[MSHARED-314] Unsigning a jar is not correct

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: maven-jarsigner-1.2
• Fix Version/s: maven-jarsigner-1.3
• Component/s: maven-jarsigner
• Assignee: Tony Chemit
• Reporter: Tony Chemit
• Created: 28/Dec/13 08:11
• Updated: 28/Dec/13 15:01
• Resolved: 28/Dec/13 08:56

Description

when unsigning a jar, we must remove of the signatures files from the META-INF package + remove any signing attributes (like SHA1-DIGEST ones).

The problem occurs in fact when a jar was signed by jdk6, unsign it, then resign it with a jdk7.

since the digest algorithm since jdk7 is no more the same, we still have some entry in the manifest which does not match the effective signing...

the best way to remove this is just to clean the manisfest file.

Issue Links

• is depended upon by: MJARSIGNER-21 jars signed using Java 7 have "invalid SHA1 signature"