public byte[] fromFile(File file) throws IOException {
   InputStream fis = null;
   BufferedInputStream bis = null;
   try {
     fis = new FileInputStream(file);
     bis = new BufferedInputStream(fis);
     return fromInputStream(bis);
   } finally {
     LauncherUtils.close(bis);
     LauncherUtils.close(fis);
   }
 }
  public byte[] fromZipContents(File file) throws IOException {
    SignatureList list = new SignatureList();
    InputStream fis = null;
    ZipInputStream zip = null;
    try {
      fis = new FileInputStream(file);
      zip = new ZipInputStream(fis);

      ZipEntry entry;
      while ((entry = zip.getNextEntry()) != null) {
        list.add(entry.getName(), fromInputStream(zip));
      }

      return list.toDigest();
    } finally {
      LauncherUtils.close(zip);
      LauncherUtils.close(fis);
    }
  }
 /**
  * Attempt to verify that a file is signed.
  *
  * @param in input stream
  * @param ext file extension
  * @throws SecurityException throw on verification failure
  * @throws IOException on I/O error
  */
 public void verify(InputStream in, String ext) throws SecurityException, IOException {
   try {
     if (ext.equalsIgnoreCase("jar") || ext.equalsIgnoreCase("zip")) {
       verifyJar(in);
     } else {
       throw new SecurityException("Not sure how to verify the signature for '" + ext + "'");
     }
   } finally {
     LauncherUtils.close(in);
   }
 }
  /**
   * Attempt to verify that a Jar file is signed. All files (aside from ones in META-INF) must be
   * signed and trusted.
   *
   * @param in input stream
   * @throws SecurityException throw on verification failure
   * @throws IOException on I/O error
   */
  @SuppressWarnings("resource")
  public void verifyJar(InputStream in) throws IOException {
    JarInputStream jarFile = null;

    try {
      jarFile = new JarInputStream(in);
      Manifest manifest = jarFile.getManifest();
      if (manifest == null) {
        throw new SecurityException("The given file was not digitally signed");
      }

      // Ensure all the entries' signatures verify correctly
      byte[] buffer = new byte[8192];
      JarEntry entry;
      while ((entry = jarFile.getNextJarEntry()) != null) {
        if (entry.isDirectory()) continue;

        do {} while (jarFile.read(buffer, 0, buffer.length) != -1);

        Certificate[] certs = entry.getCertificates();
        if (isMetaInf(entry.getName())) {
          continue;
        } else if (certs == null || certs.length == 0) {
          throw new SecurityException("The archive contains files that are not digitally signed");
        } else {
          int i = 0;
          boolean verified = false;
          while (i < certs.length) {
            X509Certificate[] chain = findChain(certs, i);
            try {
              verify(chain);
              verified = true;
              break;
            } catch (SecurityException e) {
            }
            i += chain.length;
          }

          if (!verified) {
            throw new SecurityException(
                "The file(s) are signed by an entity that is not registered as 'trusted' with the launcher");
          }
        }
      }
    } finally {
      LauncherUtils.close(jarFile);
    }
  }