます。したがって、上の例で出力されるJARファイルには、次の名前を持つファイルが含まれます。
-.LP
-.nf
-\f3
-.fl
-  SUSAN.SF
-.fl
-  SUSAN.DSA
-.fl
-  KEVIN.SF
-.fl
-  KEVIN.DSA
-.fl
-\fP
-.fi
-
-.LP
-.LP
-注意: JARファイルでは、JDK 1.1の\f3javakey\fPツールで生成された署名と\f3jarsigner\fPで生成された署名が混在できます。つまり、すでに\f3javakey\fPを使用して署名が付けられているJARファイルに、\f3jarsigner\fPを使用して署名を付けることができます。
-.LP
-.SH "オプション"
-.LP
-.LP
-次に、\f3jarsigner\fPのオプションについて説明します。注意:
-.LP
-.RS 3
-.TP 2
-o
-どのオプション名にも先頭にマイナス記号(\-)が付きます。 
-.TP 2
-o
-オプションは任意の順序で指定できます。 
-.TP 2
-o
-イタリック体の項目の実際の値(オプションの値)は、指定する必要があります。 
-.TP 2
-o
-\f2\-keystore\fP、\f2\-storepass\fP、\f2\-keypass\fP、\f2\-sigfile\fP、\f2\-sigalg\fP、\f2\-digestalg\fPおよび\f2\-signedjar\fPオプションを使用できるのは、署名付きJARファイルを検証する場合ではなく、JARファイルに署名する場合のみです。同様に、別名をコマンドラインで指定するのは、JARファイルに署名を付ける場合のみです。 
+.sp
+.RS 4
+.ie n \{\
+\h'-04' 2.\h'+01'\c
+.\}
+.el \{\
+.sp -1
+.IP "  2." 4.2
+.\}
+ポリシー・ファイル/キーストアの組合せは、アイデンティティ・データベース内の信頼できるアイデンティティよりも優先されます。
 .RE
-
-.LP
-.RS 3
-.TP 3
-\-keystore url 
-キーストアの場所を示すURLを指定します。デフォルトは、ユーザーのホーム・ディレクトリ内のファイル\f2.keystore\fPです。ユーザーのホーム・ディレクトリは、user.homeシステム・プロパティによって決まります。
+.sp
+.RS 4
+.ie n \{\
+\h'-04' 3.\h'+01'\c
+.\}
+.el \{\
+.sp -1
+.IP "  3." 4.2
+.\}
+Javaプラットフォームでは、信頼できないアイデンティティは無視されます。
+.RE
+.RE
+.SH "参照"
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+jar(1)
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+keytool(1)
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+http://docs\&.oracle\&.com/javase/tutorial/security/index\&.htmlにある
+「コース: Java SEのセキュリティ機能」
+.RE
 .br
-.br
-署名するときはキーストアが必要です。このため、デフォルトのキーストアが存在しない場合(またはデフォルト以外のキーストアを使用する場合)は、キーストアを明示的に指定する必要があります。
-.br
-.br
-検証するときはキーストアは\f2必要ありません\fP。ただし、キーストアが指定されているか、あるいはデフォルトのキーストアが存在していて、さらに\f2\-verbose\fPオプションも指定されていた場合、JARファイルの検証に使用される証明書がそのキーストアに1つでも含まれているかどうかに関する追加情報が出力されます。
-.br
-.br
-注意: \f2\-keystore\fPの引数には、URLのかわりにファイル名(とパス)を指定できます。ファイル名(とパス)を指定した場合は、「file:」URLとして扱われます。次に例を示します。 
-.nf
-\f3
-.fl
-  \-keystore \fP\f4filePathAndName\fP\f3
-.fl
-\fP
-.fi
-これは、次の指定と同じものとして扱われます。 
-.nf
-\f3
-.fl
-  \-keystore file:\fP\f4filePathAndName\fP\f3
-.fl
-\fP
-.fi
-JREの\f2$JAVA_HOME/lib/security\fPディレクトリに格納された\f2java.security\fPセキュリティ・プロパティ・ファイル内でSun PKCS#11プロバイダが構成されている場合、keytoolとjarsignerはPKCS#11トークンに基づいて動作できます。次のオプションを指定します。 
-.RS 3
-.TP 2
-o
-\f2\-keystore NONE\fP 
-.TP 2
-o
-\f2\-storetype PKCS11\fP 
-.RE
-たとえば、次のコマンドは、構成されたPKCS#11トークンの内容を一覧表示します。 
-.nf
-\f3
-.fl
-   jarsigner \-keystore NONE \-storetype PKCS11 \-list
-.fl
-\fP
-.fi
-.TP 3
-\-storetype storetype 
-インスタンスを生成するキーストアのタイプを指定します。デフォルトのキーストア・タイプは、セキュリティ・プロパティ・ファイル内のkeystore.typeプロパティの値で指定されたタイプです。この値は、\f2java.security.KeyStore\fPのstatic \f2getDefaultType\fPメソッドによって返されます。
-.br
-.br
-\f2\-storepass\fPオプションを使用してPCKS#11トークンのPINを指定することもできます。何も指定しなかった場合、keytoolとjarsignerはユーザーにトークンPINの入力を求めます。トークンに保護された認証パス(専用のPINパッドや生体読取り機など)がある場合、\f2\-protected\fPオプションを指定する必要がありますが、パスワード・オプションは指定できません。 
-.TP 3
-\-storepass[:env | :file] argument 
-キーストアにアクセスするのに必要なパスワードを指定します。これが必要なのは、JARファイルに署名を付けるときのみです(検証するときには不要です)。その場合、\f2\-storepass\fPオプションをコマンドラインで指定しないと、パスワードの入力を求められます。
-.br
-.br
-修飾子\f2env\fPまたは\f2file\fPが指定されていない場合、パスワードの値は\f2argument\fPになります。それ以外の場合、パスワードは次のようにして取得されます。 
-.RS 3
-.TP 2
-o
-\f2env\fP: \f2argument\fPという名前の環境変数からパスワードを取得します。 
-.TP 2
-o
-\f2file\fP: \f2argument\fPという名前のファイルからパスワードを取得します。 
-.RE
-注意: テストを目的とする場合、またはセキュリティ保護されたシステムを使用している場合以外は、コマンドラインやスクリプトでパスワードを指定しないでください。 
-.TP 3
-\-keypass[:env | :file] argument 
-コマンドラインで指定された別名に対応するキーストア・エントリの秘密鍵を保護するのに使用するパスワードを指定します。\f3jarsigner\fPを使用してJARファイルに署名を付けるときは、パスワードが必要です。コマンドラインでパスワードが指定されておらず、必要なパスワードがストアのパスワードと異なる場合は、パスワードの入力を求められます。
-.br
-.br
-修飾子\f2env\fPまたは\f2file\fPが指定されていない場合、パスワードの値は\f2argument\fPになります。それ以外の場合、パスワードは次のようにして取得されます。 
-.RS 3
-.TP 2
-o
-\f2env\fP: \f2argument\fPという名前の環境変数からパスワードを取得します。 
-.TP 2
-o
-\f2file\fP: \f2argument\fPという名前のファイルからパスワードを取得します。 
-.RE
-注意: テストを目的とする場合、またはセキュリティ保護されたシステムを使用している場合以外は、コマンドラインやスクリプトでパスワードを指定しないでください。 
-.TP 3
-\-sigfile file 
-.SFファイルと .DSAファイルの生成に使用するベース・ファイル名を指定します。たとえば、\f2file\fPにDUKESIGNを指定すると、生成される.SFファイルと.DSAファイルの名前は、それぞれDUKESIGN.SFとDUKESIGN.DSAになります。これらのファイルは、署名付きJARファイルのMETA\-INFディレクトリに置かれます。
-.br
-.br
-\f2file\fPに使用できる文字は「a\-zA\-Z0\-9_\-」です。つまり、文字、数字、下線およびハイフンのみを使用できます。注意: .SFおよび.DSAのファイル名では、小文字はすべて大文字に変換されます。
-.br
-.br
-コマンドラインで\f2\-sigfile\fPオプションを指定しなかった場合、.SFファイルと.DSAファイルのベース・ファイル名は、コマンドラインで指定された別名の先頭の8文字をすべて大文字に変換したものになります。別名が8文字未満の場合は、別名がそのまま使用されます。別名の中に、署名ファイル名に使用できない文字が含まれている場合は、該当する文字を下線(_)に置き換えてファイル名が作成されます。 
-.TP 3
-\-sigalg algorithm 
-JARファイルの署名に使用する署名アルゴリズムの名前を指定します。
-.br
-.br
-標準署名アルゴリズム名の一覧は、Java暗号化アーキテクチャの
-.na
-\f2付録A\fP @
-.fi
-http://docs.oracle.com/javase/7/docs/technotes/guides/security/crypto/CryptoSpec.html#AppAを参照してください。このアルゴリズムには、JARファイルの署名に使用する秘密鍵との互換性が必要です。このオプションを指定しなかった場合、秘密鍵のタイプに応じてSHA1withDSA、SHA256withRSA、SHA256withECDSAのいずれかが使用されます。指定されたアルゴリズムの実装を提供するプロバイダが静的にインストールされているか、\f2\-providerClass\fPオプションを使用してそのようなプロバイダをユーザーが指定する必要があります。そうでない場合、コマンドの実行が失敗します。 
-.TP 3
-\-digestalg algorithm 
-JARファイルのエントリをダイジェストする際に使用するメッセージ・ダイジェスト・アルゴリズムの名前を指定します。
-.br
-.br
-メッセージ・ダイジェスト・アルゴリズム名の一覧は、Java暗号化アーキテクチャの
-.na
-\f2付録A\fP @
-.fi
-http://docs.oracle.com/javase/7/docs/technotes/guides/security/crypto/CryptoSpec.html#AppAを参照してください。このオプションを指定しなかった場合、SHA256が使用されます。指定されたアルゴリズムの実装を提供するプロバイダが静的にインストールされているか、\f2\-providerClass\fPオプションを使用してそのようなプロバイダをユーザーが指定する必要があります。そうでない場合、コマンドの実行が失敗します。 
-.TP 3
-\-signedjar file 
-署名付きJARファイルの名前を指定します。
-.br
-.br
-コマンドラインで名前を指定しなかった場合は、入力JARファイル(署名の対象となるJARファイル)の名前と同じ名前が使用されます。つまり、入力JARファイルは署名付きJARファイルによって上書きされます。 
-.TP 3
-\-verify 
-コマンドラインでこのオプションが指定されている場合は、指定されたJARファイルの署名ではなく検証が行われます。検証が成功すると、「jarが検証されました。」というメッセージが表示されます。署名されていないJARファイル、またはサポートされていないアルゴリズム(RSAプロバイダのインストールを終了していない場合のRSAなど)を使用して署名されたJARファイルを検証しようとすると、「jarは署名されていません。(署名が見つからないか、構文解析できません)」というメッセージが表示されます。
-.br
-.br
-署名付きJARファイルは、\f3jarsigner\fPまたはJDK 1.1の\f3javakey\fPツールのどちらかまたは両方を使用して検証できます。
-.br
-.br
-検証の詳細は、JARファイルの検証を参照してください。 
-.TP 3
-\-certs 
-コマンドラインで、\f2\-verify\fPおよび\f2\-verbose\fPオプションとともにこのオプションを指定した場合、JARファイルの各署名者の証明書情報が出力に含まれます。この情報には次のものが含まれます。 
-.RS 3
-.TP 2
-o
-署名者の公開鍵を証明する(.DSAファイルに格納された)証明書タイプの名前 
-.TP 2
-o
-証明書がX.509証明書(つまり、\f2java.security.cert.X509Certificate\fPのインスタンス)である場合は、署名者の識別名 
-.RE
-キーストアの確認も行われます。コマンドラインでキーストアの値が指定されていない場合、デフォルトのキーストア・ファイルがあれば、検査されます。署名者の公開鍵の証明書がキーストア内のエントリと一致した場合は、次の情報も表示されます。 
-.RS 3
-.TP 2
-o
-署名者に該当するキーストア・エントリの別名。この別名は括弧で囲まれます。ただし、キーストアではなくJDK 1.1のアイデンティティ・データベースに由来する署名者の場合は、括弧ではなく大括弧で囲まれます。 
-.RE
-.TP 3
-\-certchain file 
-コマンドラインで指定した別名で決まるキーストア・エントリの秘密鍵に関連付けられた証明書チェーンが完全でない場合に、使用する証明書チェーンを指定します。そのような状態になる可能性があるのは、キーストアがハードウェア・トークン上に格納されているが、そこには証明書チェーンの全体を保持できる領域が存在していないような場合です。このファイルは一連のX.509証明書が順に連結されたもの、PKCS#7形式の単一データ・ブロックのいずれかとなり、そのエンコーディング形式はバイナリ・エンコーディング形式、Internet RFC 1421標準で規定される印刷可能エンコーディング形式(BASE64エンコーディングとも呼ばれる)のいずれかになります。 
-.TP 3
-\-verbose 
-コマンドラインでこのオプションが指定されている場合、\f3jarsigner\fPは「冗長」モードで動作し、JARの署名または検証の進行状況に関する追加情報を出力します。 
-.TP 3
-\-internalsf 
-以前は、JARファイルの署名時に生成された.DSA(署名ブロック)ファイルの中に、生成された.SFファイル(署名ファイル)の完全なコピーが符号化された形で含まれていました。この動作は変更されました。現在では、出力JARファイル全体のサイズを小さくするために、デフォルトでは.SFファイルのコピーが.DSAファイルに含まれないようになっています。ただし、\f2\-internalsf\fPオプションをコマンドラインで指定すると、以前と同じように動作します。\f3このオプションは、テストを行う場合には便利ですが、それ以外には使用しないでください。このオプションを使用すると、有益な最適化が行われなくなります。\fP 
-.TP 3
-\-sectionsonly 
-コマンドラインでこのオプションが指定されている場合、JARファイルの署名時に生成される.SFファイル(署名ファイル)には、マニフェスト・ファイル全体のハッシュを含むヘッダーは\f2含まれません\fP。この場合、.SFファイルに含まれるのは、JARファイル内の各ソース・ファイルに関する情報およびハッシュのみです。詳細は、署名(.SF)ファイルを参照してください。
-.br
-.br
-デフォルトでは、最適化のために、このヘッダーが追加されます。ヘッダーが存在する場合は、JARファイルの検証時に、まずヘッダー内のハッシュが、マニフェスト・ファイル全体のハッシュと実際に一致するかどうかが確認されます。一致する場合、検証は次の手順に進みます。ハッシュが一致しない場合は、効率的には劣る方法を使用して検証する必要があります。具体的には、.SFファイル内の各ソース・ファイル情報セクションのハッシュが、マニフェスト・ファイル内の対応するセクションのハッシュと一致するかどうかが確認されます。
-.br
-.br
-詳細は、JARファイルの検証を参照してください。
-.br
-.br
-\f3このオプションは、テストを行う場合には便利ですが、それ以外には使用しないでください。このオプションを使用すると、有益な最適化が行われなくなります。\fP 
-.TP 3
-\-protected 
-\f2true\fPまたは\f2false\fPのいずれか。専用PINリーダーなどの保護された認証パスを介してパスワードを指定する必要がある場合には、この値に\f2true\fPを指定してください。 
-.TP 3
-\-providerClass provider\-class\-name 
-サービス・プロバイダがセキュリティ・プロパティ・ファイル(\f2java.security\fP)のリストに入っていないときに、暗号化サービス・プロバイダのマスター・クラス・ファイルの名前を指定するために使用します。
-.br
-.br
-\f2\-providerArg\fP \f2ConfigFilePath\fPオプションと組み合せて使用します。keytoolとjarsignerはプロバイダを動的にインストールします(ここで、\f2ConfigFilePath\fPはトークン構成ファイルへのパスです)。セキュリティ・プロパティ・ファイル内でSun PKCS#11プロバイダが構成されていない場合にPKCS#11キーストアを一覧表示するコマンドの例を次に示します。 
-.nf
-\f3
-.fl
-jarsigner \-keystore NONE \-storetype PKCS11 \\ 
-.fl
-          \-providerClass sun.security.pkcs11.SunPKCS11 \\ 
-.fl
-          \-providerArg /foo/bar/token.config \\ 
-.fl
-          \-list
-.fl
-\fP
-.fi
-.TP 3
-\-providerName providerName 
-\f2java.security\fPセキュリティ・プロパティ・ファイル内で2つ以上のプロバイダが構成されている場合、\f2\-providerName\fPオプションを使用して特定のプロバイダ・インスタンスを選択できます。このオプションの引数は、プロバイダの名前です。
-.br
-.br
-Sun PKCS#11プロバイダの場合、\f2providerName\fPは\f2SunPKCS11\-\fP\f2TokenName\fPという形式になります。ここで\f2TokenName\fPは、プロバイダ・インスタンスが構成された名前の接尾辞です。詳細は
-.na
-\f2構成属性の表\fP @
-.fi
-http://docs.oracle.com/javase/7/docs/technotes/guides/security/p11guide.html#ATTRSを参照してください。たとえば、次のコマンドは、名前接尾辞\f2SmartCard\fPのPKCS#11キーストア・プロバイダ・インスタンスの内容をリストします。 
-.nf
-\f3
-.fl
-jarsigner \-keystore NONE \-storetype PKCS11 \\ 
-.fl
-        \-providerName SunPKCS11\-SmartCard \\ 
-.fl
-        \-list
-.fl
-\fP
-.fi
-.TP 3
-\-Jjavaoption 
-指定された\f2javaoption\fP文字列をJavaインタプリタに直接渡します。(\f3jarsigner\fPは、実際にはJavaインタプリタに対する「ラッパー」です。)このオプションには、空白を含めることはできません。このオプションは、実行環境またはメモリー使用を調整する場合に便利です。指定できるインタプリタ・オプションを一覧表示するには、コマンドラインで\f2java \-h\fPまたは\f2java \-X\fPと入力してください。  
-.TP 3
-\-tsa url 
-\f2「\-tsa http://example.tsa.url」\fPがJARファイルの署名時にコマンドラインにある場合、署名のタイムスタンプが生成されます。URL\f2http://example.tsa.url\fPは、TSA(Time Stamping Authority)の場所を示しています。これは、\f2\-tsacert\fPオプションで検出されたURLをオーバーライドします。\f2\-tsa\fPオプションでは、TSAの公開鍵証明書をキーストアに配置する必要はありません。
-.br
-.br
-タイムスタンプを生成するために、\f2jarsigner\fPは、
-.na
-\f2RFC 3161\fP @
-.fi
-http://www.ietf.org/rfc/rfc3161.txtで定義されているタイムスタンプ・プロトコル(TSP)を使用してTSAと通信します。成功すると、TSAから返されたタイムスタンプ・トークンは署名ブロック・ファイルの署名とともに保存されます。  
-.TP 3
-\-tsacert alias 
-\f2「\-tsacert alias」\fPがJARファイルの署名時にコマンドラインにある場合、署名のタイムスタンプが生成されます。\f2alias\fPは、キーストア内の現在有効なTSAの公開鍵証明書を示しています。エントリの証明書で、TSAの場所を特定するURLを含むSubject Information Access拡張機能が確認されます。
-.br
-.br
-\f2\-tsacert\fPを使用した場合は、TSAの公開鍵証明書がキーストアに配置されている必要があります。  
-.TP 3
-\-altsigner class 
-代替署名機構を使用することを指定します。完全修飾クラス名で、\f2com.sun.jarsigner.ContentSigner\fP抽象クラスを拡張するクラス・ファイルを指定します。このクラス・ファイルへのパスは、\f2\-altsignerpath\fPオプションによって定義されます。\f2\-altsigner\fPオプションが使用されると、\f2jarsigner\fPは、指定されたクラスが提供する署名機構を使用します。それ以外の場合、\f2jarsigner\fPはデフォルトの署名機構を使用します。
-.br
-.br
-たとえば、\f2com.sun.sun.jarsigner.AuthSigner\fPという名前のクラスが提供する署名機構を使用するには、\f2jarsigner\fPで\f2「\-altsigner com.sun.jarsigner.AuthSigner」\fPというオプションを使用します。 
-.TP 3
-\-altsignerpath classpathlist 
-クラス・ファイル(クラス・ファイル名は前述の\f2\-altsigner\fPオプションで指定します)およびそのクラスが依存するすべてのJARファイルへのパスを指定します。クラス・ファイルがJARファイル内にある場合、以下の例のようにJARファイルへのパスが指定されます。
-.br
-.br
-絶対パスまたは現在のディレクトリからの相対パスを指定できます。\f2classpathlist\fPに複数のパスやJARファイルが含まれる場合には、それらをSolarisの場合はコロン(\f2:\fP)で、Windowsの場合はセミコロン(\f2;\fP)でそれぞれ区切ります。目的のクラスがすでに検索パス内にある場合は、このオプションは不要です。
-.br
-.br
-クラス・ファイルを含む、JARファイルへのパスを指定する例を示します。 
-.nf
-\f3
-.fl
-\-altsignerpath /home/user/lib/authsigner.jar
-.fl
-\fP
-.fi
-JARファイル名が含まれていることに注意してください。
-.br
-.br
-クラス・ファイルを含むJARファイルへのパスを指定する例を示します。 
-.nf
-\f3
-.fl
-\-altsignerpath /home/user/classes/com/sun/tools/jarsigner/
-.fl
-\fP
-.fi
-JARファイル名は含まれていないことに留意してください。 
-.TP 3
-\-strict 
-署名または検証処理中に、なんらかの警告メッセージが表示される場合があります。コマンドラインでこのオプションを指定すると、見つかった警告メッセージがツールの終了コードに反映されます。詳細は、警告の項を参照してください。 
-.TP 3
-\-verbose:sub\-options 
-検証処理の場合、表示する情報の量を決定するサブオプションを\f2\-verbose\fPオプションに指定できます。\f2\-certs\fPも指定した場合、デフォルト・モード(またはサブオプションall)では、エントリが処理されるたびにそれらの各エントリが表示され、その後にJARファイルの各署名者の証明書情報も表示されます。\f2\-certs\fPと\f2\-verbose:grouped\fPサブオプションを指定した場合、同じ署名者情報を持つエントリとその証明書情報が、グループ化されて表示されます。\f2\-certs\fPと\f2\-verbose:summary\fPサブオプションを指定した場合、同じ署名者情報を持つエントリとその証明書情報がグループ化されて表示されますが、各エントリの詳細が「1つのエントリ(およびそれ以上)」として要約されて表示されます。詳細は、例の項を参照してください。 
-.RE
-
-.LP
-.SH "例"
-.LP
-.SS 
-JARファイルの署名
-.LP
-.LP
-bundle.jarという名前のJARファイルがあるとします。このファイルに、workingというディレクトリのmystoreというキーストアにあるキーストアの別名がjaneであるユーザーの秘密鍵を使用して、署名を付けるとします。次のコマンドを実行すると、JARファイルに署名を付けてsbundle.jarという署名付きJARファイルを作成できます。
-.LP
-.nf
-\f3
-.fl
-    jarsigner \-keystore /working/mystore \-storepass \fP\f4<keystore password>\fP\f3
-.fl
-      \-keypass \fP\f4<private key password>\fP\f3 \-signedjar sbundle.jar bundle.jar jane
-.fl
-\fP
-.fi
-
-.LP
-.LP
-上のコマンドでは\f2\-sigfile\fPが指定されていないため、署名付きJARファイルに格納される.SFファイルと.DSAファイルの名前は、別名からデフォルト名が付けられます。つまり、それらの名前は\f2JANE.SF\fPおよび\f2JANE.DSA\fPになります。
-.LP
-.LP
-ストアのパスワードと秘密鍵のパスワードの入力を求めるプロンプトを表示する場合は、上のコマンドを短縮して次のように入力できます。
-.LP
-.nf
-\f3
-.fl
-    jarsigner \-keystore /working/mystore
-.fl
-      \-signedjar sbundle.jar bundle.jar jane
-.fl
-\fP
-.fi
-
-.LP
-.LP
-デフォルトのキーストア(ホーム・ディレクトリ内の.keystoreという名前のキーストア)を使用する場合は、次に示すように、キーストアの指定を省略できます。
-.LP
-.nf
-\f3
-.fl
-    jarsigner \-signedjar sbundle.jar bundle.jar jane
-.fl
-\fP
-.fi
-
-.LP
-.LP
-最後に、入力JARファイル(\f2bundle.jar\fP)を署名付きJARファイルで単純に上書きする場合は、次のように\f2\-signedjar\fPオプションを指定する必要はありません。
-.LP
-.nf
-\f3
-.fl
-    jarsigner bundle.jar jane
-.fl
-\fP
-.fi
-
-.LP
-.SS 
-署名付きJARファイルの検証
-.LP
-.LP
-署名付きJARファイルを検証する、つまり署名が有効でJARファイルが改変されていないことを確認するには、次のようなコマンドを入力します。
-.LP
-.nf
-\f3
-.fl
-    jarsigner \-verify sbundle.jar
-.fl
-\fP
-.fi
-
-.LP
-.LP
-検証が成功すると、
-.LP
-.nf
-\f3
-.fl
-    jar verified.
-.fl
-\fP
-.fi
-
-.LP
-.LP
-と表示されます。それ以外の場合は、エラー・メッセージが表示されます。
-.LP
-.LP
-\f2\-verbose\fPオプションを使用すると、より多くの情報が表示されます。\f2\-verbose\fPオプション付きで\f3jarsigner\fPを使用する例とその出力例を、次に示します。
-.LP
-.nf
-\f3
-.fl
-    jarsigner \-verify \-verbose sbundle.jar
-.fl
-
-.fl
-           198 Fri Sep 26 16:14:06 PDT 1997 META\-INF/MANIFEST.MF
-.fl
-           199 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE.SF
-.fl
-          1013 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE.DSA
-.fl
-    smk   2752 Fri Sep 26 16:12:30 PDT 1997 AclEx.class
-.fl
-    smk    849 Fri Sep 26 16:12:46 PDT 1997 test.class
-.fl
-
-.fl
-      s = signature was verified
-.fl
-      m = entry is listed in manifest
-.fl
-      k = at least one certificate was found in keystore
-.fl
-
-.fl
-    jar verified.
-.fl
-\fP
-.fi
-
-.LP
-.SS 
-証明書情報を使用した検証
-.LP
-.LP
-検証時に\f2\-verify\fPと\f2\-verbose\fPオプションに加えて\f2\-certs\fPオプションを指定した場合は、JARファイルの各署名者の証明書情報も出力されます。これには、証明書タイプ、署名者識別名情報(X.509証明書の場合のみ)、およびJARファイルの公開鍵の証明書がキーストア・エントリの証明書に一致した場合には、括弧で囲まれた署名者のキーストア別名が含まれます。次に示します。
-.LP
-.nf
-\f3
-.fl
-    jarsigner \-keystore /working/mystore \-verify \-verbose \-certs myTest.jar
-.fl
-
-.fl
-           198 Fri Sep 26 16:14:06 PDT 1997 META\-INF/MANIFEST.MF
-.fl
-           199 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE.SF
-.fl
-          1013 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE.DSA
-.fl
-           208 Fri Sep 26 16:23:30 PDT 1997 META\-INF/JAVATEST.SF
-.fl
-          1087 Fri Sep 26 16:23:30 PDT 1997 META\-INF/JAVATEST.DSA
-.fl
-    smk   2752 Fri Sep 26 16:12:30 PDT 1997 Tst.class
-.fl
-
-.fl
-      X.509, CN=Test Group, OU=Java Software, O=Sun Microsystems, L=CUP, S=CA, C=US (javatest)
-.fl
-      X.509, CN=Jane Smith, OU=Java Software, O=Sun, L=cup, S=ca, C=us (jane)
-.fl
-
-.fl
-      s = signature was verified
-.fl
-      m = entry is listed in manifest
-.fl
-      k = at least one certificate was found in keystore
-.fl
-
-.fl
-    jar verified.
-.fl
-\fP
-.fi
-
-.LP
-.LP
-署名者の証明書がX.509証明書でない場合は、識別名情報は表示されません。その場合には、証明書のタイプと別名のみが表示されます。たとえば、証明書がPGP証明書で、別名がbobの場合は、次のように表示されます。
-.LP
-.nf
-\f3
-.fl
-      PGP, (bob)
-.fl
-\fP
-.fi
-
-.LP
-.SS 
-アイデンティティ・データベースの署名者を含むJARファイルの検証
-.LP
-.LP
-JARファイルが、JDK 1.1の\f3javakey\fPツールを使用して署名されている場合、署名者はアイデンティティ・データベース内の別名です。この場合、検証の出力には「i」という記号が含まれます。JARファイルが、アイデンティティ・データベース内の別名とキーストア内の別名の両方によって署名されている場合は、「k」と「i」の両方が表示されます。
-.LP
-.LP
-\f2\-certs\fPオプションを指定した場合、キーストアの別名は括弧で囲まれるのに対し、アイデンティティ・データベース内の別名は角括弧で囲まれて表示されます。次に例を示します。
-.LP
-.nf
-\f3
-.fl
-    jarsigner \-keystore /working/mystore \-verify \-verbose \-certs writeFile.jar
-.fl
-
-.fl
-           198 Fri Sep 26 16:14:06 PDT 1997 META\-INF/MANIFEST.MF
-.fl
-           199 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE.SF
-.fl
-          1013 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE.DSA
-.fl
-           199 Fri Sep 27 12:22:30 PDT 1997 META\-INF/DUKE.SF
-.fl
-          1013 Fri Sep 27 12:22:30 PDT 1997 META\-INF/DUKE.DSA
-.fl
-   smki   2752 Fri Sep 26 16:12:30 PDT 1997 writeFile.html
-.fl
-
-.fl
-      X.509, CN=Jane Smith, OU=Java Software, O=Sun, L=cup, S=ca, C=us (jane)
-.fl
-      X.509, CN=Duke, OU=Java Software, O=Sun, L=cup, S=ca, C=us [duke]
-.fl
-
-.fl
-      s = signature was verified
-.fl
-      m = entry is listed in manifest
-.fl
-      k = at least one certificate was found in keystore
-.fl
-      i = at least one certificate was found in identity scope
-.fl
-
-.fl
-    jar verified.
-.fl
-\fP
-.fi
-
-.LP
-.LP
-別名dukeは角括弧で囲まれているので、この別名はキーストアの別名ではなく、アイデンティティ・データベースの別名です。
-.LP
-.SH "警告"
-.LP
-署名/検証処理中には、jarsignerから様々な警告が表示される可能性があります。これらの警告コードは次のように定義されています。 
-.nf
-\f3
-.fl
-         hasExpiringCert         2
-.fl
-             This jar contains entries whose signer certificate will expire within six months
-.fl
-
-.fl
-         hasExpiredCert          4
-.fl
-             This jar contains entries whose signer certificate has expired.
-.fl
-
-.fl
-         notYetValidCert         4
-.fl
-             This jar contains entries whose signer certificate is not yet valid.
-.fl
-
-.fl
-         chainNotValidated       4
-.fl
-             This jar contains entries whose certificate chain cannot be correctly validated.
-.fl
-
-.fl
-         badKeyUsage             8
-.fl
-             This jar contains entries whose signer certificate's KeyUsage extension doesn't allow code signing.
-.fl
-
-.fl
-         badExtendedKeyUsage     8
-.fl
-             This jar contains entries whose signer certificate's ExtendedKeyUsage extension
-.fl
-             doesn't allow code signing.
-.fl
-
-.fl
-         badNetscapeCertType     8
-.fl
-             This jar contains entries whose signer certificate's NetscapeCertType extension
-.fl
-             doesn't allow code signing.
-.fl
-
-.fl
-         hasUnsignedEntry        16
-.fl
-             This jar contains unsigned entries which have not been integrity\-checked.
-.fl
-
-.fl
-         notSignedByAlias        32
-.fl
-             This jar contains signed entries which are not signed by the specified alias(es)
-.fl
-
-.fl
-         aliasNotInStore         32
-.fl
-             This jar contains signed entries that are not signed by alias in this keystore
-.fl
-
-.fl
-\fP
-.fi
-
-.LP
-.LP
-\f2\-strict\fPオプションを指定した場合、検出された警告のORを取った値がツールの終了コードとして返されます。たとえば、エントリの署名に使用される証明書が期限切れになっていて、かつその証明書のkeyUsage拡張でファイルの署名が許可されていない場合、終了コード12(=4+8)が返されます。
-.LP
-.LP
-\f3注意\fP: UNIXで使用可能な値は0から255のみであるため、終了コードは再利用されます。いずれにしても、署名/検証処理が失敗すると、次の終了コードが返されます。
-.LP
-.nf
-\f3
-.fl
-failure                 1
-.fl
-\fP
-.fi
-
-.LP
-.SS 
-JDK 1.1との互換性
-.LP
-.LP
-\f3keytool\fPツールと\f3jarsigner\fPツールは、JDK 1.1で提供されていた\f3javakey\fPツールを完全に置き換えるものです。これらの新しいツールは、キーストアと秘密鍵をパスワードで保護する機能や、署名の生成に加えて署名を検証する機能など、\f3javakey\fPより多くのを機能を備えています。
-.LP
-.LP
-新しいキーストア・アーキテクチャは、\f3javakey\fPが作成して管理していたアイデンティティ・データベースに代わるものです。キーストア形式と、1.1の\f3javakey\fPが使用していたデータベース形式との間には下位互換性はありません。ただし、次のことは可能です。
-.LP
-.RS 3
-.TP 2
-o
-\f3keytool\fPの\f2\-identitydb\fPコマンドを使用すると、アイデンティティ・データベースの情報をキーストアにインポートできます。 
-.TP 2
-o
-\f3jarsigner\fPは、以前に\f3javakey\fPを使用して署名されたJARファイルに署名を付けることができます。 
-.TP 2
-o
-\f3jarsigner\fPは、\f3javakey\fPを使用して署名されたJARファイルを検証できます。したがって、Java 2 SDKのキーストアではなくJDK 1.1のアイデンティティ・データベースからの署名者別名を認識し、これらを対象に処理を行うことができます。 
-.RE
-
-.LP
-.LP
-次の表は、JDK 1.1.xで署名されたJARファイルが、Java 2プラットフォームでどのように扱われるかを示しています。
-.LP
-.LP
-.TS
-.if \n+(b.=1 .nr d. \n(.c-\n(c.-1
-.de 35
-.ps \n(.s
-.vs \n(.vu
-.in \n(.iu
-.if \n(.u .fi
-.if \n(.j .ad
-.if \n(.j=0 .na
-..
-.nf
-.nr #~ 0
-.if n .nr #~ 0.6n
-.ds #d .d
-.if \(ts\n(.z\(ts\(ts .ds #d nl
-.fc
-.nr 33 \n(.s
-.rm 80 81 82 83 84
-.nr 34 \n(.lu
-.eo
-.am 80
-.br
-.di a+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(80 .ll \n(80u
-.in 0
-\f3JARファイルのタイプ\fP
-.br
-.di
-.nr a| \n(dn
-.nr a- \n(dl
-..
-.ec \
-.eo
-.am 81
-.br
-.di b+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(81 .ll \n(81u
-.in 0
-\f31.1データベース内のアイデンティティ\fP
-.br
-.di
-.nr b| \n(dn
-.nr b- \n(dl
-..
-.ec \
-.eo
-.am 82
-.br
-.di c+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(82 .ll \n(82u
-.in 0
-\f31.1データベースからJava 2 Platformキーストアにインポートされる信頼できるアイデンティティ(4)\fP
-.br
-.di
-.nr c| \n(dn
-.nr c- \n(dl
-..
-.ec \
-.eo
-.am 83
-.br
-.di d+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(83 .ll \n(83u
-.in 0
-\f3ポリシー・ファイルがアイデンティティ/別名に特権を付与\fP
-.br
-.di
-.nr d| \n(dn
-.nr d- \n(dl
-..
-.ec \
-.eo
-.am 84
-.br
-.di e+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(84 .ll \n(84u
-.in 0
-すべてのコードに付与されるデフォルトの特権
-.br
-.di
-.nr e| \n(dn
-.nr e- \n(dl
-..
-.ec \
-.eo
-.am 84
-.br
-.di f+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(84 .ll \n(84u
-.in 0
-すべてのコードに付与されるデフォルトの特権
-.br
-.di
-.nr f| \n(dn
-.nr f- \n(dl
-..
-.ec \
-.eo
-.am 84
-.br
-.di g+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(84 .ll \n(84u
-.in 0
-すべてのコードに付与されるデフォルトの特権
-.br
-.di
-.nr g| \n(dn
-.nr g- \n(dl
-..
-.ec \
-.eo
-.am 81
-.br
-.di h+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(81 .ll \n(81u
-.in 0
-はい/信頼できない
-.br
-.di
-.nr h| \n(dn
-.nr h- \n(dl
-..
-.ec \
-.eo
-.am 84
-.br
-.di i+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(84 .ll \n(84u
-.in 0
-すべてのコードに付与されるデフォルトの特権(3)
-.br
-.di
-.nr i| \n(dn
-.nr i- \n(dl
-..
-.ec \
-.eo
-.am 81
-.br
-.di j+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(81 .ll \n(81u
-.in 0
-はい/信頼できない
-.br
-.di
-.nr j| \n(dn
-.nr j- \n(dl
-..
-.ec \
-.eo
-.am 84
-.br
-.di k+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(84 .ll \n(84u
-.in 0
-すべてのコードに付与されるデフォルトの特権(1、3)
-.br
-.di
-.nr k| \n(dn
-.nr k- \n(dl
-..
-.ec \
-.eo
-.am 84
-.br
-.di l+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(84 .ll \n(84u
-.in 0
-すべてのコードに付与されるデフォルトの特権とポリシー・ファイル内で付与される特権
-.br
-.di
-.nr l| \n(dn
-.nr l- \n(dl
-..
-.ec \
-.eo
-.am 84
-.br
-.di m+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(84 .ll \n(84u
-.in 0
-すべてのコードに付与されるデフォルトの特権とポリシー・ファイル内で付与される特権(2)
-.br
-.di
-.nr m| \n(dn
-.nr m- \n(dl
-..
-.ec \
-.35
-.nf
-.ll \n(34u
-.nr 80 0
-.nr 38 \w署名付きJAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \w署名のないJAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \w署名付きJAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \w署名付きJAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \w署名付きJAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \w署名付きJAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \w署名付きJAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \w署名付きJAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \w署名付きJAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \w署名付きJAR
-.if \n(80<\n(38 .nr 80 \n(38
-.80
-.rm 80
-.nr 38 \n(a-
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 81 0
-.nr 38 \wいいえ
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wいいえ
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wいいえ
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wいいえ
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wはい/信頼できる
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wはい/信頼できる
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wはい/信頼できる
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wはい/信頼できる
-.if \n(81<\n(38 .nr 81 \n(38
-.81
-.rm 81
-.nr 38 \n(b-
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \n(h-
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \n(j-
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 82 0
-.nr 38 \wいいえ
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wいいえ
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wはい
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wいいえ
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wいいえ
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wはい
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wはい
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wいいえ
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wはい
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wいいえ
-.if \n(82<\n(38 .nr 82 \n(38
-.82
-.rm 82
-.nr 38 \n(c-
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 83 0
-.nr 38 \wいいえ
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wいいえ
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wいいえ
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wいいえ
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wはい
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wはい
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wはい
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wいいえ
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wいいえ
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wはい
-.if \n(83<\n(38 .nr 83 \n(38
-.83
-.rm 83
-.nr 38 \n(d-
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 84 0
-.nr 38 \w\f3付与される特権\fP
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \wすべての特権
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \wすべての特権(1)
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \wすべての特権(1)
-.if \n(84<\n(38 .nr 84 \n(38
-.84
-.rm 84
-.nr 38 \n(e-
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \n(f-
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \n(g-
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \n(i-
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \n(k-
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \n(l-
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \n(m-
-.if \n(84<\n(38 .nr 84 \n(38
-.35
-.nf
-.ll \n(34u
-.nr 38 1n
-.nr 79 0
-.nr 40 \n(79+(0*\n(38)
-.nr 80 +\n(40
-.nr 41 \n(80+(3*\n(38)
-.nr 81 +\n(41
-.nr 42 \n(81+(3*\n(38)
-.nr 82 +\n(42
-.nr 43 \n(82+(3*\n(38)
-.nr 83 +\n(43
-.nr 44 \n(83+(3*\n(38)
-.nr 84 +\n(44
-.nr TW \n(84
-.if t .if \n(TW>\n(.li .tm Table at line 1090 file Input is too wide - \n(TW units
-.fc  
-.nr #T 0-1
-.nr #a 0-1
-.eo
-.de T#
-.ds #d .d
-.if \(ts\n(.z\(ts\(ts .ds #d nl
-.mk ##
-.nr ## -1v
-.ls 1
-.ls
-..
-.ec
-.ne \n(a|u+\n(.Vu
-.ne \n(b|u+\n(.Vu
-.ne \n(c|u+\n(.Vu
-.ne \n(d|u+\n(.Vu
-.if (\n(a|+\n(#^-1v)>\n(#- .nr #- +(\n(a|+\n(#^-\n(#--1v)
-.if (\n(b|+\n(#^-1v)>\n(#- .nr #- +(\n(b|+\n(#^-\n(#--1v)
-.if (\n(c|+\n(#^-1v)>\n(#- .nr #- +(\n(c|+\n(#^-\n(#--1v)
-.if (\n(d|+\n(#^-1v)>\n(#- .nr #- +(\n(d|+\n(#^-\n(#--1v)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u 
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'\h'|\n(41u'\h'|\n(42u'\h'|\n(43u'\h'|\n(44u'\f3付与される特権\fP
-.mk ##
-.nr 31 \n(##
-.sp |\n(##u-1v
-.nr 37 \n(40u
-.in +\n(37u
-.a+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(##u-1v
-.nr 37 \n(41u
-.in +\n(37u
-.b+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(##u-1v
-.nr 37 \n(42u
-.in +\n(37u
-.c+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(##u-1v
-.nr 37 \n(43u
-.in +\n(37u
-.d+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(31u
-.ne \n(e|u+\n(.Vu
-.if (\n(e|+\n(#^-1v)>\n(#- .nr #- +(\n(e|+\n(#^-\n(#--1v)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u 
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'署名付きJAR\h'|\n(41u'いいえ\h'|\n(42u'いいえ\h'|\n(43u'いいえ\h'|\n(44u'
-.mk ##
-.nr 31 \n(##
-.sp |\n(##u-1v
-.nr 37 \n(44u
-.in +\n(37u
-.e+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(31u
-.ne \n(f|u+\n(.Vu
-.if (\n(f|+\n(#^-1v)>\n(#- .nr #- +(\n(f|+\n(#^-\n(#--1v)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u 
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'署名のないJAR\h'|\n(41u'いいえ\h'|\n(42u'いいえ\h'|\n(43u'いいえ\h'|\n(44u'
-.mk ##
-.nr 31 \n(##
-.sp |\n(##u-1v
-.nr 37 \n(44u
-.in +\n(37u
-.f+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(31u
-.ne \n(g|u+\n(.Vu
-.if (\n(g|+\n(#^-1v)>\n(#- .nr #- +(\n(g|+\n(#^-\n(#--1v)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u 
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'署名付きJAR\h'|\n(41u'いいえ\h'|\n(42u'はい\h'|\n(43u'いいえ\h'|\n(44u'
-.mk ##
-.nr 31 \n(##
-.sp |\n(##u-1v
-.nr 37 \n(44u
-.in +\n(37u
-.g+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(31u
-.ne \n(h|u+\n(.Vu
-.ne \n(i|u+\n(.Vu
-.if (\n(h|+\n(#^-1v)>\n(#- .nr #- +(\n(h|+\n(#^-\n(#--1v)
-.if (\n(i|+\n(#^-1v)>\n(#- .nr #- +(\n(i|+\n(#^-\n(#--1v)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u 
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'署名付きJAR\h'|\n(41u'\h'|\n(42u'いいえ\h'|\n(43u'いいえ\h'|\n(44u'
-.mk ##
-.nr 31 \n(##
-.sp |\n(##u-1v
-.nr 37 \n(41u
-.in +\n(37u
-.h+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(##u-1v
-.nr 37 \n(44u
-.in +\n(37u
-.i+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(31u
-.ne \n(j|u+\n(.Vu
-.ne \n(k|u+\n(.Vu
-.if (\n(j|+\n(#^-1v)>\n(#- .nr #- +(\n(j|+\n(#^-\n(#--1v)
-.if (\n(k|+\n(#^-1v)>\n(#- .nr #- +(\n(k|+\n(#^-\n(#--1v)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u 
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'署名付きJAR\h'|\n(41u'\h'|\n(42u'いいえ\h'|\n(43u'はい\h'|\n(44u'
-.mk ##
-.nr 31 \n(##
-.sp |\n(##u-1v
-.nr 37 \n(41u
-.in +\n(37u
-.j+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(##u-1v
-.nr 37 \n(44u
-.in +\n(37u
-.k+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(31u
-.ne \n(l|u+\n(.Vu
-.if (\n(l|+\n(#^-1v)>\n(#- .nr #- +(\n(l|+\n(#^-\n(#--1v)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u 
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'署名付きJAR\h'|\n(41u'いいえ\h'|\n(42u'はい\h'|\n(43u'はい\h'|\n(44u'
-.mk ##
-.nr 31 \n(##
-.sp |\n(##u-1v
-.nr 37 \n(44u
-.in +\n(37u
-.l+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(31u
-.ne \n(m|u+\n(.Vu
-.if (\n(m|+\n(#^-1v)>\n(#- .nr #- +(\n(m|+\n(#^-\n(#--1v)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u 
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'署名付きJAR\h'|\n(41u'はい/信頼できる\h'|\n(42u'はい\h'|\n(43u'はい\h'|\n(44u'
-.mk ##
-.nr 31 \n(##
-.sp |\n(##u-1v
-.nr 37 \n(44u
-.in +\n(37u
-.m+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(31u
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u 
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'署名付きJAR\h'|\n(41u'はい/信頼できる\h'|\n(42u'いいえ\h'|\n(43u'いいえ\h'|\n(44u'すべての特権
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u 
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'署名付きJAR\h'|\n(41u'はい/信頼できる\h'|\n(42u'はい\h'|\n(43u'いいえ\h'|\n(44u'すべての特権(1)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u 
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'署名付きJAR\h'|\n(41u'はい/信頼できる\h'|\n(42u'いいえ\h'|\n(43u'はい\h'|\n(44u'すべての特権(1)
-.fc
-.nr T. 1
-.T# 1
-.35
-.rm a+
-.rm b+
-.rm c+
-.rm d+
-.rm e+
-.rm f+
-.rm g+
-.rm h+
-.rm i+
-.rm j+
-.rm k+
-.rm l+
-.rm m+
-.TE
-.if \n-(b.=0 .nr c. \n(.c-\n(d.-50
-
-.LP
-.LP
-注意:
-.LP
-.RS 3
-.TP 3
-1.
-ポリシー・ファイル内にアイデンティティ/別名についての言及がある場合、それをキーストアにインポートして、付与された特権にポリシー・ファイルの設定が反映されるようにする必要があります。 
-.TP 3
-2.
-ポリシー・ファイル/キーストアの組合せは、アイデンティティ・データベース内の信頼できるアイデンティティよりも優先されます。 
-.TP 3
-3.
-Java 2プラットフォームでは、信頼できないアイデンティティは無視されます。 
-.TP 3
-4.
-Java 2 SDKキーストアにインポートできるのは、信頼できるアイデンティティのみです。 
-.RE
-
-.LP
-.SH "関連項目"
-.LP
-.RS 3
-.TP 2
-o
-jar(1)ツールのドキュメント 
-.TP 2
-o
-keytool(1)ツールのドキュメント 
-.TP 2
-o
-\f3jarsigner\fPツールの使用例は、
-.na
-\f4Javaチュートリアル\fP @
-.fi
-http://docs.oracle.com/javase/tutorial/index.htmlの
-.na
-\f4セキュリティ\fP @
-.fi
-http://docs.oracle.com/javase/tutorial/security/index.htmlを参照 
-.RE
-
-.LP
- 
+'pl 8.5i
+'bp
--- a/src/linux/doc/man/jarsigner.1	Fri Jan 10 15:10:25 2014 +0000
+++ b/src/linux/doc/man/jarsigner.1	Thu Jan 23 19:23:55 2014 +0000
@@ -1,1569 +1,985 @@
-." Copyright (c) 1998, 2011, Oracle and/or its affiliates. All rights reserved.
-." DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-."
-." This code is free software; you can redistribute it and/or modify it
-." under the terms of the GNU General Public License version 2 only, as
-." published by the Free Software Foundation.
-."
-." This code is distributed in the hope that it will be useful, but WITHOUT
-." ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-." FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-." version 2 for more details (a copy is included in the LICENSE file that
-." accompanied this code).
-."
-." You should have received a copy of the GNU General Public License version
-." 2 along with this work; if not, write to the Free Software Foundation,
-." Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-."
-." Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-." or visit www.oracle.com if you need additional information or have any
-." questions.
-."
-.TH jarsigner 1 "16 Mar 2012"
+'\" t
+.\"  Copyright (c) 1998, 2013, Oracle and/or its affiliates. All rights reserved.
+.\"
+.\" DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+.\"
+.\" This code is free software; you can redistribute it and/or modify it
+.\" under the terms of the GNU General Public License version 2 only, as
+.\" published by the Free Software Foundation.
+.\"
+.\" This code is distributed in the hope that it will be useful, but WITHOUT
+.\" ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+.\" FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+.\" version 2 for more details (a copy is included in the LICENSE file that
+.\" accompanied this code).
+.\"
+.\" You should have received a copy of the GNU General Public License version
+.\" 2 along with this work; if not, write to the Free Software Foundation,
+.\" Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+.\"
+.\" Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+.\" or visit www.oracle.com if you need additional information or have any
+.\" questions.
+.\"
+.\"     Arch: generic
+.\"     Software: JDK 7
+.\"     Date: 6 August 2013
+.\"     SectDesc: Security Tools
+.\"     Title: jarsigner.1
+.\"
+.if n .pl 99999
+.TH jarsigner 1 "6 August 2013" "JDK 7" "Security Tools"
+.\" -----------------------------------------------------------------
+.\" * Define some portability stuff
+.\" -----------------------------------------------------------------
+.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.\" http://bugs.debian.org/507673
+.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
+.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.ie \n(.g .ds Aq \(aq
+.el       .ds Aq '
+.\" -----------------------------------------------------------------
+.\" * set default formatting
+.\" -----------------------------------------------------------------
+.\" disable hyphenation
+.nh
+.\" disable justification (adjust text to left margin only)
+.ad l
+.\" -----------------------------------------------------------------
+.\" * MAIN CONTENT STARTS HERE *
+.\" -----------------------------------------------------------------
 
-.LP
-.SH "Name"
-jarsigner \- JAR Signing and Verification Tool
-.LP
-.LP
-Generates signatures for Java ARchive (JAR) files, and verifies the signatures of signed JAR files.
-.LP
-.SH "SYNOPSIS"
-.LP
-.nf
-\f3
-.fl
-\fP\f3jarsigner\fP [ options ] jar\-file alias
-.fl
-\f3jarsigner\fP \-verify [ options ] jar\-file [alias...]
-.fl
-.fi
+.SH NAME    
+jarsigner \- Signs and verifies Java Archive (JAR) files\&.
+.SH SYNOPSIS    
+.sp     
+.nf     
 
-.LP
-.LP
-The jarsigner \-verify command can take zero or more keystore alias names after the jar filename. When specified, jarsigner will check that the certificate used to verify each signed entry in the jar file matches one of the keystore aliases. The aliases are defined in the keystore specified by \-keystore, or the default keystore.
-.LP
-.SH "DESCRIPTION"
-.LP
-.LP
-The \f3jarsigner\fP tool is used for two purposes:
-.LP
-.RS 3
-.TP 3
-1.
-to sign Java ARchive (JAR) files, and 
-.TP 3
-2.
-to verify the signatures and integrity of signed JAR files. 
-.RE
+\fBjarsigner\fR [ \fIoptions\fR ] \fIjar\-file\fR \fIalias\fR
+.fi     
+.nf     
 
-.LP
-.LP
-The JAR feature enables the packaging of class files, images, sounds, and other digital data in a single file for faster and easier distribution. A tool named jar(1) enables developers to produce JAR files. (Technically, any zip file can also be considered a JAR file, although when created by \f3jar\fP or processed by \f3jarsigner\fP, JAR files also contain a META\-INF/MANIFEST.MF file.)
-.LP
-.LP
-A \f2digital signature\fP is a string of bits that is computed from some data (the data being "signed") and the private key of an entity (a person, company, etc.). Like a handwritten signature, a digital signature has many useful characteristics:
-.LP
-.RS 3
-.TP 2
-o
-Its authenticity can be verified, via a computation that uses the public key corresponding to the private key used to generate the signature. 
-.TP 2
-o
-It cannot be forged, assuming the private key is kept secret. 
-.TP 2
-o
-It is a function of the data signed and thus can't be claimed to be the signature for other data as well. 
-.TP 2
-o
-The signed data cannot be changed; if it is, the signature will no longer verify as being authentic. 
-.RE
+\fBjarsigner\fR \fB\-verify\fR [ \fIoptions\fR ] \fIjar\-file\fR [\fIalias \&.\&.\&.\fR]
+.fi     
+.sp     
+.TP     
+\fIoptions\fR
+The command-line options\&. See Options\&.
+.TP
+-verify
+.br
+The \f3-verify\fR option can take zero or more keystore alias names after the JAR file name\&. When the \f3-verify\fR option is specified, the \f3jarsigner\fR command checks that the certificate used to verify each signed entry in the JAR file matches one of the keystore aliases\&. The aliases are defined in the keystore specified by \f3-keystore\fR or the default keystore\&.
 
-.LP
-.LP
-In order for an entity's signature to be generated for a file, the entity must first have a public/private key pair associated with it, and also one or more certificates authenticating its public key. A \f2certificate\fP is a digitally signed statement from one entity, saying that the public key of some other entity has a particular value.
-.LP
-.LP
-\f3jarsigner\fP uses key and certificate information from a \f2keystore\fP to generate digital signatures for JAR files. A keystore is a database of private keys and their associated X.509 certificate chains authenticating the corresponding public keys. The keytool(1) utility is used to create and administer keystores.
-.LP
-.LP
-\f3jarsigner\fP uses an entity's private key to generate a signature. The signed JAR file contains, among other things, a copy of the certificate from the keystore for the public key corresponding to the private key used to sign the file. \f3jarsigner\fP can verify the digital signature of the signed JAR file using the certificate inside it (in its signature block file).
-.LP
-.LP
-\f3jarsigner\fP can generate signatures that include a timestamp, thus enabling systems/deployer (including Java Plug\-in) to check whether the JAR file was signed while the signing certificate was still valid. In addition, APIs will allow applications to obtain the timestamp information.
-.LP
-.LP
-At this time, \f3jarsigner\fP can only sign JAR files created by the SDK jar(1) tool or zip files. (JAR files are the same as zip files, except they also have a META\-INF/MANIFEST.MF file. Such a file will automatically be created when \f3jarsigner\fP signs a zip file.)
-.LP
-.LP
-The default \f3jarsigner\fP behavior is to \f2sign\fP a JAR (or zip) file. Use the \f2\-verify\fP option to instead have it \f2verify\fP a signed JAR file.
-.LP
-.SS 
-Keystore Aliases
-.LP
-.LP
-All keystore entities are accessed via unique \f2aliases\fP.
-.LP
-.LP
-When using \f3jarsigner\fP to sign a JAR file, you must specify the alias for the keystore entry containing the private key needed to generate the signature. For example, the following will sign the JAR file named "MyJARFile.jar", using the private key associated with the alias "duke" in the keystore named "mystore" in the "working" directory. Since no output file is specified, it overwrites MyJARFile.jar with the signed JAR file.
-.LP
-.nf
-\f3
-.fl
-    jarsigner \-keystore /working/mystore \-storepass \fP\f4<keystore password>\fP\f3
-.fl
-      \-keypass \fP\f4<private key password>\fP\f3 MyJARFile.jar duke
-.fl
-\fP
-.fi
+If you also specified the \f3-strict\fR option, and the \f3jarsigner\fR command detected severe warnings, the message, "jar verified, with signer errors" is displayed\&.
+.TP     
+\fIjar-file\fR
+The JAR file to be signed\&.
 
-.LP
-.LP
-Keystores are protected with a password, so the store password must be specified. You will be prompted for it if you don't specify it on the command line. Similarly, private keys are protected in a keystore with a password, so the private key's password must be specified, and you will be prompted for it if you don't specify it on the command line and it isn't the same as the store password.
-.LP
-.SS 
-Keystore Location
-.LP
-.LP
-\f3jarsigner\fP has a \f2\-keystore\fP option for specifying the URL of the keystore to be used. The keystore is by default stored in a file named \f2.keystore\fP in the user's home directory, as determined by the \f2user.home\fP system property. On Solaris systems \f2user.home\fP defaults to the user's home directory.
-.LP
-.LP
-Note that the input stream from the \f2\-keystore\fP option is passed to the \f2KeyStore.load\fP method. If \f2NONE\fP is specified as the URL, then a null stream is passed to the \f2KeyStore.load\fP method. \f2NONE\fP should be specified if the \f2KeyStore\fP is not file\-based, for example, if it resides on a hardware token device.
-.LP
-.SS 
-Keystore Implementation
-.LP
-.LP
-The \f2KeyStore\fP class provided in the \f2java.security\fP package supplies well\-defined interfaces to access and modify the information in a keystore. It is possible for there to be multiple different concrete implementations, where each implementation is that for a particular \f2type\fP of keystore.
-.LP
-.LP
-Currently, there are two command\-line tools that make use of keystore implementations (\f3keytool\fP and \f3jarsigner\fP), and also a GUI\-based tool named \f3Policy Tool\fP. Since \f2KeyStore\fP is publicly available, Java 2 SDK users can write additional security applications that use it.
-.LP
-.LP
-There is a built\-in default implementation, provided by Sun Microsystems. It implements the keystore as a file, utilizing a proprietary keystore type (format) named "JKS". It protects each private key with its individual password, and also protects the integrity of the entire keystore with a (possibly different) password.
-.LP
-.LP
-Keystore implementations are provider\-based. More specifically, the application interfaces supplied by \f2KeyStore\fP are implemented in terms of a "Service Provider Interface" (SPI). That is, there is a corresponding abstract \f2KeystoreSpi\fP class, also in the \f2java.security\fP package, which defines the Service Provider Interface methods that "providers" must implement. (The term "provider" refers to a package or a set of packages that supply a concrete implementation of a subset of services that can be accessed by the Java Security API.) Thus, to provide a keystore implementation, clients must implement a provider and supply a KeystoreSpi subclass implementation, as described in 
-.na
-\f2How to Implement a Provider for the Java Cryptography Architecture\fP @
-.fi
-http://docs.oracle.com/javase/7/docs/technotes/guides/security/crypto/HowToImplAProvider.html.
-.LP
-.LP
-Applications can choose different \f2types\fP of keystore implementations from different providers, using the "getInstance" factory method supplied in the \f2KeyStore\fP class. A keystore type defines the storage and data format of the keystore information, and the algorithms used to protect private keys in the keystore and the integrity of the keystore itself. Keystore implementations of different types are not compatible.
-.LP
-.LP
-\f3keytool\fP works on any file\-based keystore implementation. (It treats the keystore location that is passed to it at the command line as a filename and converts it to a FileInputStream, from which it loads the keystore information.) The \f3jarsigner\fP and \f3policytool\fP tools, on the other hand, can read a keystore from any location that can be specified using a URL.
-.LP
-.LP
-For \f3jarsigner\fP and \f3keytool\fP, you can specify a keystore type at the command line, via the \f2\-storetype\fP option. For \f3Policy Tool\fP, you can specify a keystore type via the "Change Keystore" command in the Edit menu.
-.LP
-.LP
-If you don't explicitly specify a keystore type, the tools choose a keystore implementation based simply on the value of the \f2keystore.type\fP property specified in the security properties file. The security properties file is called \f2java.security\fP, and it resides in the SDK security properties directory, \f2java.home\fP/lib/security, where \f2java.home\fP is the runtime environment's directory (the \f2jre\fP directory in the SDK or the top\-level directory of the Java 2 Runtime Environment).
-.LP
-.LP
-Each tool gets the \f2keystore.type\fP value and then examines all the currently\-installed providers until it finds one that implements keystores of that type. It then uses the keystore implementation from that provider.
-.LP
-.LP
-The \f2KeyStore\fP class defines a static method named \f2getDefaultType\fP that lets applications and applets retrieve the value of the \f2keystore.type\fP property. The following line of code creates an instance of the default keystore type (as specified in the \f2keystore.type\fP property):
-.LP
-.nf
-\f3
-.fl
-    KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
-.fl
-\fP
-.fi
+If you also specified the \f3-strict\fR option, and the \f3jarsigner\fR command detected severe warnings, the message, "jar signed, with signer errors" is displayed\&.
+.TP     
+\fIalias\fR
+The aliases are defined in the keystore specified by \f3-keystore\fR or the default keystore\&.
+.SH DESCRIPTION    
+The \f3jarsigner\fR tool has two purposes:
+.TP 0.2i    
+\(bu
+To sign Java Archive (JAR) files\&.
+.TP 0.2i    
+\(bu
+To verify the signatures and integrity of signed JAR files\&.
+.PP
+The JAR feature enables the packaging of class files, images, sounds, and other digital data in a single file for faster and easier distribution\&. A tool named \f3jar\fR enables developers to produce JAR files\&. (Technically, any zip file can also be considered a JAR file, although when created by the \f3jar\fR command or processed by the \f3jarsigner\fR command, JAR files also contain a \f3META-INF/MANIFEST\&.MF\fR file\&.)
+.PP
+A digital signature is a string of bits that is computed from some data (the data being signed) and the private key of an entity (a person, company, and so on)\&. Similar to a handwritten signature, a digital signature has many useful characteristics:
+.TP 0.2i    
+\(bu
+Its authenticity can be verified by a computation that uses the public key corresponding to the private key used to generate the signature\&.
+.TP 0.2i    
+\(bu
+It cannot be forged, assuming the private key is kept secret\&.
+.TP 0.2i    
+\(bu
+It is a function of the data signed and thus cannot be claimed to be the signature for other data as well\&.
+.TP 0.2i    
+\(bu
+The signed data cannot be changed\&. If the data is changed, then the signature cannot be verified as authentic\&.
+.PP
+To generate an entity\&'s signature for a file, the entity must first have a public/private key pair associated with it and one or more certificates that authenticate its public key\&. A certificate is a digitally signed statement from one entity that says that the public key of another entity has a particular value\&.
+.PP
+The \f3jarsigner\fR command uses key and certificate information from a keystore to generate digital signatures for JAR files\&. A keystore is a database of private keys and their associated X\&.509 certificate chains that authenticate the corresponding public keys\&. The \f3keytool\fR command is used to create and administer keystores\&.
+.PP
+The \f3jarsigner\fR command uses an entity\&'s private key to generate a signature\&. The signed JAR file contains, among other things, a copy of the certificate from the keystore for the public key corresponding to the private key used to sign the file\&. The \f3jarsigner\fR command can verify the digital signature of the signed JAR file using the certificate inside it (in its signature block file)\&.
+.PP
+The \f3jarsigner\fR command can generate signatures that include a time stamp that lets a systems or deployer (including Java Plug-in) to check whether the JAR file was signed while the signing certificate was still valid\&. In addition, APIs allow applications to obtain the timestamp information\&.
+.PP
+At this time, the \f3jarsigner\fR command can only sign JAR files created by the \f3jar\fR command or zip files\&. JAR files are the same as zip files, except they also have a \f3META-INF/MANIFEST\&.MF\fR file\&. A \f3META-INF/MANIFEST\&.MF\fR file is created when the \f3jarsigner\fR command signs a zip file\&.
+.PP
+The default \f3jarsigner\fR command behavior is to sign a JAR or zip file\&. Use the \f3-verify\fR option to verify a signed JAR file\&.
+.PP
+The \f3jarsigner\fR command also attempts to validate the signer\&'s certificate after signing or verifying\&. If there is a validation error or any other problem, the command generates warning messages\&. If you specify the \f3-strict\fR option, then the command treats severe warnings as errors\&. See Errors and Warnings\&.
+.SS KEYSTORE\ ALIASES    
+All keystore entities are accessed with unique aliases\&.
+.PP
+When you use the \f3jarsigner\fR command to sign a JAR file, you must specify the alias for the keystore entry that contains the private key needed to generate the signature\&. For example, the following command signs the JAR file named \f3MyJARFile\&.jar\fR with the private key associated with the alias \f3duke\fR in the keystore named \f3mystore\fR in the \f3working\fR directory\&. Because no output file is specified, it overwrites \f3MyJARFile\&.jar\fR with the signed JAR file\&.
+.sp     
+.nf     
+\f3jarsigner \-keystore /working/mystore \-storepass <keystore password>\fP
+.fi     
+.nf     
+\f3      \-keypass <private key password> MyJARFile\&.jar duke\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+Keystores are protected with a password, so the store password must be specified\&. You are prompted for it when you do not specify it on the command line\&. Similarly, private keys are protected in a keystore with a password, so the private key\&'s password must be specified, and you are prompted for the password when you do not specify it on the command line and it is not the same as the store password\&.
+.SS KEYSTORE\ LOCATION    
+The \f3jarsigner\fR command has a \f3-keystore\fR option for specifying the URL of the keystore to be used\&. The keystore is by default stored in a file named \f3\&.keystore\fR in the user\&'s home directory, as determined by the \f3user\&.home\fR system property\&.
+.PP
+On Oracle Solaris systems, \f3user\&.home\fR defaults to the user\&'s home directory\&.
+.PP
+The input stream from the \f3-keystore\fR option is passed to the \f3KeyStore\&.load\fR method\&. If \f3NONE\fR is specified as the URL, then a null stream is passed to the \f3KeyStore\&.load\fR method\&. \f3NONE\fR should be specified when the \f3KeyStore\fR class is not file based, for example, when it resides on a hardware token device\&.
+.SS KEYSTORE\ IMPLEMENTATION    
+The \f3KeyStore\fR class provided in the \f3java\&.security\fR package supplies a number of well-defined interfaces to access and modify the information in a keystore\&. You can have multiple different concrete implementations, where each implementation is for a particular type of keystore\&.
+.PP
+Currently, there are two command-line tools that use keystore implementations (\f3keytool\fR and \f3jarsigner\fR), and a GUI-based tool named Policy Tool\&. Because the \f3KeyStore\fR class is publicly available, JDK users can write additional security applications that use it\&.
+.PP
+There is a built-in default implementation provided by Oracle that implements the keystore as a file, that uses a proprietary keystore type (format) named JKS\&. The built-in implementation protects each private key with its individual password and protects the integrity of the entire keystore with a (possibly different) password\&.
+.PP
+Keystore implementations are provider-based, which means the application interfaces supplied by the \f3KeyStore\fR class are implemented in terms of a Service Provider Interface (SPI)\&. There is a corresponding abstract \f3KeystoreSpi\fR class, also in the \f3java\&.security package\fR, that defines the Service Provider Interface methods that providers must implement\&. The term provider refers to a package or a set of packages that supply a concrete implementation of a subset of services that can be accessed by the Java Security API\&. To provide a keystore implementation, clients must implement a provider and supply a \f3KeystoreSpi\fR subclass implementation, as described in How to Implement a Provider in the Java Cryptography Architecture at http://docs\&.oracle\&.com/javase/7/docs/technotes/guides/security/crypto/HowToImplAProvider\&.html
+.PP
+Applications can choose different types of keystore implementations from different providers, with the \f3getInstance\fR factory method in the \f3KeyStore\fR class\&. A keystore type defines the storage and data format of the keystore information and the algorithms used to protect private keys in the keystore and the integrity of the keystore itself\&. Keystore implementations of different types are not compatible\&.
+.PP
+The \f3jarsigner\fR and \f3policytool\fR commands can read file-based keystores from any location that can be specified using a URL\&. In addition, these commands can read non-file-based keystores such as those provided by MSCAPI on Windows and PKCS11 on all platforms\&.
+.PP
+For the \f3jarsigner\fR and \f3keytool\fR commands, you can specify a keystore type at the command line with the \f3-storetype\fR option\&. For Policy Tool, you can specify a keystore type with the \fIEdit\fR command in the \fIKeyStore\fR menu\&.
+.PP
+If you do not explicitly specify a keystore type, then the tools choose a keystore implementation based on the value of the \f3keystore\&.type\fR property specified in the security properties file\&. The security properties file is called \f3java\&.security\fR, and it resides in the JDK security properties directory, \f3java\&.home/lib/security\fR, where \f3java\&.home\fR is the runtime environment\&'s directory\&. The \f3jre\fR directory in the JDK or the top-level directory of the Java Runtime Environment (JRE)\&.
+.PP
+Each tool gets the \f3keystore\&.type\fR value and then examines all the installed providers until it finds one that implements keystores of that type\&. It then uses the keystore implementation from that provider\&.
+.PP
+The \f3KeyStore\fR class defines a static method named \f3getDefaultType\fR that lets applications and applets retrieve the value of the \f3keystore\&.type\fR property\&. The following line of code creates an instance of the default keystore type as specified in the \f3keystore\&.type property\fR:
+.sp     
+.nf     
+\f3KeyStore keyStore = KeyStore\&.getInstance(KeyStore\&.getDefaultType());\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+The default keystore type is \f3jks\fR (the proprietary type of the keystore implementation provided by Oracle)\&. This is specified by the following line in the security properties file:
+.sp     
+.nf     
+\f3keystore\&.type=jks\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+Case does not matter in keystore type designations\&. For example, \f3JKS\fR is the same as \f3jks\fR\&.
+.PP
+To have the tools use a keystore implementation other than the default, change that line to specify a different keystore type\&. For example, if you have a provider package that supplies a keystore implementation for a keystore type called \f3pkcs12\fR, then change the line to the following:
+.sp     
+.nf     
+\f3keystore\&.type=pkcs12\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+\fINote:\fR If you use the PKCS 11 provider package, then see "KeyTool" and "JarSigner" in Java PKCS #11 Reference Guide at http://docs\&.oracle\&.com/javase/7/docs/technotes/guides/security/p11guide\&.html
+.SS SUPPORTED\ ALGORITHMS    
+By default, the \f3jarsigner\fR command signs a JAR file using one of the following algorithms:
+.TP 0.2i    
+\(bu
+Digital Signature Algorithm (DSA) with the SHA1 digest algorithm
+.TP 0.2i    
+\(bu
+RSA algorithm with the SHA256 digest algorithm
+.TP 0.2i    
+\(bu
+Elliptic Curve (EC) cryptography algorithm with the SHA256 with Elliptic Curve Digital Signature Algorithm (ECDSA)\&.
+.PP
+If the signer\&'s public and private keys are DSA keys, then \f3jarsigner\fR signs the JAR file with the \f3SHA1withDSA\fR algorithm\&. If the signer\&'s keys are RSA keys, then \f3jarsigner\fR attempts to sign the JAR file with the \f3SHA256withRSA\fR algorithm\&. If the signer\&'s keys are EC keys, then \f3jarsigner\fR signs the JAR file with the \f3SHA256withECDSA\fR algorithm\&.
+.PP
+These default signature algorithms can be overridden using the \f3-sigalg\fR option\&.
+.SS THE\ SIGNED\ JAR\ FILE    
+When the \f3jarsigner\fR command is used to sign a JAR file, the output signed JAR file is exactly the same as the input JAR file, except that it has two additional files placed in the META-INF directory:
+.TP 0.2i    
+\(bu
+A signature file with an \f3\&.SF\fR extension
+.TP 0.2i    
+\(bu
+A signature block file with a \f3\&.DSA\fR, \f3\&.RSA\fR, or \f3\&.EC\fR extension
+.PP
+The base file names for these two files come from the value of the \f3-sigFile\fR option\&. For example, when the option is \f3-sigFile MKSIGN\fR, the files are named \f3MKSIGN\&.SF\fR and \f3MKSIGN\&.DSA\fR
+.PP
+If no \f3-sigfile\fR option appears on the command line, then the base file name for the \f3\&.SF\fR and \f3\&.DSA\fR files is the first 8 characters of the alias name specified on the command line, all converted to uppercase\&. If the alias name has fewer than 8 characters, then the full alias name is used\&. If the alias name contains any characters that are not allowed in a signature file name, then each such character is converted to an underscore (_) character in forming the file name\&. Valid characters include letters, digits, underscores, and hyphens\&.
+.PP
+Signature File
 
-.LP
-.LP
-The default keystore type is "jks" (the proprietary type of the keystore implementation provided by Sun). This is specified by the following line in the security properties file:
-.LP
-.nf
-\f3
-.fl
-    keystore.type=jks
-.fl
-\fP
-.fi
+A signature file (\f3\&.SF\fR file) looks similar to the manifest file that is always included in a JAR file when the \f3jarsigner\fR command is used to sign the file\&. For each source file included in the JAR file, the \f3\&.SF\fR file has three lines, such as in the manifest file, that list the following:
+.TP 0.2i    
+\(bu
+File name
+.TP 0.2i    
+\(bu
+Name of the digest algorithm (SHA)
+.TP 0.2i    
+\(bu
+SHA digest value
+.PP
+In the manifest file, the SHA digest value for each source file is the digest (hash) of the binary data in the source file\&. In the \f3\&.SF\fR file, the digest value for a specified source file is the hash of the three lines in the manifest file for the source file\&.
+.PP
+The signature file, by default, includes a header with a hash of the whole manifest file\&. The header also contains a hash of the manifest header\&. The presence of the header enables verification optimization\&. See JAR File Verification\&.
+.PP
+Signature Block File
 
-.LP
-.LP
-Note: Case doesn't matter in keystore type designations. For example, "JKS" would be considered the same as "jks".
-.LP
-.LP
-To have the tools utilize a keystore implementation other than the default, change that line to specify a different keystore type. For example, if you have a provider package that supplies a keystore implementation for a keystore type called "pkcs12", change the line to
-.LP
-.nf
-\f3
-.fl
-    keystore.type=pkcs12
-.fl
-\fP
-.fi
+The \f3\&.SF\fR file is signed and the signature is placed in the signature block file\&. This file also contains, encoded inside it, the certificate or certificate chain from the keystore that authenticates the public key corresponding to the private key used for signing\&. The file has the extension \f3\&.DSA\fR, \f3\&.RSA\fR, or \f3\&.EC\fR, depending on the digest algorithm used\&.
+.SS SIGNATURE\ TIME\ STAMP    
+The \f3jarsigner\fR command can generate and store a signature time stamp when signing a JAR file\&. In addition, \f3jarsigner\fR supports alternative signing mechanisms\&. This behavior is optional and is controlled by the user at the time of signing through these options\&. See Options\&.
+.sp     
+.nf     
+\f3\-tsa \fIurl\fR\fP
+.fi     
+.nf     
+\f3\-tsacert \fIalias\fR\fP
+.fi     
+.nf     
+\f3\-altsigner \fIclass\fR\fP
+.fi     
+.nf     
+\f3\-altsignerpath \fIclasspathlist\fR\fP
+.fi     
+.nf     
+\f3\-tsapolicyid \fIpolicyid\fR\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+.SS JAR\ FILE\ VERIFICATION    
+A successful JAR file verification occurs when the signatures are valid, and none of the files that were in the JAR file when the signatures were generated have changed since then\&. JAR file verification involves the following steps:
+.TP 0.4i    
+1\&.
+Verify the signature of the \f3\&.SF\fR file\&.
 
-.LP
-.LP
-Note that if you us the PKCS#11 provider package, you should refer to the 
-.na
-\f2KeyTool and JarSigner\fP @
-.fi
-http://docs.oracle.com/javase/7/docs/technotes/guides/security/p11guide.html#KeyToolJarSigner section of the Java PKCS#11 Reference Guide for details.
-.LP
-.SS 
-Supported Algorithms
-.LP
-.LP
-By default, \f3jarsigner\fP signs a JAR file using one of the following:
-.LP
-.RS 3
-.TP 2
-o
-DSA (Digital Signature Algorithm) with the SHA1 digest algorithm 
-.TP 2
-o
-RSA algorithm with the SHA256 digest algorithm. 
-.TP 2
-o
-EC (Elliptic Curve) cryptography algorithm with the SHA256 with ECDSA (Elliptic Curve Digital Signature Algorithm). 
-.RE
+The verification ensures that the signature stored in each signature block (\f3\&.DSA\fR) file was generated using the private key corresponding to the public key whose certificate (or certificate chain) also appears in the \f3\&.DSA\fR file\&. It also ensures that the signature is a valid signature of the corresponding signature (\f3\&.SF\fR) file, and thus the \f3\&.SF\fR file was not tampered with\&.
+.TP 0.4i    
+2\&.
+Verify the digest listed in each entry in the \f3\&.SF\fR file with each corresponding section in the manifest\&.
 
-.LP
-.LP
-That is, if the signer's public and private keys are DSA keys, \f3jarsigner\fP will sign the JAR file using the "SHA1withDSA" algorithm. If the signer's keys are RSA keys, \f3jarsigner\fP will attempt to sign the JAR file using the "SHA256withRSA" algorithm. If the signer's keys are EC keys, \f3jarsigner\fP will sign the JAR file using the "SHA256withECDSA" algorithm.
-.LP
-.LP
-These default signature algorithms can be overridden using the \f2\-sigalg\fP option.
-.LP
-.SS 
-The Signed JAR File
-.LP
-.LP
-When \f3jarsigner\fP is used to sign a JAR file, the output signed JAR file is exactly the same as the input JAR file, except that it has two additional files placed in the META\-INF directory:
-.LP
-.RS 3
-.TP 2
-o
-a signature file, with a .SF extension, and 
-.TP 2
-o
-a signature block file, with a .DSA, .RSA, or .EC extension. 
-.RE
+The \f3\&.SF\fR file by default includes a header that contains a hash of the entire manifest file\&. When the header is present, the verification can check to see whether or not the hash in the header matches the hash of the manifest file\&. If there is a match, then verification proceeds to the next step\&.
 
-.LP
-.LP
-The base file names for these two files come from the value of the \f2\-sigFile\fP option. For example, if the option appears as
-.LP
-.nf
-\f3
-.fl
-\-sigFile MKSIGN
-.fl
-\fP
-.fi
+If there is no match, then a less optimized verification is required to ensure that the hash in each source file information section in the \f3\&.SF\fR file equals the hash of its corresponding section in the manifest file\&. See Signature File\&.
 
-.LP
-.LP
-The files are named "MKSIGN.SF" and "MKSIGN.DSA".
-.LP
-.LP
-If no \f2\-sigfile\fP option appears on the command line, the base file name for the .SF and .DSA files will be the first 8 characters of the alias name specified on the command line, all converted to upper case. If the alias name has fewer than 8 characters, the full alias name is used. If the alias name contains any characters that are not allowed in a signature file name, each such character is converted to an underscore ("_") character in forming the file name. Legal characters include letters, digits, underscores, and hyphens.
-.LP
-\f3The Signature (.SF) File\fP
-.LP
-.LP
-A signature file (the .SF file) looks similar to the manifest file that is always included in a JAR file when \f3jarsigner\fP is used to sign the file. That is, for each source file included in the JAR file, the .SF file has three lines, just as in the manifest file, listing the following:
-.LP
-.RS 3
-.TP 2
-o
-the file name, 
-.TP 2
-o
-the name of the digest algorithm used (SHA), and 
-.TP 2
-o
-a SHA digest value. 
-.RE
+One reason the hash of the manifest file that is stored in the \f3\&.SF\fR file header might not equal the hash of the current manifest file is that one or more files were added to the JAR file (with the \f3jar\fR tool) after the signature and \f3\&.SF\fR file were generated\&. When the \f3jar\fR tool is used to add files, the manifest file is changed by adding sections to it for the new files, but the \f3\&.SF\fR file is not changed\&. A verification is still considered successful when none of the files that were in the JAR file when the signature was generated have been changed since then\&. This happens when the hashes in the non-header sections of the \f3\&.SF\fR file equal the hashes of the corresponding sections in the manifest file\&.
+.TP 0.4i    
+3\&.
+Read each file in the JAR file that has an entry in the \f3\&.SF\fR file\&. While reading, compute the file\&'s digest and compare the result with the digest for this file in the manifest section\&. The digests should be the same or verification fails\&.
 
-.LP
-.LP
-In the manifest file, the SHA digest value for each source file is the digest (hash) of the binary data in the source file. In the .SF file, on the other hand, the digest value for a given source file is the hash of the three lines in the manifest file for the source file.
-.LP
-.LP
-The signature file also, by default, includes a header containing a hash of the whole manifest file. The presence of the header enables verification optimization, as described in JAR File Verification.
-.LP
-\f3The Signature Block File\fP
-.LP
-The .SF file is signed and the signature is placed in the signature block file. This file also contains, encoded inside it, the certificate or certificate chain from the keystore which authenticates the public key corresponding to the private key used for signing. The file has the extension .DSA, .RSA, or .EC depending on the digest algorithm used. 
-.SS 
-Signature Timestamp
-.LP
-.LP
-\f2jarsigner\fP tool can generate and store a signature timestamp when signing a JAR file. In addition, \f2jarsigner\fP supports alternative signing mechanisms. This behavior is optional and is controlled by the user at the time of signing through these options:
-.LP
-.RS 3
-.TP 2
-o
-\f2\-tsa url\fP 
-.TP 2
-o
-\f2\-tsacert alias\fP 
-.TP 2
-o
-\f2\-altsigner class\fP 
-.TP 2
-o
-\f2\-altsignerpath classpathlist\fP 
-.RE
+If any serious verification failures occur during the verification process, then the process is stopped and a security exception is thrown\&. The \f3jarsigner\fR command catches and displays the exception\&.
+.PP
+\fINote:\fR You should read any addition warnings (or errors if you specified the \f3-strict\fR option), as well as the content of the certificate (by specifying the \f3-verbose\fR and \f3-certs\fR options) to determine if the signature can be trusted\&.
+.SS MULTIPLE\ SIGNATURES\ FOR\ A\ JAR\ FILE    
+A JAR file can be signed by multiple people by running the \f3jarsigner\fR command on the file multiple times and specifying the alias for a different person each time, as follows:
+.sp     
+.nf     
+\f3jarsigner myBundle\&.jar susan\fP
+.fi     
+.nf     
+\f3jarsigner myBundle\&.jar kevin\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+When a JAR file is signed multiple times, there are multiple \f3\&.SF\fR and \f3\&.DSA\fR files in the resulting JAR file, one pair for each signature\&. In the previous example, the output JAR file includes files with the following names:
+.sp     
+.nf     
+\f3SUSAN\&.SF\fP
+.fi     
+.nf     
+\f3SUSAN\&.DSA\fP
+.fi     
+.nf     
+\f3KEVIN\&.SF\fP
+.fi     
+.nf     
+\f3KEVIN\&.DSA\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+\fINote:\fR It is also possible for a JAR file to have mixed signatures, some generated by the JDK 1\&.1 by the \f3javakey\fR command and others by \f3jarsigner\fR\&. The \f3jarsigner\fR command can be used to sign JAR files that are already signed with the \f3javakey\fR command\&.
+.SH OPTIONS    
+The following sections describe the various \f3jarsigner\fR options\&. Be aware of the following standards:
+.TP 0.2i    
+\(bu
+All option names are preceded by a minus sign (-)\&.
+.TP 0.2i    
+\(bu
+The options can be provided in any order\&.
+.TP 0.2i    
+\(bu
+Items that are in italics or underlined (option values) represent the actual values that must be supplied\&.
+.TP 0.2i    
+\(bu
+The \f3-storepass\fR, \f3-keypass\fR, \f3-sigfile\fR, \f3-sigalg\fR, \f3-digestalg\fR, \f3-signedjar\fR, and TSA-related options are only relevant when signing a JAR file; they are not relevant when verifying a signed JAR file\&. The \f3-keystore\fR option is relevant for signing and verifying a JAR file\&. In addition, aliases are specified when signing and verifying a JAR file\&.
+.TP
+-keystore \fIurl\fR
+.br
+Specifies the URL that tells the keystore location\&. This defaults to the file \f3\&.keystore\fR in the user\&'s home directory, as determined by the \f3user\&.home\fR system property\&.
 
-.LP
-.LP
-Each of these options is detailed in the Options section below.
-.LP
-.SS 
-JAR File Verification
-.LP
-.LP
-A successful JAR file verification occurs if the signature(s) are valid, and none of the files that were in the JAR file when the signatures were generated have been changed since then. JAR file verification involves the following steps:
-.LP
-.RS 3
-.TP 3
-1.
-Verify the signature of the .SF file itself.
+A keystore is required when signing\&. You must explicitly specify a keystore when the default keystore does not exist or if you want to use one other than the default\&.
+
+A keystore is not required when verifying, but if one is specified or the default exists and the \f3-verbose\fR option was also specified, then additional information is output regarding whether or not any of the certificates used to verify the JAR file are contained in that keystore\&.
+
+The \f3-keystore\fR argument can be a file name and path specification rather than a URL, in which case it is treated the same as a file: URL, for example, the following are equivalent:
+.sp     
+.nf     
+\f3\-keystore \fIfilePathAndName\fR\fP
+.fi     
+.nf     
+\f3\-keystore file:\fIfilePathAndName\fR\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+
+
+If the Sun PKCS #11 provider was configured in the \f3java\&.security\fR security properties file (located in the JRE\&'s \f3$JAVA_HOME/lib/security directory\fR), then the \f3keytool\fR and \f3jarsigner\fR tools can operate on the PKCS #11 token by specifying these options:
+.sp     
+.nf     
+\f3\-keystore NONE\fP
+.fi     
+.nf     
+\f3\-storetype PKCS11\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+
+
+For example, the following command lists the contents of the configured PKCS#11 token:
+.sp     
+.nf     
+\f3keytool \-keystore NONE \-storetype PKCS11 \-list\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+
+.TP
+-storetype \fIstoretype\fR
 .br
+Specifies the type of keystore to be instantiated\&. The default keystore type is the one that is specified as the value of the \f3keystore\&.type\fR property in the security properties file, which is returned by the static \f3getDefaultType\fR method in \f3java\&.security\&.KeyStore\fR\&.
+
+The PIN for a PCKS #11 token can also be specified with the \f3-storepass\fR option\&. If none is specified, then the \f3keytool\fR and \f3jarsigner\fR commands prompt for the token PIN\&. If the token has a protected authentication path (such as a dedicated PIN-pad or a biometric reader), then the \f3-protected\fR option must be specified and no password options can be specified\&.
+.TP
+-storepass[:env | :file] \fIargument\fR
 .br
-That is, the verification ensures that the signature stored in each signature block (.DSA) file was in fact generated using the private key corresponding to the public key whose certificate (or certificate chain) also appears in the .DSA file. It also ensures that the signature is a valid signature of the corresponding signature (.SF) file, and thus the .SF file has not been tampered with. 
-.TP 3
-2.
-Verify the digest listed in each entry in the .SF file with each corresponding section in the manifest.
+Specifies the password that is required to access the keystore\&. This is only needed when signing (not verifying) a JAR file\&. In that case, if a \f3-storepass\fR option is not provided at the command line, then the user is prompted for the password\&.
+
+If the modifier \f3env\fR or \f3file\fR is not specified, then the password has the value \fIargument\fR\&. Otherwise, the password is retrieved as follows:
+.RS     
+.TP 0.2i    
+\(bu
+\f3env\fR: Retrieve the password from the environment variable named \f3argument\fR\&.
+.TP 0.2i    
+\(bu
+\f3file\fR: Retrieve the password from the file named \f3argument\fR\&.
+.RE     
+
+
+\fINote:\fR The password should not be specified on the command line or in a script unless it is for testing purposes, or you are on a secure system\&.
+.TP
+-keypass [:env | :file] \fIargument\fR
 .br
+Specifies the password used to protect the private key of the keystore entry addressed by the alias specified on the command line\&. The password is required when using \f3jarsigner\fR to sign a JAR file\&. If no password is provided on the command line, and the required password is different from the store password, then the user is prompted for it\&.
+
+If the modifier \f3env\fR or \f3file\fR is not specified, then the password has the value \f3argument\fR\&. Otherwise, the password is retrieved as follows:
+.RS     
+.TP 0.2i    
+\(bu
+\f3env\fR: Retrieve the password from the environment variable named \f3argument\fR\&.
+.TP 0.2i    
+\(bu
+\f3file\fR: Retrieve the password from the file named \f3argument\fR\&.
+.RE     
+
+
+\fINote:\fR The password should not be specified on the command line or in a script unless it is for testing purposes, or you are on a secure system\&.
+.TP
+-sigfile \fIfile\fR
 .br
-The .SF file by default includes a header containing a hash of the entire manifest file. When the header is present, then the verification can check to see whether or not the hash in the header indeed matches the hash of the manifest file. If that is the case, verification proceeds to the next step.
+Specifies the base file name to be used for the generated \f3\&.SF\fR and \f3\&.DSA\fR files\&. For example, if file is \f3DUKESIGN\fR, then the generated \f3\&.SF\fR and \f3\&.DSA\fR files are named \f3DUKESIGN\&.SF\fR and \f3DUKESIGN\&.DSA\fR, and placed in the \f3META-INF\fR directory of the signed JAR file\&.
+
+The characters in the file must come from the set \f3a-zA-Z0-9_-\fR\&. Only letters, numbers, underscore, and hyphen characters are allowed\&. All lowercase characters are converted to uppercase for the \f3\&.SF\fR and \f3\&.DSA\fR file names\&.
+
+If no \f3-sigfile\fR option appears on the command line, then the base file name for the \f3\&.SF\fR and \f3\&.DSA\fR files is the first 8 characters of the alias name specified on the command line, all converted to upper case\&. If the alias name has fewer than 8 characters, then the full alias name is used\&. If the alias name contains any characters that are not valid in a signature file name, then each such character is converted to an underscore (_) character to form the file name\&.
+.TP
+-sigalg \fIalgorithm\fR
 .br
+Specifies the name of the signature algorithm to use to sign the JAR file\&.
+
+For a list of standard signature algorithm names, see "Appendix A: Standard Names" in the Java Cryptography Architecture (JCA) Reference Guide at http://docs\&.oracle\&.com/javase/7/docs/technotes/guides/security/crypto/CryptoSpec\&.html#AppA
+
+This algorithm must be compatible with the private key used to sign the JAR file\&. If this option is not specified, then \f3SHA1withDSA\fR, \f3SHA256withRSA\fR, or \f3SHA256withECDSA\fR are used depending on the type of private key\&. There must either be a statically installed provider supplying an implementation of the specified algorithm or the user must specify one with the \f3-providerClass\fR option; otherwise, the command will not succeed\&.
+.TP
+-digestalg \fIalgorithm\fR
 .br
-If that is not the case, a less optimized verification is required to ensure that the hash in each source file information section in the .SF file equals the hash of its corresponding section in the manifest file (see The Signature (.SF) File).
+Specifies the name of the message digest algorithm to use when digesting the entries of a JAR file\&.
+
+For a list of standard message digest algorithm names, see "Appendix A: Standard Names" in the Java Cryptography Architecture (JCA) Reference Guide at http://docs\&.oracle\&.com/javase/7/docs/technotes/guides/security/crypto/CryptoSpec\&.html#AppA
+
+If this option is not specified, then \f3SHA256\fR is used\&. There must either be a statically installed provider supplying an implementation of the specified algorithm or the user must specify one with the \f3-providerClass\fR option; otherwise, the command will not succeed\&.
+.TP
+-certs
 .br
+If the \f3-certs\fR option appears on the command line with the \f3-verify\fR and \f3-verbose\fR options, then the output includes certificate information for each signer of the JAR file\&. This information includes the name of the type of certificate (stored in the \f3\&.DSA\fR file) that certifies the signer\&'s public key, and if the certificate is an X\&.509 certificate (an instance of the \f3java\&.security\&.cert\&.X509Certificate\fR), then the distinguished name of the signer\&.
+
+The keystore is also examined\&. If no keystore value is specified on the command line, then the default keystore file (if any) is checked\&. If the public key certificate for a signer matches an entry in the keystore, then the alias name for the keystore entry for that signer is displayed in parentheses\&. If the signer comes from a JDK 1\&.1 identity database instead of from a keystore, then the alias name displays in brackets instead of parentheses\&.
+.TP
+-certchain \fIfile\fR
 .br
-One reason the hash of the manifest file that is stored in the .SF file header may not equal the hash of the current manifest file would be because one or more files were added to the JAR file (using the \f2jar\fP tool) after the signature (and thus the .SF file) was generated. When the \f2jar\fP tool is used to add files, the manifest file is changed (sections are added to it for the new files), but the .SF file is not. A verification is still considered successful if none of the files that were in the JAR file when the signature was generated have been changed since then, which is the case if the hashes in the non\-header sections of the .SF file equal the hashes of the corresponding sections in the manifest file. 
-.TP 3
-3.
-Read each file in the JAR file that has an entry in the .SF file. While reading, compute the file's digest, and then compare the result with the digest for this file in the manifest section. The digests should be the same, or verification fails. 
-.RE
+Specifies the certificate chain to be used when the certificate chain associated with the private key of the keystore entry that is addressed by the alias specified on the command line is not complete\&. This can happen when the keystore is located on a hardware token where there is not enough capacity to hold a complete certificate chain\&. The file can be a sequence of concatenated X\&.509 certificates, or a single PKCS#7 formatted data block, either in binary encoding format or in printable encoding format (also known as Base64 encoding) as defined by the Internet RFC 1421 standard\&. See the section Internet RFC 1421 Certificate Encoding Standard in \f3keytool\fR and http://tools\&.ietf\&.org/html/rfc1421\&.
+.TP
+-verbose
+.br
+When the \f3-verbose\fR option appears on the command line, it indicates verbose mode, which causes \f3jarsigner\fR to output extra information about the progress of the JAR signing or verification\&.
+.TP
+-internalsf
+.br
+In the past, the \f3\&.DSA\fR (signature block) file generated when a JAR file was signed included a complete encoded copy of the \f3\&.SF\fR file (signature file) also generated\&. This behavior has been changed\&. To reduce the overall size of the output JAR file, the \f3\&.DSA\fR file by default does not contain a copy of the \f3\&.SF\fR file anymore\&. If \f3-internalsf\fR appears on the command line, then the old behavior is utilized\&. This option is useful for testing\&. In practice, do not use the \f3-internalsf\fR option because it incurs higher overhead\&.
+.TP
+-sectionsonly
+.br
+If the \f3-sectionsonly\fR option appears on the command line, then the \f3\&.SF\fR file (signature file) generated when a JAR file is signed does not include a header that contains a hash of the whole manifest file\&. It contains only the information and hashes related to each individual source file included in the JAR file\&. See Signature File\&.
 
-.LP
-.LP
-If any serious verification failures occur during the verification process, the process is stopped and a security exception is thrown. It is caught and displayed by \f3jarsigner\fP.
-.LP
-.SS 
-Multiple Signatures for a JAR File
-.LP
-.LP
-A JAR file can be signed by multiple people simply by running the \f3jarsigner\fP tool on the file multiple times, specifying the alias for a different person each time, as in:
-.LP
-.nf
-\f3
-.fl
-  jarsigner myBundle.jar susan
-.fl
-  jarsigner myBundle.jar kevin
-.fl
-\fP
-.fi
+By default, this header is added, as an optimization\&. When the header is present, whenever the JAR file is verified, the verification can first check to see whether the hash in the header matches the hash of the whole manifest file\&. When there is a match, verification proceeds to the next step\&. When there is no match, it is necessary to do a less optimized verification that the hash in each source file information section in the \f3\&.SF\fR file equals the hash of its corresponding section in the manifest file\&. See JAR File Verification\&.
 
-.LP
-.LP
-When a JAR file is signed multiple times, there are multiple .SF and .DSA files in the resulting JAR file, one pair for each signature. Thus, in the example above, the output JAR file includes files with the following names:
-.LP
-.nf
-\f3
-.fl
-  SUSAN.SF
-.fl
-  SUSAN.DSA
-.fl
-  KEVIN.SF
-.fl
-  KEVIN.DSA
-.fl
-\fP
-.fi
+The \f3-sectionsonly\fR option is primarily used for testing\&. It should not be used other than for testing because using it incurs higher overhead\&.
+.TP
+-protected
+.br
+Values can be either \f3true\fR or \f3false\fR\&. Specify \f3true\fR when a password must be specified through a protected authentication path such as a dedicated PIN reader\&.
+.TP
+-providerClass \fIprovider-class-name\fR
+.br
+Used to specify the name of cryptographic service provider\&'s master class file when the service provider is not listed in the \f3java\&.security\fR security properties file\&.
 
-.LP
-.LP
-Note: It is also possible for a JAR file to have mixed signatures, some generated by the JDK 1.1 \f3javakey\fP tool and others by \f3jarsigner\fP. That is, \f3jarsigner\fP can be used to sign JAR files already previously signed using \f3javakey\fP.
-.LP
-.SH "OPTIONS"
-.LP
-.LP
-The various \f3jarsigner\fP options are listed and described below. Note:
-.LP
-.RS 3
-.TP 2
-o
-All option names are preceded by a minus sign (\-). 
-.TP 2
-o
-The options may be provided in any order. 
-.TP 2
-o
-Items in italics (option values) represent the actual values that must be supplied. 
-.TP 2
-o
-The \f2\-keystore\fP, \f2\-storepass\fP, \f2\-keypass\fP, \f2\-sigfile\fP, \f2\-sigalg\fP, \f2\-digestalg\fP, and \f2\-signedjar\fP options are only relevant when signing a JAR file, not when verifying a signed JAR file. Similarly, an alias is only specified on the command line when signing a JAR file. 
-.RE
+Used with the \f3-providerArg ConfigFilePath\fR option, the \f3keytool\fR and \f3jarsigner\fR tools install the provider dynamically and use \fIConfigFilePath\fR for the path to the token configuration file\&. The following example shows a command to list a \f3PKCS #11\fR keystore when the Oracle PKCS #11 provider was not configured in the security properties file\&.
+.sp     
+.nf     
+\f3jarsigner \-keystore NONE \-storetype PKCS11 \e\fP
+.fi     
+.nf     
+\f3          \-providerClass sun\&.security\&.pkcs11\&.SunPKCS11 \e\fP
+.fi     
+.nf     
+\f3          \-providerArg /mydir1/mydir2/token\&.config \e\fP
+.fi     
+.nf     
+\f3          \-list\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
 
-.LP
-.RS 3
-.TP 3
-\-keystore url 
-Specifies the URL that tells the keystore location. This defaults to the file \f2.keystore\fP in the user's home directory, as determined by the "user.home" system property.
+.TP
+-providerName \fIproviderName\fR
 .br
+If more than one provider was configured in the \f3java\&.security\fR security properties file, then you can use the \f3-providerName\fR option to target a specific provider instance\&. The argument to this option is the name of the provider\&.
+
+For the Oracle PKCS #11 provider, \fIproviderName\fR is of the form \f3SunPKCS11-\fR\fITokenName\fR, where \fITokenName\fR is the name suffix that the provider instance has been configured with, as detailed in the configuration attributes table\&. For example, the following command lists the contents of the \f3PKCS #11\fR keystore provider instance with name suffix \f3SmartCard\fR:
+.sp     
+.nf     
+\f3jarsigner \-keystore NONE \-storetype PKCS11 \e\fP
+.fi     
+.nf     
+\f3        \-providerName SunPKCS11\-SmartCard \e\fP
+.fi     
+.nf     
+\f3        \-list\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+
+.TP
+-J\fIjavaoption\fR
 .br
-A keystore is required when signing, so you must explicitly specify one if the default keystore does not exist (or you want to use one other than the default).
+Passes through the specified \fIjavaoption\fR string directly to the Java interpreter\&. The \f3jarsigner\fR command is a wrapper around the interpreter\&. This option should not contain any spaces\&. It is useful for adjusting the execution environment or memory usage\&. For a list of possible interpreter options, type \f3java -h\fR or \f3java -X\fR at the command line\&.
+.TP
+-tsa \fIurl\fR
 .br
+If \f3-tsa http://example\&.tsa\&.url\fR appears on the command line when signing a JAR file then a time stamp is generated for the signature\&. The URL, \f3http://example\&.tsa\&.url\fR, identifies the location of the Time Stamping Authority (TSA) and overrides any URL found with the \f3-tsacert\fR option\&. The \f3-tsa\fR option does not require the TSA public key certificate to be present in the keystore\&.
+
+To generate the time stamp, \f3jarsigner\fR communicates with the TSA with the Time-Stamp Protocol (TSP) defined in RFC 3161\&. When successful, the time stamp token returned by the TSA is stored with the signature in the signature block file\&.
+.TP
+-tsacert \fIalias\fR
 .br
-A keystore is \f2not\fP required when verifying, but if one is specified, or the default exists, and the \f2\-verbose\fP option was also specified, additional information is output regarding whether or not any of the certificates used to verify the JAR file are contained in that keystore.
+When \f3-tsacert alias\fR appears on the command line when signing a JAR file, a time stamp is generated for the signature\&. The alias identifies the TSA public key certificate in the keystore that is in effect\&. The entry\&'s certificate is examined for a Subject Information Access extension that contains a URL identifying the location of the TSA\&.
+
+The TSA public key certificate must be present in the keystore when using the \f3-tsacert\fR option\&.
+.TP
+-tsapolicyid \fIpolicyid\fR
 .br
+Specifies the object identifier (OID) that identifies the policy ID to be sent to the TSA server\&. If this option is not specified, no policy ID is sent and the TSA server will choose a default policy ID\&.
+
+Object identifiers are defined by X\&.696, which is an ITU Telecommunication Standardization Sector (ITU-T) standard\&. These identifiers are typically period-separated sets of non-negative digits like \f31\&.2\&.3\&.4\fR, for example\&.
+.TP
+-altsigner \fIclass\fR
 .br
-Note: the \f2\-keystore\fP argument can actually be a file name (and path) specification rather than a URL, in which case it will be treated the same as a "file:" URL. That is, 
-.nf
-\f3
-.fl
-  \-keystore \fP\f4filePathAndName\fP\f3
-.fl
-\fP
-.fi
-is treated as equivalent to 
-.nf
-\f3
-.fl
-  \-keystore file:\fP\f4filePathAndName\fP\f3
-.fl
-\fP
-.fi
-If the Sun PKCS#11 provider has been configured in the \f2java.security\fP security properties file (located in the JRE's \f2$JAVA_HOME/lib/security\fP directory), then keytool and jarsigner can operate on the PKCS#11 token by specifying these options: 
-.RS 3
-.TP 2
-o
-\f2\-keystore NONE\fP 
-.TP 2
-o
-\f2\-storetype PKCS11\fP 
-.RE
-For example, this command lists the contents of the configured PKCS#11 token: 
-.nf
-\f3
-.fl
-   jarsigner \-keystore NONE \-storetype PKCS11 \-list
-.fl
-\fP
-.fi
-.TP 3
-\-storetype storetype 
-Specifies the type of keystore to be instantiated. The default keystore type is the one that is specified as the value of the "keystore.type" property in the security properties file, which is returned by the static \f2getDefaultType\fP method in \f2java.security.KeyStore\fP.
+This option specifies an alternative signing mechanism\&. The fully qualified class name identifies a class file that extends the \f3com\&.sun\&.jarsigner\&.ContentSigner\fR abstract class\&. The path to this class file is defined by the \f3-altsignerpath\fR option\&. If the \f3-altsigner\fR option is used, then the \f3jarsigner\fR command uses the signing mechanism provided by the specified class\&. Otherwise, the \f3jarsigner\fR command uses its default signing mechanism\&.
+
+For example, to use the signing mechanism provided by a class named \f3com\&.sun\&.sun\&.jarsigner\&.AuthSigner\fR, use the jarsigner option \f3-altsigner com\&.sun\&.jarsigner\&.AuthSigner\fR\&.
+.TP
+-altsignerpath \fIclasspathlist\fR
 .br
+Specifies the path to the class file and any JAR file it depends on\&. The class file name is specified with the \f3-altsigner\fR option\&. If the class file is in a JAR file, then this option specifies the path to that JAR file\&.
+
+An absolute path or a path relative to the current directory can be specified\&. If \fIclasspathlist\fR contains multiple paths or JAR files, then they should be separated with a colon (:) on Oracle Solaris and a semicolon (;) on Windows\&. This option is not necessary when the class is already in the search path\&.
+
+The following example shows how to specify the path to a JAR file that contains the class file\&. The JAR file name is included\&.
+.sp     
+.nf     
+\f3\-altsignerpath /home/user/lib/authsigner\&.jar\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+
+
+The following example shows how to specify the path to the JAR file that contains the class file\&. The JAR file name is omitted\&.
+.sp     
+.nf     
+\f3\-altsignerpath /home/user/classes/com/sun/tools/jarsigner/\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+
+.TP
+-strict
 .br
-The PIN for a PCKS#11 token can also be specified using the \f2\-storepass\fP option. If none has been specified, keytool and jarsigner will prompt for the token PIN. If the token has a protected authentication path (such as a dedicated PIN\-pad or a biometric reader), then the \f2\-protected\fP option must be specified and no password options can be specified. 
-.TP 3
-\-storepass[:env | :file] argument 
-Specifies the password which is required to access the keystore. This is only needed when signing (not verifying) a JAR file. In that case, if a \f2\-storepass\fP option is not provided at the command line, the user is prompted for the password.
+During the signing or verifying process, the command may issue warning messages\&. If you specify this option, the exit code of the tool reflects the severe warning messages that this command found\&. See Errors and Warnings\&.
+.TP
+-verbose \fIsuboptions\fR
 .br
-.br
-If the modifier \f2env\fP or \f2file\fP is not specified, then the password has the value \f2argument\fP. Otherwise, the password is retrieved as follows: 
-.RS 3
-.TP 2
-o
-\f2env\fP: Retrieve the password from the environment variable named \f2argument\fP 
-.TP 2
-o
-\f2file\fP: Retrieve the password from the file named \f2argument\fP 
-.RE
-Note: The password shouldn't be specified on the command line or in a script unless it is for testing purposes, or you are on a secure system. 
-.TP 3
-\-keypass[:env | :file] argument 
-Specifies the password used to protect the private key of the keystore entry addressed by the alias specified on the command line. The password is required when using \f3jarsigner\fP to sign a JAR file. If no password is provided on the command line, and the required password is different from the store password, the user is prompted for it.
-.br
-.br
-If the modifier \f2env\fP or \f2file\fP is not specified, then the password has the value \f2argument\fP. Otherwise, the password is retrieved as follows: 
-.RS 3
-.TP 2
-o
-\f2env\fP: Retrieve the password from the environment variable named \f2argument\fP 
-.TP 2
-o
-\f2file\fP: Retrieve the password from the file named \f2argument\fP 
-.RE
-Note: The password shouldn't be specified on the command line or in a script unless it is for testing purposes, or you are on a secure system. 
-.TP 3
-\-sigfile file 
-Specifies the base file name to be used for the generated .SF and .DSA files. For example, if \f2file\fP is "DUKESIGN", the generated .SF and .DSA files will be named "DUKESIGN.SF" and "DUKESIGN.DSA", and will be placed in the "META\-INF" directory of the signed JAR file.
-.br
-.br
-The characters in \f2file\fP must come from the set "a\-zA\-Z0\-9_\-". That is, only letters, numbers, underscore, and hyphen characters are allowed. Note: All lowercase characters will be converted to uppercase for the .SF and .DSA file names.
-.br
-.br
-If no \f2\-sigfile\fP option appears on the command line, the base file name for the .SF and .DSA files will be the first 8 characters of the alias name specified on the command line, all converted to upper case. If the alias name has fewer than 8 characters, the full alias name is used. If the alias name contains any characters that are not legal in a signature file name, each such character is converted to an underscore ("_") character in forming the file name. 
-.TP 3
-\-sigalg algorithm 
-Specifies the name of the signature algorithm to use to sign the JAR file.
-.br
-.br
-See 
-.na
-\f2Appendix A\fP @
-.fi
-http://docs.oracle.com/javase/7/docs/technotes/guides/security/crypto/CryptoSpec.html#AppA of the Java Cryptography Architecture for a list of standard signature algorithm names. This algorithm must be compatible with the private key used to sign the JAR file. If this option is not specified, SHA1withDSA, SHA256withRSA, or SHA256withECDSA will be used depending on the type of private key. There must either be a statically installed provider supplying an implementation of the specified algorithm or the user must specify one with the \f2\-providerClass\fP option, otherwise the command will not succeed. 
-.TP 3
-\-digestalg algorithm 
-Specifies the name of the message digest algorithm to use when digesting the entries of a jar file.
-.br
-.br
-See 
-.na
-\f2Appendix A\fP @
-.fi
-http://docs.oracle.com/javase/7/docs/technotes/guides/security/crypto/CryptoSpec.html#AppA of the Java Cryptography Architecture for a list of standard message digest algorithm names. If this option is not specified, SHA256 will be used. There must either be a statically installed provider supplying an implementation of the specified algorithm or the user must specify one with the \f2\-providerClass\fP option, otherwise the command will not succeed. 
-.TP 3
-\-signedjar file 
-Specifies the name to be used for the signed JAR file.
-.br
-.br
-If no name is specified on the command line, the name used is the same as the input JAR file name (the name of the JAR file to be signed); in other words, that file is overwritten with the signed JAR file. 
-.TP 3
-\-verify 
-If this appears on the command line, the specified JAR file will be verified, not signed. If the verification is successful, "jar verified" will be displayed. If you try to verify an unsigned JAR file, or a JAR file signed with an unsupported algorithm (e.g., RSA when you don't have an RSA provider installed), the following is displayed: "jar is unsigned. (signatures missing or not parsable)"
-.br
-.br
-It is possible to verify JAR files signed using either \f3jarsigner\fP or the JDK 1.1 \f3javakey\fP tool, or both.
-.br
-.br
-For further information on verification, see JAR File Verification. 
-.TP 3
-\-certs 
-If this appears on the command line, along with the \f2\-verify\fP and \f2\-verbose\fP options, the output includes certificate information for each signer of the JAR file. This information includes 
-.RS 3
-.TP 2
-o
-the name of the type of certificate (stored in the .DSA file) that certifies the signer's public key 
-.TP 2
-o
-if the certificate is an X.509 certificate (more specifically, an instance of \f2java.security.cert.X509Certificate\fP): the distinguished name of the signer 
-.RE
-The keystore is also examined. If no keystore value is specified on the command line, the default keystore file (if any) will be checked. If the public key certificate for a signer matches an entry in the keystore, then the following information will also be displayed: 
-.RS 3
-.TP 2
-o
-in parentheses, the alias name for the keystore entry for that signer. If the signer actually comes from a JDK 1.1 identity database instead of from a keystore, the alias name will appear in brackets instead of parentheses. 
-.RE
-.TP 3
-\-certchain file 
-Specifies the certificate chain to be used, if the certificate chain associated with the private key of the keystore entry, addressed by the alias specified on the command line, is not complete. This may happen if the keystore is located on a hardware token where there is not enough capacity to hold a complete certificate chain. The file can be a sequence of X.509 certificates concatenated together, or a single PKCS#7 formatted data block, either in binary encoding format or in printable encoding format (also known as BASE64 encoding) as defined by the Internet RFC 1421 standard. 
-.TP 3
-\-verbose 
-If this appears on the command line, it indicates "verbose" mode, which causes \f3jarsigner\fP to output extra information as to the progress of the JAR signing or verification. 
-.TP 3
-\-internalsf 
-In the past, the .DSA (signature block) file generated when a JAR file was signed used to include a complete encoded copy of the .SF file (signature file) also generated. This behavior has been changed. To reduce the overall size of the output JAR file, the .DSA file by default doesn't contain a copy of the .SF file anymore. But if \f2\-internalsf\fP appears on the command line, the old behavior is utilized. \f3This option is mainly useful for testing; in practice, it should not be used, since doing so eliminates a useful optimization.\fP 
-.TP 3
-\-sectionsonly 
-If this appears on the command line, the .SF file (signature file) generated when a JAR file is signed does \f2not\fP include a header containing a hash of the whole manifest file. It just contains information and hashes related to each individual source file included in the JAR file, as described in The Signature (.SF) File .
-.br
-.br
-By default, this header is added, as an optimization. When the header is present, then whenever the JAR file is verified, the verification can first check to see whether or not the hash in the header indeed matches the hash of the whole manifest file. If so, verification proceeds to the next step. If not, it is necessary to do a less optimized verification that the hash in each source file information section in the .SF file equals the hash of its corresponding section in the manifest file.
-.br
-.br
-For further information, see JAR File Verification.
-.br
-.br
-\f3This option is mainly useful for testing; in practice, it should not be used, since doing so eliminates a useful optimization.\fP 
-.TP 3
-\-protected 
-Either \f2true\fP or \f2false\fP. This value should be specified as \f2true\fP if a password must be given via a protected authentication path such as a dedicated PIN reader. 
-.TP 3
-\-providerClass provider\-class\-name 
-Used to specify the name of cryptographic service provider's master class file when the service provider is not listed in the security properties file, \f2java.security\fP.
-.br
-.br
-Used in conjunction with the \f2\-providerArg\fP \f2ConfigFilePath\fP option, keytool and jarsigner will install the provider dynamically (where \f2ConfigFilePath\fP is the path to the token configuration file). Here's an example of a command to list a PKCS#11 keystore when the Sun PKCS#11 provider has not been configured in the security properties file. 
-.nf
-\f3
-.fl
-jarsigner \-keystore NONE \-storetype PKCS11 \\ 
-.fl
-          \-providerClass sun.security.pkcs11.SunPKCS11 \\ 
-.fl
-          \-providerArg /foo/bar/token.config \\ 
-.fl
-          \-list
-.fl
-\fP
-.fi
-.TP 3
-\-providerName providerName 
-If more than one provider has been configured in the \f2java.security\fP security properties file, you can use the \f2\-providerName\fP option to target a specific provider instance. The argument to this option is the name of the provider.
-.br
-.br
-For the Sun PKCS#11 provider, \f2providerName\fP is of the form \f2SunPKCS11\-\fP\f2TokenName\fP, where \f2TokenName\fP is the name suffix that the provider instance has been configured with, as detailed in the 
-.na
-\f2configuration attributes table\fP @
-.fi
-http://docs.oracle.com/javase/7/docs/technotes/guides/security/p11guide.html#ATTRS. For example, the following command lists the contents of the PKCS#11 keystore provider instance with name suffix \f2SmartCard\fP: 
-.nf
-\f3
-.fl
-jarsigner \-keystore NONE \-storetype PKCS11 \\ 
-.fl
-        \-providerName SunPKCS11\-SmartCard \\ 
-.fl
-        \-list
-.fl
-\fP
-.fi
-.TP 3
-\-Jjavaoption 
-Passes through the specified \f2javaoption\fP string directly to the Java interpreter. (\f3jarsigner\fP is actually a "wrapper" around the interpreter.) This option should not contain any spaces. It is useful for adjusting the execution environment or memory usage. For a list of possible interpreter options, type \f2java \-h\fP or \f2java \-X\fP at the command line.  
-.TP 3
-\-tsa url 
-If \f2"\-tsa http://example.tsa.url"\fP appears on the command line when signing a JAR file then a timestamp is generated for the signature. The URL, \f2http://example.tsa.url\fP, identifies the location of the Time Stamping Authority (TSA). It overrides any URL found via the \f2\-tsacert\fP option. The \f2\-tsa\fP option does not require the TSA's public key certificate to be present in the keystore.
-.br
-.br
-To generate the timestamp, \f2jarsigner\fP communicates with the TSA using the Time\-Stamp Protocol (TSP) defined in 
-.na
-\f2RFC 3161\fP @
-.fi
-http://www.ietf.org/rfc/rfc3161.txt. If successful, the timestamp token returned by the TSA is stored along with the signature in the signature block file.  
-.TP 3
-\-tsacert alias 
-If \f2"\-tsacert alias"\fP appears on the command line when signing a JAR file then a timestamp is generated for the signature. The \f2alias\fP identifies the TSA's public key certificate in the keystore that is currently in effect. The entry's certificate is examined for a Subject Information Access extension that contains a URL identifying the location of the TSA.
-.br
-.br
-The TSA's public key certificate must be present in the keystore when using \f2\-tsacert\fP.  
-.TP 3
-\-altsigner class 
-Specifies that an alternative signing mechanism be used. The fully\-qualified class name identifies a class file that extends the \f2com.sun.jarsigner.ContentSigner abstract class\fP. The path to this class file is defined by the \f2\-altsignerpath\fP option. If the \f2\-altsigner\fP option is used, \f2jarsigner\fP uses the signing mechanism provided by the specified class. Otherwise, \f2jarsigner\fP uses its default signing mechanism.
-.br
-.br
-For example, to use the signing mechanism provided by a class named \f2com.sun.sun.jarsigner.AuthSigner\fP, use the \f2jarsigner\fP option \f2"\-altsigner com.sun.jarsigner.AuthSigner"\fP  
-.TP 3
-\-altsignerpath classpathlist 
-Specifies the path to the class file (the class file name is specified with the \f2\-altsigner\fP option described above) and any JAR files it depends on. If the class file is in a JAR file, then this specifies the path to that JAR file, as shown in the example below.
-.br
-.br
-An absolute path or a path relative to the current directory may be specified. If \f2classpathlist\fP contains multiple paths or JAR files, they should be separated with a colon (\f2:\fP) on Solaris and a semi\-colon (\f2;\fP) on Windows. This option is not necessary if the class is already in the search path.
-.br
-.br
-Example of specifying the path to a jar file that contains the class file: 
-.nf
-\f3
-.fl
-\-altsignerpath /home/user/lib/authsigner.jar
-.fl
-\fP
-.fi
-Note that the JAR file name is included.
-.br
-.br
-Example of specifying the path to the jar file that contains the class file: 
-.nf
-\f3
-.fl
-\-altsignerpath /home/user/classes/com/sun/tools/jarsigner/
-.fl
-\fP
-.fi
-Note that the JAR file name is omitted. 
-.TP 3
-\-strict 
-During the signing or verifying process, some warning messages may be shown. If this option appears on the command line, the exit code of the tool will reflect the warning messages that are found. Read the "WARNINGS" section for details. 
-.TP 3
-\-verbose:sub\-options 
-For the verifying process, the \f2\-verbose\fP option takes sub\-options to determine how much information will be shown. If \f2\-certs\fP is also specified, the default mode (or sub\-option all) displays each entry as it is being processed and following that, the certificate information for each signer of the JAR file. If \f2\-certs\fP and the \f2\-verbose:grouped\fP sub\-option are specified, entries with the same signer info are grouped and displayed together along with their certificate information. If \f2\-certs\fP and the \f2\-verbose:summary\fP sub\-option are specified, then entries with the same signer info are grouped and displayed together along with their certificate information but details about each entry are summarized and displayed as "one entry (and more)". See the examples section for more information. 
-.RE
+For the verifying process, the \f3-verbose\fR option takes suboptions to determine how much information is shown\&. If the \f3-certs\fR option is also specified, then the default mode (or suboption \f3all\fR) displays each entry as it is being processed, and after that, the certificate information for each signer of the JAR file\&. If the \f3-certs\fR and the \f3-verbose:grouped\fR suboptions are specified, then entries with the same signer info are grouped and displayed together with their certificate information\&. If \f3-certs\fR and the \f3-verbose:summary\fR suboptions are specified, then entries with the same signer information are grouped and displayed together with their certificate information\&. Details about each entry are summarized and displayed as \fIone entry (and more)\fR\&. See Examples\&.
+.SH ERRORS\ AND\ WARNINGS    
+During the signing or verifying process, the \f3jarsigner\fR command may issue various errors or warnings\&.
+.PP
+If there is a failure, the \f3jarsigner\fR command exits with code 1\&. If there is no failure, but there are one or more severe warnings, the \f3jarsigner\fR command exits with code 0 when the \f3-strict\fR option is \fInot\fR specified, or exits with the OR-value of the warning codes when the \f3-strict\fR is specified\&. If there is only informational warnings or no warning at all, the command always exits with code 0\&.
+.PP
+For example, if a certificate used to sign an entry is expired and has a KeyUsage extension that does not allow it to sign a file, the \f3jarsigner\fR command exits with code 12 (=4+8) when the \f3-strict\fR option is specified\&.
+.PP
+\fINote:\fR Exit codes are reused because only the values from 0 to 255 are legal on Unix-based operating systems\&.
+.PP
+The following sections describes the names, codes, and descriptions of the errors and warnings that the \f3jarsigner\fR command can issue\&.
+.SS FAILURE    
+Reasons why the \f3jarsigner\fR command fails include (but are not limited to) a command line parsing error, the inability to find a keypair to sign the JAR file, or the verification of a signed JAR fails\&.
+.TP     
+failure
+Code 1\&. The signing or verifying fails\&.
+.SS SEVERE\ WARNINGS    
+\fINote:\fR Severe warnings are reported as errors if you specify the \f3-strict\fR option\&.
+.PP
+Reasons why the \f3jarsigner\fR command issues a severe warning include the certificate used to sign the JAR file has an error or the signed JAR file has other problems\&.
+.TP     
+hasExpiredCert
+Code 4\&. This jar contains entries whose signer certificate has expired\&.
+.TP     
+notYetValidCert
+Code 4\&. This jar contains entries whose signer certificate is not yet valid\&.
+.TP     
+chainNotValidated
+Code 4\&. This jar contains entries whose certificate chain cannot be correctly validated\&.
+.TP     
+badKeyUsage
+Code 8\&. This jar contains entries whose signer certificate\&'s KeyUsage extension doesn\&'t allow code signing\&.
+.TP     
+badExtendedKeyUsage
+Code 8\&. This jar contains entries whose signer certificate\&'s ExtendedKeyUsage extension doesn\&'t allow code signing\&.
+.TP     
+badNetscapeCertType
+Code 8\&. This jar contains entries whose signer certificate\&'s NetscapeCertType extension doesn\&'t allow code signing\&.
+.TP     
+hasUnsignedEntry
+Code 16\&. This jar contains unsigned entries which have not been integrity-checked\&.
+.TP     
+notSignedByAlias
+Code 32\&. This jar contains signed entries which are not signed by the specified alias(es)\&.
+.TP     
+aliasNotInStore
+Code 32\&. This jar contains signed entries that are not signed by alias in this keystore\&.
+.SS INFORMATIONAL\ WARNINGS    
+Informational warnings include those that are not errors but regarded as bad practice\&. They do not have a code\&.
+.TP     
+hasExpiringCert
+This jar contains entries whose signer certificate will expire within six months\&.
+.TP     
+noTimestamp
+This jar contains signatures that does not include a timestamp\&. Without a timestamp, users may not be able to validate this JAR file after the signer certificate\&'s expiration date (\f3YYYY-MM-DD\fR) or after any future revocation date\&.
+.SH EXAMPLES    
+.SS SIGN\ A\ JAR\ FILE    
+Use the following command to sign bundle\&.jar with the private key of a user whose keystore alias is \f3jane\fR in a keystore named \f3mystore\fR in the \f3working\fR directory and name the signed JAR file \f3sbundle\&.jar\fR:
+.sp     
+.nf     
+\f3jarsigner \-keystore /working/mystore\fP
+.fi     
+.nf     
+\f3    \-storepass <keystore password>\fP
+.fi     
+.nf     
+\f3    \-keypass <private key password>\fP
+.fi     
+.nf     
+\f3    \-signedjar sbundle\&.jar bundle\&.jar jane\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+There is no \f3-sigfile\fR specified in the previous command so the generated \f3\&.SF\fR and \f3\&.DSA\fR files to be placed in the signed JAR file have default names based on the alias name\&. They are named \f3JANE\&.SF\fR and \f3JANE\&.DSA\fR\&.
+.PP
+If you want to be prompted for the store password and the private key password, then you could shorten the previous command to the following:
+.sp     
+.nf     
+\f3jarsigner \-keystore /working/mystore\fP
+.fi     
+.nf     
+\f3    \-signedjar sbundle\&.jar bundle\&.jar jane\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+If the keystore is the default keystore (\&.keystore in your home directory), then you do not need to specify a keystore, as follows:
+.sp     
+.nf     
+\f3jarsigner \-signedjar sbundle\&.jar bundle\&.jar jane\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+If you want the signed JAR file to overwrite the input JAR file (bundle\&.jar), then you do not need to specify a \f3-signedjar\fR option, as follows:
+.sp     
+.nf     
+\f3jarsigner bundle\&.jar jane\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+.SS VERIFY\ A\ SIGNED\ JAR\ FILE    
+To verify a signed JAR file to ensure that the signature is valid and the JAR file was not been tampered with, use a command such as the following:
+.sp     
+.nf     
+\f3jarsigner \-verify sbundle\&.jar\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+When the verification is successful, \f3jar verified\fR is displayed\&. Otherwise, an error message is displayed\&. You can get more information when you use the \f3-verbose\fR option\&. A sample use of \f3jarsigner\fR with the\f3-verbose\fR option follows:
+.sp     
+.nf     
+\f3jarsigner \-verify \-verbose sbundle\&.jar\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.nf     
+\f3           198 Fri Sep 26 16:14:06 PDT 1997 META\-INF/MANIFEST\&.MF\fP
+.fi     
+.nf     
+\f3           199 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE\&.SF\fP
+.fi     
+.nf     
+\f3          1013 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE\&.DSA\fP
+.fi     
+.nf     
+\f3    smk   2752 Fri Sep 26 16:12:30 PDT 1997 AclEx\&.class\fP
+.fi     
+.nf     
+\f3    smk    849 Fri Sep 26 16:12:46 PDT 1997 test\&.class\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.nf     
+\f3      s = signature was verified\fP
+.fi     
+.nf     
+\f3      m = entry is listed in manifest\fP
+.fi     
+.nf     
+\f3      k = at least one certificate was found in keystore\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.nf     
+\f3    jar verified\&.\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+.SS VERIFICATION\ WITH\ CERTIFICATE\ INFORMATION    
+If you specify the \f3-certs\fR option with the \f3-verify\fR and \f3-verbose\fR options, then the output includes certificate information for each signer of the JAR file\&. The information includes the certificate type, the signer distinguished name information (when it is an X\&.509 certificate), and in parentheses, the keystore alias for the signer when the public key certificate in the JAR file matches the one in a keystore entry, for example:
+.sp     
+.nf     
+\f3jarsigner \-keystore /working/mystore \-verify \-verbose \-certs myTest\&.jar\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.nf     
+\f3           198 Fri Sep 26 16:14:06 PDT 1997 META\-INF/MANIFEST\&.MF\fP
+.fi     
+.nf     
+\f3           199 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE\&.SF\fP
+.fi     
+.nf     
+\f3          1013 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE\&.DSA\fP
+.fi     
+.nf     
+\f3           208 Fri Sep 26 16:23:30 PDT 1997 META\-INF/JAVATEST\&.SF\fP
+.fi     
+.nf     
+\f3          1087 Fri Sep 26 16:23:30 PDT 1997 META\-INF/JAVATEST\&.DSA\fP
+.fi     
+.nf     
+\f3    smk   2752 Fri Sep 26 16:12:30 PDT 1997 Tst\&.class\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.nf     
+\f3      X\&.509, CN=Test Group, OU=Java Software, O=Oracle, L=CUP, S=CA, C=US (javatest)\fP
+.fi     
+.nf     
+\f3      X\&.509, CN=Jane Smith, OU=Java Software, O=Oracle, L=cup, S=ca, C=us (jane)\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.nf     
+\f3      s = signature was verified\fP
+.fi     
+.nf     
+\f3      m = entry is listed in manifest\fP
+.fi     
+.nf     
+\f3      k = at least one certificate was found in keystore\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.nf     
+\f3    jar verified\&.\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+If the certificate for a signer is not an X\&.509 certificate, then there is no distinguished name information\&. In that case, just the certificate type and the alias are shown\&. For example, if the certificate is a PGP certificate, and the alias is \f3bob\fR, then you would get: \f3PGP, (bob)\fR\&.
+.SS VERIFICATION\ THAT\ INCLUDES\ IDENTITY\ DATABASE\ SIGNERS    
+If a JAR file was signed with the JDK 1\&.1 \f3javakey\fR tool, and the signer is an alias in an identity database, then the verification output includes an \f3i\fR\&. If the JAR file was signed by both an alias in an identity database and an alias in a keystore, then both \f3k\fR and \f3i\fR appear\&.
+.PP
+When the \f3-certs\fR option is used, any identity database aliases are shown in brackets rather than the parentheses used for keystore aliases, for example:
+.sp     
+.nf     
+\f3    jarsigner \-keystore /working/mystore \-verify \-verbose \-certs writeFile\&.jar\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.nf     
+\f3           198 Fri Sep 26 16:14:06 PDT 1997 META\-INF/MANIFEST\&.MF\fP
+.fi     
+.nf     
+\f3           199 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE\&.SF\fP
+.fi     
+.nf     
+\f3          1013 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE\&.DSA\fP
+.fi     
+.nf     
+\f3           199 Fri Sep 27 12:22:30 PDT 1997 META\-INF/DUKE\&.SF\fP
+.fi     
+.nf     
+\f3          1013 Fri Sep 27 12:22:30 PDT 1997 META\-INF/DUKE\&.DSA\fP
+.fi     
+.nf     
+\f3   smki   2752 Fri Sep 26 16:12:30 PDT 1997 writeFile\&.html\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.nf     
+\f3      X\&.509, CN=Jane Smith, OU=Java Software, O=Oracle, L=cup, S=ca, C=us (jane)\fP
+.fi     
+.nf     
+\f3      X\&.509, CN=Duke, OU=Java Software, O=Oracle, L=cup, S=ca, C=us [duke]\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.nf     
+\f3      s = signature was verified\fP
+.fi     
+.nf     
+\f3      m = entry is listed in manifest\fP
+.fi     
+.nf     
+\f3      k = at least one certificate was found in keystore\fP
+.fi     
+.nf     
+\f3      i = at least one certificate was found in identity scope\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.nf     
+\f3    jar verified\&.\fP
+.fi     
+.nf     
+\f3\fR
+.fi     
+.sp     
+\fINote:\fR The alias \f3duke\fR is in brackets to denote that it is an identity database alias, and not a keystore alias\&.
+.SH JDK\ 1\&.1\ COMPATIBILITY    
+The \f3keytool\fR and \f3jarsigner\fR tools replace the \f3javakey\fR tool in JDK 1\&.1\&. These new tools provide more features than \f3javakey\fR, including the ability to protect the keystore and private keys with passwords, and the ability to verify signatures in addition to generating them\&.
+.PP
+The new keystore architecture replaces the identity database that \f3javakey\fR created and managed\&. There is no backward compatibility between the keystore format and the database format used by \f3javakey\fR in JDK 1\&.1\&. However, be aware of the following:
+.TP 0.2i    
+\(bu
+It is possible to import the information from an identity database into a keystore through the \f3keytool -identitydb\fR command\&.
+.TP 0.2i    
+\(bu
+The \f3jarsigner\fR command can sign JAR files that were signed with the \f3javakey\fR command\&.
+.TP 0.2i    
+\(bu
+The \f3jarsigner\fR command can verify JAR files signed with \f3javakey\fR\&. The \f3jarsigner\fR command recognizes and can work with signer aliases that are from a JDK 1\&.1 identity database rather than a JDK keystore\&.
+.SS UNSIGNED\ JARS    
+Unsigned JARs have the default privileges that are granted to all code\&.
+.SS SIGNED\ JARS    
+Signed JARs have the privilege configurations based on their JDK 1\&.1\&.\fIn\fR identity and policy file status as described\&. Only trusted identities can be imported into the JDK keystore\&.
+.PP
+Default Privileges Granted to All Code
 
-.LP
-.SH "EXAMPLES"
-.LP
-.SS 
-Signing a JAR File
-.LP
-.LP
-Suppose you have a JAR file named "bundle.jar" and you'd like to sign it using the private key of the user whose keystore alias is "jane" in the keystore named "mystore" in the "working" directory. You can use the following to sign the JAR file and name the signed JAR file "sbundle.jar":
-.LP
-.nf
-\f3
-.fl
-    jarsigner \-keystore /working/mystore \-storepass \fP\f4<keystore password>\fP\f3
-.fl
-      \-keypass \fP\f4<private key password>\fP\f3 \-signedjar sbundle.jar bundle.jar jane
-.fl
-\fP
-.fi
+Identity in 1\&.1 database: \fINo\fR
+.br     
+Trusted identity imported into Java keystore from 1\&.1\&. database: \fINo\fR
+.br     
+Policy file grants privileges to identity/alias: \fINo\fR
+.PP
 
-.LP
-.LP
-Note that there is no \f2\-sigfile\fP specified in the command above, so the generated .SF and .DSA files to be placed in the signed JAR file will have default names based on the alias name. That is, they will be named \f2JANE.SF\fP and \f2JANE.DSA\fP.
-.LP
-.LP
-If you want to be prompted for the store password and the private key password, you could shorten the above command to
-.LP
-.nf
-\f3
-.fl
-    jarsigner \-keystore /working/mystore
-.fl
-      \-signedjar sbundle.jar bundle.jar jane
-.fl
-\fP
-.fi
+.PP
+Identity in 1\&.1 database: \fINo\fR
+.br     
+Trusted identity imported into Java keystore from 1\&.1\&. database: \fIYes\fR
+.br     
+Policy file grants privileges to identity/alias: \fINo\fR
+.PP
 
-.LP
-.LP
-If the keystore to be used is the default keystore (the one named ".keystore" in your home directory), you don't need to specify a keystore, as in:
-.LP
-.nf
-\f3
-.fl
-    jarsigner \-signedjar sbundle.jar bundle.jar jane
-.fl
-\fP
-.fi
+.PP
+Identity in 1\&.1 database: Yes/Untrusted
+.br     
+Trusted identity imported into Java keystore from 1\&.1\&. database: \fINo\fR
+.br     
+Policy file grants privileges to identity/alias: \fINo\fR
+.br     
+See 3 in Notes Regarding Privileges of Signed JARs\&.
+.PP
 
-.LP
-.LP
-Finally, if you want the signed JAR file to simply overwrite the input JAR file (\f2bundle.jar\fP), you don't need to specify a \f2\-signedjar\fP option:
-.LP
-.nf
-\f3
-.fl
-    jarsigner bundle.jar jane
-.fl
-\fP
-.fi
+.PP
+Identity in 1\&.1 database: Yes/Untrusted
+.br     
+Trusted identity imported into Java keystore from 1\&.1\&. database: \fINo\fR
+.br     
+Policy file grants privileges to identity/alias: \fIYes\fR
+.br     
+See 1 and 3 in Notes Regarding Privileges of Signed JARs\&.
+.PP
+Default Privileges and Policy File Privileges Granted
 
-.LP
-.SS 
-Verifying a Signed JAR File
-.LP
-.LP
-To verify a signed JAR file, that is, to verify that the signature is valid and the JAR file has not been tampered with, use a command such as the following:
-.LP
-.nf
-\f3
-.fl
-    jarsigner \-verify sbundle.jar
-.fl
-\fP
-.fi
+Identity in 1\&.1 database: \fINo\fR
+.br     
+Trusted identity imported into Java keystore from 1\&.1\&. database: \fIYes\fR
+.br     
+Policy file grants privileges to identity/alias: \fIYes\fR
+.PP
 
-.LP
-.LP
-If the verification is successful,
-.LP
-.nf
-\f3
-.fl
-    jar verified.
-.fl
-\fP
-.fi
+.PP
+Identity in 1\&.1 database: \fIYes/Trusted\fR
+.br     
+Trusted identity imported into Java keystore from 1\&.1\&. database: \fIYes\fR
+.br     
+Policy file grants privileges to identity/alias: \fIYes\fR
+.br     
+See 2 in Notes Regarding Privileges of Signed JARs\&.
+.PP
+All Privileges Granted
 
-.LP
-.LP
-is displayed. Otherwise, an error message appears.
-.LP
-.LP
-You can get more information if you use the \f2\-verbose\fP option. A sample use of \f3jarsigner\fP with the \f2\-verbose\fP option is shown below, along with sample output:
-.LP
-.nf
-\f3
-.fl
-    jarsigner \-verify \-verbose sbundle.jar
-.fl
+Identity in 1\&.1 database: \fIYes/Trusted\fR
+.br     
+Trusted identity imported into Java keystore from 1\&.1\&. database: \fINo\fR
+.br     
+Policy file grants privileges to identity/alias: \fINo\fR
+.PP
 
-.fl
-           198 Fri Sep 26 16:14:06 PDT 1997 META\-INF/MANIFEST.MF
-.fl
-           199 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE.SF
-.fl
-          1013 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE.DSA
-.fl
-    smk   2752 Fri Sep 26 16:12:30 PDT 1997 AclEx.class
-.fl
-    smk    849 Fri Sep 26 16:12:46 PDT 1997 test.class
-.fl
-
-.fl
-      s = signature was verified
-.fl
-      m = entry is listed in manifest
-.fl
-      k = at least one certificate was found in keystore
-.fl
-
-.fl
-    jar verified.
-.fl
-\fP
-.fi
-
-.LP
-.SS 
-Verification with Certificate Information
-.LP
-.LP
-If you specify the \f2\-certs\fP option when verifying, along with the \f2\-verify\fP and \f2\-verbose\fP options, the output includes certificate information for each signer of the JAR file, including the certificate type, the signer distinguished name information (if and only if it's an X.509 certificate), and, in parentheses, the keystore alias for the signer if the public key certificate in the JAR file matches that in a keystore entry. For example,
-.LP
-.nf
-\f3
-.fl
-    jarsigner \-keystore /working/mystore \-verify \-verbose \-certs myTest.jar
-.fl
-
-.fl
-           198 Fri Sep 26 16:14:06 PDT 1997 META\-INF/MANIFEST.MF
-.fl
-           199 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE.SF
-.fl
-          1013 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE.DSA
-.fl
-           208 Fri Sep 26 16:23:30 PDT 1997 META\-INF/JAVATEST.SF
-.fl
-          1087 Fri Sep 26 16:23:30 PDT 1997 META\-INF/JAVATEST.DSA
-.fl
-    smk   2752 Fri Sep 26 16:12:30 PDT 1997 Tst.class
-.fl
-
-.fl
-      X.509, CN=Test Group, OU=Java Software, O=Sun Microsystems, L=CUP, S=CA, C=US (javatest)
-.fl
-      X.509, CN=Jane Smith, OU=Java Software, O=Sun, L=cup, S=ca, C=us (jane)
-.fl
-
-.fl
-      s = signature was verified
-.fl
-      m = entry is listed in manifest
-.fl
-      k = at least one certificate was found in keystore
-.fl
-
-.fl
-    jar verified.
-.fl
-\fP
-.fi
-
-.LP
-.LP
-If the certificate for a signer is not an X.509 certificate, there is no distinguished name information. In that case, just the certificate type and the alias are shown. For example, if the certificate is a PGP certificate, and the alias is "bob", you'd get
-.LP
-.nf
-\f3
-.fl
-      PGP, (bob)
-.fl
-\fP
-.fi
-
-.LP
-.SS 
-Verification of a JAR File that Includes Identity Database Signers
-.LP
-.LP
-If a JAR file has been signed using the JDK 1.1 \f3javakey\fP tool, and thus the signer is an alias in an identity database, the verification output includes an "i" symbol. If the JAR file has been signed by both an alias in an identity database and an alias in a keystore, both "k" and "i" appear.
-.LP
-.LP
-When the \f2\-certs\fP option is used, any identity database aliases are shown in square brackets rather than the parentheses used for keystore aliases. For example:
-.LP
-.nf
-\f3
-.fl
-    jarsigner \-keystore /working/mystore \-verify \-verbose \-certs writeFile.jar
-.fl
-
-.fl
-           198 Fri Sep 26 16:14:06 PDT 1997 META\-INF/MANIFEST.MF
-.fl
-           199 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE.SF
-.fl
-          1013 Fri Sep 26 16:22:10 PDT 1997 META\-INF/JANE.DSA
-.fl
-           199 Fri Sep 27 12:22:30 PDT 1997 META\-INF/DUKE.SF
-.fl
-          1013 Fri Sep 27 12:22:30 PDT 1997 META\-INF/DUKE.DSA
-.fl
-   smki   2752 Fri Sep 26 16:12:30 PDT 1997 writeFile.html
-.fl
-
-.fl
-      X.509, CN=Jane Smith, OU=Java Software, O=Sun, L=cup, S=ca, C=us (jane)
-.fl
-      X.509, CN=Duke, OU=Java Software, O=Sun, L=cup, S=ca, C=us [duke]
-.fl
-
-.fl
-      s = signature was verified
-.fl
-      m = entry is listed in manifest
-.fl
-      k = at least one certificate was found in keystore
-.fl
-      i = at least one certificate was found in identity scope
-.fl
-
-.fl
-    jar verified.
-.fl
-\fP
-.fi
-
-.LP
-.LP
-Note that the alias "duke" is in brackets to denote that it is an identity database alias, not a keystore alias.
-.LP
-.SH "WARNINGS"
-.LP
-During the signing/verifying process, jarsigner may display various warnings. These warning codes are defined as follows: 
-.nf
-\f3
-.fl
-         hasExpiringCert         2
-.fl
-             This jar contains entries whose signer certificate will expire within six months
-.fl
-
-.fl
-         hasExpiredCert          4
-.fl
-             This jar contains entries whose signer certificate has expired.
-.fl
-
-.fl
-         notYetValidCert         4
-.fl
-             This jar contains entries whose signer certificate is not yet valid.
-.fl
-
-.fl
-         chainNotValidated       4
-.fl
-             This jar contains entries whose certificate chain cannot be correctly validated.
-.fl
-
-.fl
-         badKeyUsage             8
-.fl
-             This jar contains entries whose signer certificate's KeyUsage extension doesn't allow code signing.
-.fl
-
-.fl
-         badExtendedKeyUsage     8
-.fl
-             This jar contains entries whose signer certificate's ExtendedKeyUsage extension
-.fl
-             doesn't allow code signing.
-.fl
-
-.fl
-         badNetscapeCertType     8
-.fl
-             This jar contains entries whose signer certificate's NetscapeCertType extension
-.fl
-             doesn't allow code signing.
-.fl
-
-.fl
-         hasUnsignedEntry        16
-.fl
-             This jar contains unsigned entries which have not been integrity\-checked.
-.fl
-
-.fl
-         notSignedByAlias        32
-.fl
-             This jar contains signed entries which are not signed by the specified alias(es)
-.fl
-
-.fl
-         aliasNotInStore         32
-.fl
-             This jar contains signed entries that are not signed by alias in this keystore
-.fl
-
-.fl
-\fP
-.fi
-
-.LP
-.LP
-When the \f2\-strict\fP option is provided, an OR\-value of warnings detected will be returned as the exit code of the tool. For example, if a certificate used to sign an entry is expired and has a keyUsage extension that does not allow it to sign a file, an exit code 12 (=4+8) will be returned.
-.LP
-.LP
-\f3Note\fP: Exit codes are reused because only 0\-255 is legal for Unix. In any case, if the signing/verifying process fails, the following exit code will be returned:
-.LP
-.nf
-\f3
-.fl
-failure                 1
-.fl
-\fP
-.fi
-
-.LP
-.SS 
-Compatibility with JDK 1.1
-.LP
-.LP
-The \f3keytool\fP and \f3jarsigner\fP tools completely replace the \f3javakey\fP tool provided in JDK 1.1. These new tools provide more features than \f3javakey\fP, including the ability to protect the keystore and private keys with passwords, and the ability to verify signatures in addition to generating them.
-.LP
-.LP
-The new keystore architecture replaces the identity database that \f3javakey\fP created and managed. There is no backwards compatibility between the keystore format and the database format used by \f3javakey\fP in 1.1. However,
-.LP
-.RS 3
-.TP 2
-o
-It is possible to import the information from an identity database into a keystore, via the \f3keytool\fP \f2\-identitydb\fP command. 
-.TP 2
-o
-\f3jarsigner\fP can sign JAR files also previously signed using \f3javakey\fP. 
-.TP 2
-o
-\f3jarsigner\fP can verify JAR files signed using \f3javakey\fP. Thus, it recognizes and can work with signer aliases that are from a JDK 1.1 identity database rather than a Java 2 SDK keystore. 
-.RE
-
-.LP
-.LP
-The following table explains how JAR files that were signed in JDK 1.1.x are treated in the Java 2 platform.
-.LP
-.LP
-.TS
-.if \n+(b.=1 .nr d. \n(.c-\n(c.-1
-.de 35
-.ps \n(.s
-.vs \n(.vu
-.in \n(.iu
-.if \n(.u .fi
-.if \n(.j .ad
-.if \n(.j=0 .na
-..
-.nf
-.nr #~ 0
-.if n .nr #~ 0.6n
-.ds #d .d
-.if \(ts\n(.z\(ts\(ts .ds #d nl
-.fc
-.nr 33 \n(.s
-.rm 80 81 82 83 84
-.nr 34 \n(.lu
-.eo
-.am 82
-.br
-.di a+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(82 .ll \n(82u
-.in 0
-\f3Trusted Identity imported into Java 2 Platform keystore from 1.1 database (4)\fP
-.br
-.di
-.nr a| \n(dn
-.nr a- \n(dl
-..
-.ec \
-.eo
-.am 83
-.br
-.di b+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(83 .ll \n(83u
-.in 0
-\f3Policy File grants privileges to Identity/Alias\fP
-.br
-.di
-.nr b| \n(dn
-.nr b- \n(dl
-..
-.ec \
-.eo
-.am 84
-.br
-.di c+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(84 .ll \n(84u
-.in 0
-Default privileges granted to all code.
-.br
-.di
-.nr c| \n(dn
-.nr c- \n(dl
-..
-.ec \
-.eo
-.am 84
-.br
-.di d+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(84 .ll \n(84u
-.in 0
-Default privileges granted to all code.
-.br
-.di
-.nr d| \n(dn
-.nr d- \n(dl
-..
-.ec \
-.eo
-.am 84
-.br
-.di e+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(84 .ll \n(84u
-.in 0
-Default privileges granted to all code.
-.br
-.di
-.nr e| \n(dn
-.nr e- \n(dl
-..
-.ec \
-.eo
-.am 84
-.br
-.di f+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(84 .ll \n(84u
-.in 0
-Default privileges granted to all code. (3)
-.br
-.di
-.nr f| \n(dn
-.nr f- \n(dl
-..
-.ec \
-.eo
-.am 84
-.br
-.di g+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(84 .ll \n(84u
-.in 0
-Default privileges granted to all code. (1,3)
-.br
-.di
-.nr g| \n(dn
-.nr g- \n(dl
-..
-.ec \
-.eo
-.am 84
-.br
-.di h+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(84 .ll \n(84u
-.in 0
-Default privileges granted to all code plus privileges granted in policy file.
-.br
-.di
-.nr h| \n(dn
-.nr h- \n(dl
-..
-.ec \
-.eo
-.am 84
-.br
-.di i+
-.35
-.ft \n(.f
-.ll \n(34u*1u/6u
-.if \n(.l<\n(84 .ll \n(84u
-.in 0
-Default privileges granted to all code plus privileges granted in policy file. (2)
-.br
-.di
-.nr i| \n(dn
-.nr i- \n(dl
-..
-.ec \
-.35
-.nf
-.ll \n(34u
-.nr 80 0
-.nr 38 \w\f3JAR File Type\fP
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \wSigned JAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \wUnsigned JAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \wSigned JAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \wSigned JAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \wSigned JAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \wSigned JAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \wSigned JAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \wSigned JAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \wSigned JAR
-.if \n(80<\n(38 .nr 80 \n(38
-.nr 38 \wSigned JAR
-.if \n(80<\n(38 .nr 80 \n(38
-.80
-.rm 80
-.nr 81 0
-.nr 38 \w\f3Identity in 1.1 database\fP
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wNO
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wNO
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wNO
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wYES/Untrusted
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wYES/Untrusted
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wNO
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wYES/Trusted
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wYES/Trusted
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wYES/Trusted
-.if \n(81<\n(38 .nr 81 \n(38
-.nr 38 \wYES/Trusted
-.if \n(81<\n(38 .nr 81 \n(38
-.81
-.rm 81
-.nr 82 0
-.nr 38 \wNO
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wNO
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wYES
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wNO
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wNO
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wYES
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wYES
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wNO
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wYES
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 38 \wNO
-.if \n(82<\n(38 .nr 82 \n(38
-.82
-.rm 82
-.nr 38 \n(a-
-.if \n(82<\n(38 .nr 82 \n(38
-.nr 83 0
-.nr 38 \wNO
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wNO
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wNO
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wNO
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wYES
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wYES
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wYES
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wNO
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wNO
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 38 \wYES
-.if \n(83<\n(38 .nr 83 \n(38
-.83
-.rm 83
-.nr 38 \n(b-
-.if \n(83<\n(38 .nr 83 \n(38
-.nr 84 0
-.nr 38 \w\f3Privileges Granted\fP
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \wAll privileges
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \wAll privileges (1)
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \wAll privileges (1)
-.if \n(84<\n(38 .nr 84 \n(38
-.84
-.rm 84
-.nr 38 \n(c-
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \n(d-
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \n(e-
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \n(f-
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \n(g-
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \n(h-
-.if \n(84<\n(38 .nr 84 \n(38
-.nr 38 \n(i-
-.if \n(84<\n(38 .nr 84 \n(38
-.35
-.nf
-.ll \n(34u
-.nr 38 1n
-.nr 79 0
-.nr 40 \n(79+(0*\n(38)
-.nr 80 +\n(40
-.nr 41 \n(80+(3*\n(38)
-.nr 81 +\n(41
-.nr 42 \n(81+(3*\n(38)
-.nr 82 +\n(42
-.nr 43 \n(82+(3*\n(38)
-.nr 83 +\n(43
-.nr 44 \n(83+(3*\n(38)
-.nr 84 +\n(44
-.nr TW \n(84
-.if t .if \n(TW>\n(.li .tm Table at line 1082 file Input is too wide - \n(TW units
-.fc  
-.nr #T 0-1
-.nr #a 0-1
-.eo
-.de T#
-.ds #d .d
-.if \(ts\n(.z\(ts\(ts .ds #d nl
-.mk ##
-.nr ## -1v
-.ls 1
-.ls
-..
-.ec
-.ne \n(a|u+\n(.Vu
-.ne \n(b|u+\n(.Vu
-.if (\n(a|+\n(#^-1v)>\n(#- .nr #- +(\n(a|+\n(#^-\n(#--1v)
-.if (\n(b|+\n(#^-1v)>\n(#- .nr #- +(\n(b|+\n(#^-\n(#--1v)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u 
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'\f3JAR File Type\fP\h'|\n(41u'\f3Identity in 1.1 database\fP\h'|\n(42u'\h'|\n(43u'\h'|\n(44u'\f3Privileges Granted\fP
-.mk ##
-.nr 31 \n(##
-.sp |\n(##u-1v
-.nr 37 \n(42u
-.in +\n(37u
-.a+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(##u-1v
-.nr 37 \n(43u
-.in +\n(37u
-.b+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(31u
-.ne \n(c|u+\n(.Vu
-.if (\n(c|+\n(#^-1v)>\n(#- .nr #- +(\n(c|+\n(#^-\n(#--1v)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u 
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'Signed JAR\h'|\n(41u'NO\h'|\n(42u'NO\h'|\n(43u'NO\h'|\n(44u'
-.mk ##
-.nr 31 \n(##
-.sp |\n(##u-1v
-.nr 37 \n(44u
-.in +\n(37u
-.c+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(31u
-.ne \n(d|u+\n(.Vu
-.if (\n(d|+\n(#^-1v)>\n(#- .nr #- +(\n(d|+\n(#^-\n(#--1v)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u 
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'Unsigned JAR\h'|\n(41u'NO\h'|\n(42u'NO\h'|\n(43u'NO\h'|\n(44u'
-.mk ##
-.nr 31 \n(##
-.sp |\n(##u-1v
-.nr 37 \n(44u
-.in +\n(37u
-.d+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(31u
-.ne \n(e|u+\n(.Vu
-.if (\n(e|+\n(#^-1v)>\n(#- .nr #- +(\n(e|+\n(#^-\n(#--1v)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u 
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'Signed JAR\h'|\n(41u'NO\h'|\n(42u'YES\h'|\n(43u'NO\h'|\n(44u'
-.mk ##
-.nr 31 \n(##
-.sp |\n(##u-1v
-.nr 37 \n(44u
-.in +\n(37u
-.e+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(31u
-.ne \n(f|u+\n(.Vu
-.if (\n(f|+\n(#^-1v)>\n(#- .nr #- +(\n(f|+\n(#^-\n(#--1v)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u 
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'Signed JAR\h'|\n(41u'YES/Untrusted\h'|\n(42u'NO\h'|\n(43u'NO\h'|\n(44u'
-.mk ##
-.nr 31 \n(##
-.sp |\n(##u-1v
-.nr 37 \n(44u
-.in +\n(37u
-.f+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(31u
-.ne \n(g|u+\n(.Vu
-.if (\n(g|+\n(#^-1v)>\n(#- .nr #- +(\n(g|+\n(#^-\n(#--1v)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u 
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'Signed JAR\h'|\n(41u'YES/Untrusted\h'|\n(42u'NO\h'|\n(43u'YES\h'|\n(44u'
-.mk ##
-.nr 31 \n(##
-.sp |\n(##u-1v
-.nr 37 \n(44u
-.in +\n(37u
-.g+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(31u
-.ne \n(h|u+\n(.Vu
-.if (\n(h|+\n(#^-1v)>\n(#- .nr #- +(\n(h|+\n(#^-\n(#--1v)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u 
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'Signed JAR\h'|\n(41u'NO\h'|\n(42u'YES\h'|\n(43u'YES\h'|\n(44u'
-.mk ##
-.nr 31 \n(##
-.sp |\n(##u-1v
-.nr 37 \n(44u
-.in +\n(37u
-.h+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(31u
-.ne \n(i|u+\n(.Vu
-.if (\n(i|+\n(#^-1v)>\n(#- .nr #- +(\n(i|+\n(#^-\n(#--1v)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u 
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'Signed JAR\h'|\n(41u'YES/Trusted\h'|\n(42u'YES\h'|\n(43u'YES\h'|\n(44u'
-.mk ##
-.nr 31 \n(##
-.sp |\n(##u-1v
-.nr 37 \n(44u
-.in +\n(37u
-.i+
-.in -\n(37u
-.mk 32
-.if \n(32>\n(31 .nr 31 \n(32
-.sp |\n(31u
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u 
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'Signed JAR\h'|\n(41u'YES/Trusted\h'|\n(42u'NO\h'|\n(43u'NO\h'|\n(44u'All privileges
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u 
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'Signed JAR\h'|\n(41u'YES/Trusted\h'|\n(42u'YES\h'|\n(43u'NO\h'|\n(44u'All privileges (1)
-.ta \n(80u \n(81u \n(82u \n(83u \n(84u 
-.nr 31 \n(.f
-.nr 35 1m
-\&\h'|\n(40u'Signed JAR\h'|\n(41u'YES/Trusted\h'|\n(42u'NO\h'|\n(43u'YES\h'|\n(44u'All privileges (1)
-.fc
-.nr T. 1
-.T# 1
-.35
-.rm a+
-.rm b+
-.rm c+
-.rm d+
-.rm e+
-.rm f+
-.rm g+
-.rm h+
-.rm i+
-.TE
-.if \n-(b.=0 .nr c. \n(.c-\n(d.-42
-
-.LP
-.LP
-Notes:
-.LP
-.RS 3
-.TP 3
-1.
-If an identity/alias is mentioned in the policy file, it must be imported into the keystore for the policy file to have any effect on privileges granted. 
-.TP 3
-2.
-The policy file/keystore combination has precedence over a trusted identity in the identity database. 
-.TP 3
-3.
-Untrusted identities are ignored in the Java 2 platform. 
-.TP 3
-4.
-Only trusted identities can be imported into Java 2 SDK keystores. 
-.RE
-
-.LP
-.SH "SEE ALSO"
-.LP
-.RS 3
-.TP 2
-o
-jar(1) tool documentation 
-.TP 2
-o
-keytool(1) tool documentation 
-.TP 2
-o
-the 
-.na
-\f4Security\fP @
-.fi
-http://docs.oracle.com/javase/tutorial/security/index.html trail of the 
-.na
-\f4Java Tutorial\fP @
-.fi
-http://docs.oracle.com/javase/tutorial/index.html for examples of the use of the \f3jarsigner\fP tool 
-.RE
-
-.LP
- 
+.PP
+Identity in 1\&.1 database: \fIYes/Trusted\fR
+.br     
+Trusted identity imported into Java keystore from 1\&.1\&. database: \fIYes\fR
+.br     
+Policy file grants privileges to identity/alias: \fINo\fR
+.br     
+See 1 in Notes Regarding Privileges of Signed JARs\&.
+.PP
+Identity in 1\&.1 database: \fIYes/Trusted\fR
+.br     
+Trusted identity imported into Java keystore from 1\&.1\&. database: \fINo\fR
+.br     
+Policy file grants privileges to identity/alias: \fIYes\fR
+.br     
+See 1 in Notes Regarding Privileges of Signed JARs\&.
+.PP
+Notes Regarding Privileges of Signed JARs
+.TP 0.4i    
+1\&.
+If an identity or alias is mentioned in the policy file, then it must be imported into the keystore for the policy file to have any effect on privileges granted\&.
+.TP 0.4i    
+2\&.
+The policy file/keystore combination has precedence over a trusted identity in the identity database\&.
+.TP 0.4i    
+3\&.
+Untrusted identities are ignored in the Java platform\&.
+.SH SEE\ ALSO    
+.TP 0.2i    
+\(bu
+\f3jar\fR
+.TP 0.2i    
+\(bu
+\f3keytool\fR
+.TP 0.2i    
+\(bu
+Trail: Security Features in Java SE at http://docs\&.oracle\&.com/javase/tutorial/security/index\&.html
+.RE
+.br
+'pl 8.5i
+'bp
--- a/src/macosx/classes/com/apple/laf/resources/aqua_ko.properties	Fri Jan 10 15:10:25 2014 +0000
+++ b/src/macosx/classes/com/apple/laf/resources/aqua_ko.properties	Thu Jan 23 19:23:55 2014 +0000
@@ -46,7 +46,7 @@
 FileChooser.openButton.textAndMnemonic=\uC5F4\uAE30
 FileChooser.saveDialogTitle.textAndMnemonic=\uC800\uC7A5
 FileChooser.openDialogTitle.textAndMnemonic=\uC5F4\uAE30
-FileChooser.updateButton.textAndMnemonic=\uAC31\uC2E0
+FileChooser.updateButton.textAndMnemonic=\uC5C5\uB370\uC774\uD2B8
 FileChooser.helpButton.textAndMnemonic=\uB3C4\uC6C0\uB9D0
 FileChooser.directoryOpenButton.textAndMnemonic=\uC5F4\uAE30
 
--- a/src/macosx/native/sun/awt/splashscreen/splashscreen_sys.m	Fri Jan 10 15:10:25 2014 +0000
+++ b/src/macosx/native/sun/awt/splashscreen/splashscreen_sys.m	Thu Jan 23 19:23:55 2014 +0000
@@ -290,8 +290,8 @@
         SplashUnlock(splash);
         rc = poll(pfd, 1, timeout);
         SplashLock(splash);
-        if (splash->isVisible>0 && SplashTime() >= splash->time +
-                splash->frames[splash->currentFrame].delay) {
+        if (splash->isVisible > 0 && splash->currentFrame >= 0 &&
+                SplashTime() >= splash->time + splash->frames[splash->currentFrame].delay) {
             SplashNextFrame(splash);
             SplashRedrawWindow(splash);
         }
--- a/src/share/classes/com/sun/accessibility/internal/resources/accessibility_de.properties	Fri Jan 10 15:10:25 2014 +0000
+++ b/src/share/classes/com/sun/accessibility/internal/resources/accessibility_de.properties	Thu Jan 23 19:23:55 2014 +0000
@@ -102,7 +102,7 @@
 #
 # accessible actions
 #
-toggleexpand=ein-/ausblenden
+toggleexpand=einblenden umschalten
 
 # new relations, roles and states for J2SE 1.5.0
 
--- a/src/share/classes/com/sun/accessibility/internal/resources/accessibility_es.properties	Fri Jan 10 15:10:25 2014 +0000
+++ b/src/share/classes/com/sun/accessibility/internal/resources/accessibility_es.properties	Thu Jan 23 19:23:55 2014 +0000
@@ -102,7 +102,7 @@
 #
 # accessible actions
 #
-toggleexpand=activar/desactivar ampliaci\u00F3n
+toggleexpand=conmutar ampliaci\u00F3n
 
 # new relations, roles and states for J2SE 1.5.0
 
--- a/src/share/classes/com/sun/accessibility/internal/resources/accessibility_fr.properties	Fri Jan 10 15:10:25 2014 +0000
+++ b/src/share/classes/com/sun/accessibility/internal/resources/accessibility_fr.properties	Thu Jan 23 19:23:55 2014 +0000
@@ -102,7 +102,7 @@
 #
 # accessible actions
 #
-toggleexpand=basculer le d\u00E9veloppement
+toggleexpand=activer/d\u00E9sactiver d\u00E9veloppement
 
 # new relations, roles and states for J2SE 1.5.0
 
--- a/src/share/classes/com/sun/accessibility/internal/resources/accessibility_it.properties	Fri Jan 10 15:10:25 2014 +0000
+++ b/src/share/classes/com/sun/accessibility/internal/resources/accessibility_it.properties	Thu Jan 23 19:23:55 2014 +0000
@@ -102,7 +102,7 @@
 #
 # accessible actions
 #
-toggleexpand=abilita/disabilita espansione
+toggleexpand=attiva/disattiva espansione
 
 # new relations, roles and states for J2SE 1.5.0
 
--- a/src/share/classes/com/sun/accessibility/internal/resources/accessibility_pt_BR.properties	Fri Jan 10 15:10:25 2014 +0000
+++ b/src/share/classes/com/sun/accessibility/internal/resources/accessibility_pt_BR.properties	Thu Jan 23 19:23:55 2014 +0000
@@ -102,7 +102,7 @@
 #
 # accessible actions
 #
-toggleexpand=alternar expans\u00E3o
+toggle