Why should I sign my JAR files?

java jar signed-applet
Chris Carruthers picture Chris Carruthers · Jun 9, 2009 · Viewed 20.4k times · Source

Why should I sign my JAR files?

I know that I need to sign my client-side JAR files (containing Applets) so that special things like filesystem access can be done, and so that the annoying bit at the bottom of windows doesn't show, but why else? And do I need to sign my server-side JAR files containing Servlets, etc.?

Some basic rules for when and when not to sign JARs would be appreciated - thanks!

Answer

Ran Biron picture Ran Biron · Jun 9, 2009

The short answer - don't, unless your company policy forces you to.

The long answer
Signing jars is effectively telling your customer "I made this, and I guarantee it won't mess up your system. If it does, come to me for retribution". This is why signed jars in client-side solution deployed from remote servers (applets / webstart) enjoy higher privileges than non-signed solutions do.

On server-side solutions, where you don't have to to placate the JVM security demands, this guarantee is only for your customer peace of mind.
The bad thing about signed jars is that they load slower than unsigned jars. How much slower? it's CPU-bound, but I've noticed more than a 100% increase in loading time. Also, patches are harder (you have to re-sign the jar), class-patches are impossible (all classes in a single package must have the same signature source) and splitting jars becomes a chore. Not to mention your build process is longer, and that proper certificates cost money (self-signed is next to useless).

So, unless your company policy forces you to, don't sign jars on the server side, and keep common jars in signed and non-signed versions (signed go to the client-side deployment, non-signed go to server-side codebase).

Related questions

-tsa or -tsacert timestamp for applet jar self-signed

When I was trying to self-sign in the jar like below. jarsigner -keystore my keystore myjar.jar myalias It gives warning like: No -tsa or -tsacert is provided and this jar is not timestamped. Without a timestamp, users may not …

Read More
Can't execute jar- file: "no main manifest attribute"

I have installed an application, when I try to run it (it's an executable jar) nothing happens. When I run it from the commandline with: java -jar "app.jar" I get the following message: no main manifest attribute, in "app.…

Read More
Running JAR file on Windows

I have a JAR file named helloworld.jar. In order to run it, I'm executing the following command in a command-line window: java -jar helloworld.jar This works fine, but how do I execute it with double-click instead? Do I …

Read More