数字签名
所有，
我需要对 zip 文件进行数字签名。我不知道该怎么做。数字签名对我有什么作用？同样重要的是，我如何验证数字签名？
All,
I need to digitally sign a zip file. I am not sure how to do that. What does the digital signature do for me? And just as importantly, how do i verify the digital signature?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您可以阅读有关 JAR 签名的精彩读物（http://www.cs.princeton.edu/introcs/85application/jar/sign.html），并记住 JAR 是带有 MANIFEST 的 ZIP，我想说您进行 JAR 签名即可。
You can get a great reading on JAR signing (http://www.cs.princeton.edu/introcs/85application/jar/sign.html) and having in mind that JAR is a ZIP with a MANIFEST, I'd say you go with JAR signing and that's it.
最新版本的 APPNOTE（这是 PKWare 发布 ZIP 格式规范的地方）描述了 ZIP 档案的数字签名。问题是他们不允许人们实现签名功能并将其保留在 SecureZip 软件中供自己使用。从法律角度来看，您只能执行 ZIP 存档签名的验证。
我们的 SecureBlackbox 组件库包含 ZIP 处理组件，其中包括许多其他功能， ZIP 存档签名的验证。我们也试图从 PKWare 获得许可证来执行签名，但他们甚至没有在内部讨论这个选项，所以他们无法给我们明确的答案。
Recent versions of APPNOTE (this is where PKWare publishes ZIP format specification) describe digital signature of ZIP archives. The problem is that they don't let one implement signing functionality and reserve it for their own use in their SecureZip software. From legal point of view you are allowed only to perform validation of ZIP archive signatures.
Our SecureBlackbox component library includes ZIP processing components, which include, among many other functions, validation of ZIP archive signatures. We attempted to acquire a license from PKWare to perform signing as well, but they didn't even discuss such option internally, so they were not able to give us a definite answer.