IV34537: JAR VERIFICATION FAILS ON JARS THAT ARE SIGNED WITH SOME OF THE MESSAGEDIGEST ALGORITHMS

APAR status

• Closed as program error.

Error description

• Error Message: When you try to verify a JAR which is signed with
  MessageDigest algorithms SHA256, SHA384 or SHA512, we get the
  following error with Java 6:
  jar is unsigned. (signatures missing or not parsable)
  With Java 7, it says the JAR is verified, but we get the warning
  shown below:
  jar verified.
  Warning:
  This jar contains unsigned entries which have not been
  integrity-checked
  .
  Stack Trace: N/A
  .
  

Local fix

Problem summary

• The problem is caused as the BootstrapProvider which is used
  during JAR verification, did not contain these algorithms in its
  list of supported algorithms.
  

Problem conclusion

• This defect will be fixed in:
  6.0.0 SR13
  7.0.0 SR4
  .
  The JDK has been updated to add the SHA256, SHA384 and SHA512
  algorithms to the list of supported algorithms in
  BootstrapProvider.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  JAVA CLASS LIBS

• Fixed component ID

  620700130

Applicable component levels

• R600 PSY

     UP

• R700 PSY

     UP