EVALUATION

Regression introduced by 6543940.

That fix tries to copy the raw header bytes from the old manifest to the new one. When there's no header, it regards the first jar entry section as it. I've fixed the codes to recognize the empty header, which is defined as the bytes before the first empty line. An empty line can be recognized as two consecutive \r\n, or, \r\n at the beginning.
                                     

EVALUATION

I've taken a look at the jar file. The problem is that it includes an illegal MANIFEST.MF with only "\r\n" inside, and then bad things happened:

1. jarsigner reads it, thinks it already has a manifest, so hasn't created a new Manifest-Main-Attributes for it.

2. when trying to write the entries to the manifest file one by one, jarsigner *removes the first one*, which it believes is the Manifest-Main-Attributes and uses the remaining parts as named sections for jar entries. Unfortunately, the first one is a jar entry, which later doesn't get signed.

Although the problem is due to the illegal MANIFEST.MF, jarsigner can be enhanced to be more robust.
                                     

WORK AROUND

Remove the empty MANIFEST.MF entry from the jar file and sign again.
                                     

EVALUATION

I looked into this a little bit more and found a problem. I downloaded iTextAsian.jar from http://www.geocities.com/itextpdf/ (also attached to this CR) and signed it using jarsigner from JDK 5u14. When I verified it, I noticed that one of the jar entries was not signed/hashed:

         809 Tue Feb 04 16:28:58 EST 2003 com/lowagie/text/pdf/fonts/cjkfonts.properties

jarsigner -verify emits the following warning:

Warning: This jar contains unsigned entries which have not been integrity-checked.

This does not occur if you sign with jarsigner 5u13.
                                     

EVALUATION

I need more information to evaluate this bug report. Please attach at least the following information:

1) The jarsigner command line that you used. Please specify the -verbose option.

2) The output from the jarsigner command, including any errors or exceptions.

3) The iTextAsian.jar that you are signing.

4) Any other information that you think would be useful.