In a Java SE environment,
Derby can detect digital
signatures on jar files. When attempting to load a class from a signed jar file
stored in the database, Derby
will verify the validity of the signature.
Note: The Derby class loader
only validates the integrity of the signed jar file and verifies that the
certificate has not expired.
Derby cannot ascertain
whether the validity or identity of declared signer is correct.
When loading classes from an application jar file in a Java SE environment,
Derby behaves as follows if
the class is signed:
- Verifies that the jar file was signed using a X.509 certificate (that is,
it can be represented by the class
java.security.cert.X509Certificate). If not, throws an
exception.
- Verifies that the digital signature matches the contents of the file. If
not, throws an exception.
- Checks that the set of signing certificates are all valid for the current
date and time. If any certificate has expired or is not yet valid, throws an
exception.
- Passes the array of certificates to the setSigners() method
of java.lang.ClassLoader. This allows security managers to
obtain the list of signers for a class (using
java.lang.Class.getSigners) and then validate the identity of
the signers using the services of a Public Key Infrastructure (PKI).
For more information about signed jar files, see http://docs.oracle.com/javase/8/docs/technotes/guides/jar/jar.html.