Verifying Jar Signature

Question

I\'m trying to programmatically verify that a jar file has not been obviously tampered with. I have 2 use cases I want to prevent. 1) Modifications of existing classes 2) ad

Answer 1

I figured out why this was happening to me...it was a stupid mistake.

I had my tampered signed jar, but I also had all the same classes compiled since this was my dev env. So the classloader picked up the compiled classes over the jar classes. There is no manifest for the compiled classes, so no security errors were generated.

Once I deleted my compiled classes I got the expected security exceptions.