Verifying Signed Components

All Orchestra JAR components are signed with a digital signature.

Signing JAR files ensures that the content has not been tampered with since it was signed. This process protects the components from malicious alterations during distribution.

Users can verify that the components have been produced by Soffico GmbH.

For this purpose, Orchestra is shipped with a public key file named public.cert. This file allows users to verify the integrity of all Orchestra components.

Verifying Signed Components

To verify a component, the following prerequisites are required:

1. Java keytool (Shipped with the Java Development Kit)

2. Java jarsigner (Shipped with the Java Development Kit)

3. public.cert file (Shipped with the Orchestra release package)

First, import the Public Key Certificate file into a Java Key Store using the Java keytool:

keytool -import -trustcacerts -alias <alias_of_the_keystore> -file public.cert -keystore <name_of_the_keystore>.jks 

Adjust the variable <alias_of_the_keystore> to match the alias of your existing keystore or choose a name if you want a new keystore to be created.

Adjust the variable <name_of_the_keystore> to match the name of your existing keystore or choose a name if you want a new keystore to be created.

Next, verify a JAR file using the keystore with the imported Soffico Public Key Certificate:

jarsigner -verify -certs -verbose -keystore <name_of_the_keystore>.jks <path_to_some_orchestra_module>.jar

If the component is signed with the private key of Soffico, the jarsigner tool should return a message indicating "jar verified".