When you sign a JAR file using the tools in the JDK 1.2 software, each file in the archive is given a digest entry in the archive' s manifest . The digest values are hashes or encoded representations of the contents of the files as they were at the time of signing. A file's digest will change if and only if the file itself changes. In version 1.1 of the platform, digest-value entries are added to the manifest when you create the JAR file rather than when you sign it. When a JAR file is signed, a signature file is automatically generated and placed in the JAR file's META-INF directory, the same directory that contains the archive's manifest .
Signature files have filenames with an .SF extension.
As you can see, the signature file contains digest entries for the archive's files that look similar to the digest-value entries in the manifest. However, while the digest values in the manifest are computed from the files themselves, the digest values in the signature file are computed from the corresponding entries in the manifest. When a signed JAR file is being verified, the digests of each of its files are re-computed and compared with the digests recorded in the manifest to ensure that the contents of the JAR file haven't changed since it was signed. As an additional check, digest values for the manifest file itself are re-computed and compared against the values recorded in the signature file. You can read additional information about signature files on the Manifest Format page of the JDK TM documentation.