我正在阅读JDK 附带的工具的手册页。jarsigner这条线让我很惊讶：
如果生成签名时 JAR 文件中的所有文件从那时起都没有更改，则验证仍然被认为是成功的，如果 .SF 文件的非标题部分中的哈希值等于清单文件中的相应部分。
这对我来说没有意义。攻击者不能在已经签名的 jar 文件中隐藏恶意代码吗？
更新：这是这种情况的一个例子。看起来 jarsigner 会将 jar 标记为包含额外文件，但仍认为它已验证。
=> jar -cf twelfthnight.jar TwelfthNight.html
=> keytool -genkey -alias signFiles -keystore examplestore
=> jarsigner -keystore examplestore twelfthnight.jar signFiles
Enter Passphrase for keystore:
jar signed.
Warning:
The signer certificate will expire within six months.
No -tsa or -tsacert is provided and this jar is not timestamped. Without a timestamp, users may not be able to validate this jar after the signer certificate's expiration date (2016-10-16) or after any future revocation date.
=> jarsigner -verify twelfthnight.jar
jar verified.
Warning:
This jar contains entries whose certificate chain is not validated.
This jar contains entries whose signer certificate will expire within six months.
This jar contains signatures that does not include a timestamp. Without a timestamp, users may not be able to validate this jar after the signer certificate's expiration date (2016-10-16) or after any future revocation date.
Re-run with the -verbose and -certs options for more details.
=> jar uf twelfthnight.jar Hamlet.html
=> jarsigner -verify twelfthnight.jar
jar verified.
Warning:
This jar contains unsigned entries which have not been integrity-checked.
This jar contains entries whose certificate chain is not validated.
This jar contains entries whose signer certificate will expire within six months.
This jar contains signatures that does not include a timestamp. Without a timestamp, users may not be able to validate this jar after the signer certificate's expiration date (2016-10-16) or after any future revocation date.
Re-run with the -verbose and -certs options for more details.