jarsigner

Sign JAR file

$ jarsigner -keystore [keystore.jks] [app.jar] [alias]

$ jarsigner -verify [app.jar]

$ jarsigner -verify -verbose -certs [app.jar]

$ jarsigner -keystore [keystore.jks] -signedjar [signed.apk] [unsigned.apk] [alias]

$ jarsigner -sigalg SHA256withRSA -digestalg SHA-256 [app.jar] [alias]

jarsigner [options] jar-file alias

jarsigner signs and verifies Java Archive (JAR) files. It adds digital signatures to ensure authenticity and integrity, required for Java applets, Android apps, and signed JARs.
The tool uses certificates stored in keystores for signing. Verification checks that contents haven't been modified and validates the signer's certificate.

-keystore file

Keystore location.

Keystore password.

Key password.

Output signed JAR name.

Signature algorithm.

Digest algorithm.

Verify signature.

Verbose output.

Show certificates.

Timestamp authority URL.

Weak algorithms deprecated. Keystores need protection. Timestamp recommended for longevity. Android has specific requirements.

jarsigner has been part of the JDK since Java's early days. JAR signing became important for Java applets in browsers and later for Android application distribution. The tool has evolved to support stronger cryptographic algorithms.

keytool(1), jar(1), apksigner(1), openssl(1)