Add command to show details about a signed object #307
Conversation
|
I'm adding support for this because sometimes I have some old binaries and need to check whether they were signed and with which certificates. Additionally it would be useful to be able to verify if the signature is valid: #59 |
|
Thank you for the PR. Verification is long overdue, I haven't got the time to complete the work unfortunately. I wonder if a |
It's useful to know whether an executable is already signed and by whom.
Either to make sure that you have properly signed it or to check if
somebody else has signed it.
Example:
```
> java -jar jsign/target/jsign-7.2-SNAPSHOT.jar show foo.exe
jsign show foo.exe
Signature 0
Digest Algorithm: SHA256
Digest Value: c481bb3892d066ffacba0650adaa4c252580b776b1dd6026cf4a8bea6c813939
Is Timestamped? false
Certificate
Subject: CN=net.jsign.signing-cert
Issuer: CN=net.jsign.issuing-cert
Not Before: Fri Dec 03 14:34:46 CST 2021
Not After: Wed May 24 14:34:46 CST 2119
Expired: false
Serial: 148957645726085760686199624248870688956
```
Signed-off-by: Daniel Schaefer <[email protected]>
Sometimes I don't have the signing certificate and I just want to check the signer's subject and timestamp/expiration. |
|
Verifying a signature implies computing the hash of the file and checking the revocation of the certificates. This can take some time, and that makes the "show" command interesting to quickly see the signatures. |
| SignerId signerId = signerInformation.getSID(); | ||
| X509CertificateHolder cert = (X509CertificateHolder) signature.getCertificates().getMatches(signerId).iterator().next(); | ||
|
|
||
| byte[] digest = signable.computeDigest(DigestAlgorithm.of(signerInformation.getDigestAlgorithmID().getAlgorithm())); |
There was a problem hiding this comment.
This is the hash of the file, I think it should be the hash of the message signed
| printSignatures(signable); | ||
| } catch (UnsupportedOperationException | IllegalArgumentException e) { | ||
| throw new SignerException(e.getMessage(), e); | ||
| } catch (Exception e) { |
2 participants
It's useful to know whether an executable is already signed and by whom. Either to make sure that you have properly signed it or to check if somebody else has signed it.
Example: