Jeff,
Thanks for all your research on this subject.
I've been tangentially involved with JAR files ever since they first came
around. I helped Tom Dell with the first implementation of Netscape's jar signing tool right after I started at Netscape in 1996. The specifications
for JAR files are found in various places on Netscape and Sun web sites,
and on third party sites. You can find one of the oldest specs here:
http://developer.netscape.com/docs/manuals/signedobj/jarfile/index.html
Notice the first diagram in that document. The order in which the manifest.mn file and other files are placed in the JAR has been unchanged since the early days. Officially, the order shouldn't matter, but ever since the beginning the manifest file was the first one placed.
Sun's spec is here: http://java.sun.com/j2se/1.3/docs/guide/jar/jar.html
Now, apparently, beginning a couple years ago, mozilla requires the .[rd]sa files to be first. As far as I'm concerned, that's a bug in mozilla. The versions of mozilla that require that are incompatible with nearly ALL the jar files made before that. Different JAR signing tools are free to put the files in the order they wish. mozilla should be compatible with all of them. I'll mention it to Doug T tomorrow.
The patch you wrote will do what you apparently want it to do, namely put the .[dr]sa file first in the META-INF directory. You're welcome to use that patch all you want. But I think the right thing for mozilla is to fix the jar parsing code, so that the file order doesn't matter.
/Nelson _______________________________________________ mozilla-crypto mailing list [EMAIL PROTECTED] http://mail.mozilla.org/listinfo/mozilla-crypto
