你如何以编程方式在Java中签署jar文件？ [英] How do you programmatically sign jar files in Java?

问题描述

以前有人这样做过吗？我在谷歌上找到的唯一参考是： http://onjava.com/ onjava / 2001/04/12 / signing_jar.html 仍然使用sun。*类会导致问题......

Has anyone done this before? The only reference I have found on google has been: http://onjava.com/onjava/2001/04/12/signing_jar.html which still uses sun.* classes that will cause issues...

发现这一点，但是不适用于java16： https://svn.cs.cf.ac.uk/projects/whip/trunk/whip-core/src/main/java/org/whipplugin/data/bundle/JarSigner15.java

Found this as well, but does not work with java16: https://svn.cs.cf.ac.uk/projects/whip/trunk/whip-core/src/main/java/org/whipplugin/data/bundle/JarSigner15.java

推荐答案

请注意 sun.security.tools.JarSigner 类被编写为用作命令行实用程序，并非设计为从Java代码调用。因此，错误处理非常突然：代码只会将错误消息打印到标准输出然后调用 System.exit（） 1 。

Be aware that the sun.security.tools.JarSigner class was written to be used as a command-line utility and wasn't designed to be called from Java code. As a result, the error handling is pretty abrupt: the code will simply print an error message to standard out and then call System.exit() 1.

这意味着如果从Java代码中调用该类，并且在尝试对jar进行签名时发生错误，则运行代码的JVM将停止。这可能会很好，具体取决于你的情况，但如果你的代码是长期运行或作为服务，它不是那么好。

This means that if you call the class from within your Java code and an error occurs when you try to sign a jar, the JVM running your code will simply stop. This may be fine depending on your situation, but if your code is long running or acting as a service, it's not so good.

因此最好调用jarsigner工具根据clamp的评论使用ProcessBuilder。然后，您可以在生成的Process对象上调用 waitFor（），并检查 exitValue（）以查看命令是否成功。 getInputStream（）将允许您读取在操作失败时写入标准输出的任何错误消息。

It's therefore better to call the jarsigner tool using the ProcessBuilder as per clamp's comment. You can then call waitFor() on the resulting Process object and check exitValue() to see if the command was successful. getInputStream() will let you read any error messages that were written to standard out if the operation fails.

这篇关于你如何以编程方式在Java中签署jar文件？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！