jarsigner Reviews

Software companies must make it possible for users to trust code, including code published online. Many webpages only contain static information which can be downloaded without risk. Some pages contain controls and programs that can be downloaded and installed on the user's computer. Downloading and running these executable files may be risky. When code is transmitted over the internet, these guarantees are not possible. The Internet cannot guarantee the identity of software creators. It cannot guarantee that software downloaded has not been altered after its creation. Browsers can display a warning message explaining the possible dangers associated with downloading data, but they cannot verify whether code is as it claims to be. To make the Internet a reliable platform for software distribution, a more proactive approach is needed.

Keyfactor Signum protects sensitive keys, automates policy, and integrates signing with your tools and build process. Create and store sensitive private keys in a cloud-based, FIPS 140-2 certified Hardware Security Module (HSM). Define granular policies for accessing and using private signing keys. Authenticate users, build servers and sign with a full audit. Integrate with native signing tools on the platform to protect access to signing keys without changing workflows. Integrate with signing software via lightweight Windows and Linux Agents that can be quickly installed on build servers or developer desktops. Create key attestations to comply with CA/B Forum requirements to verify that the keys are generated and stored in an HSM.