签署代码（例如 jar）有什么意义？
当每个人都可以使用 jarsigner 来签名你的代码（就像 Java 的 jar 一样）有什么意义呢？ 它如何提供安全性？
What is the point of signing your code like Java's jars when everyone can do it with jarsigner?
How does it provide security?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
对 JAR 文件进行签名的目的是验证它没有被篡改。一旦对 jar 文件进行签名，您就可以验证该文件是否未被其他人修改。这可确保该文件源自最初签名的人。如果有人在中间修改了文件，签名验证过程将失败。您可以查看这篇文章，了解有关如何公钥加密可用于执行数字签名。
The point of signing a JAR file is to verify that it has not been tampered with. Once a jar file is signed you can verify that this file hasn't been modified by someone else. This ensures that the file originates from the person that originally signed it. If someone has modified the file in-between the signature verification process will fail. You may check this article for more details on how public key cryptography could be used to perform digital signature.
当您签署 jar 文件时，您可以表明是您签署的，而不是其他人。
当你签署一份文件时，也是同样的想法——只有你可以写下你的签名。其他人可以签署它，但他们会使用他们的签名，而不是您的签名。
通过手写签名，熟练的伪造者可以学会复制您的签名。使用数字签名，制作副本要困难得多，因为您需要获取该人的私人信息钥匙。如果没有私钥，您就无法制作看起来像他们的签名。
When you sign a jar file you can show that it was you that signed it and not someone else.
It's the same idea when you sign a document - only you can write your signature. Other people can sign it, but they'll sign it with their signature, not yours.
With hand-written signatures a skilled forger can learn to copy your signature. With digital signatures it is much more difficult to make a copy because you need to get that person's private key. Without the private key you cannot make a signature that looks like theirs.
对 jar 进行签名将内容与特定证书联系起来。那么这个证书能证明什么呢？
如果证书的私钥被盗，那么情况也不会那么严重。有防篡改设备来保存私钥。然而，私钥常常隐藏在开发人员的机器上。这些机器可能没有得到很好的保护。
证书本身可以由知名的证书颁发机构 (CA) 签名。因此，最终用户对内容具有所声称的来源有一定的信心。证书密钥持有者与其声称的身份的验证量各不相同。这导致了一场逐底竞争，CA 简化程序以提供更低的价格。
即使对于未经验证的证书，使用同一证书签名的不同内容也显示出共同的来源。因此，如果您决定信任某个证书，您就可以从同一来源接收更多内容，而无需信任其他任何人。
Signing a jar ties the contents back to a particular certificate. So what is that certificate proving?
If the private key for the certificate has been stolen, then not very much. There are tamper-proof devices for keeping private keys. However, often private keys often lie about on developer machines. Those machines are probably not well protected.
A certificate may itself be signed by a well known Certificate Authority (CA). So the end-user has some confidence that content has the claimed origin. The amount of verification that the certificate key holder is who they claim to be varies. This has led to a race-to-the-bottom where CAs simplify procedures to offer lower prices.
Even for unverified certificates, different content signed with the same certificate shows a common origin. So if you make a decision to trust a certificate, you can receive more content from the same origin without trusting anyone else.