Home/ Questions/Q 8492007
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-10T22:35:42+00:00

Using freshly installed JDK 1.7 we sign the JAR file. Immediately after that we

  • 0

Using freshly installed JDK 1.7 we sign the JAR file. Immediately after that we verify it using the same jarsigner and the same keystore and … it fails with the message:

invalid SHA256 hash on …

The signing/verification code is trivial (two consequent lines in windows batch):

%JAVADIR%\jarsigner -keystore \path\to\SBBJavaCodeSigningStore -storepass my_password SecureBlackbox.JCE.jar sbbjavacodesigningkey
%JAVADIR%\jarsigner -verify -keystore \path\to\SBBJavaCodeSigningStore -storepass my_password SecureBlackbox.JCE.jar

The worst thing is that the problem seems to be random, and jarsigner doesn’t even set errorlevel (exit code) when verification fails.

Is it a bug of Java signer or cryptographic classes or something else?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I am putting the solution here as a lesson for other users.

    It appeared that later in batch file we batch-signed all JARs and this particular JAR gets signed twice. jarsigner lets you do the second signature and breaks the first one this way.

    • 0