diff --git a/changelog.html b/changelog.html
index 317909825578f99a22cf4eee3c19c4eeba39cee9..1c4167ac169a129d26134840b0cc8a5907143677 100644
--- a/changelog.html
+++ b/changelog.html
@@ -63,6 +63,9 @@ Upcoming changes
+ -
+ Java Web Start binaries weren't signed.
+ (report)
-
Fixed Maven build error if headless option is set and MAVEN_OPTS empty
(issue 10375)
diff --git a/core/src/test/java/jenkins/RemotingJarSignatureTest.java b/core/src/test/java/jenkins/RemotingJarSignatureTest.java
new file mode 100644
index 0000000000000000000000000000000000000000..d223178688a5d9c5496084a03aa7efad20e4a800
--- /dev/null
+++ b/core/src/test/java/jenkins/RemotingJarSignatureTest.java
@@ -0,0 +1,49 @@
+package jenkins;
+
+import hudson.remoting.Channel;
+import hudson.remoting.Which;
+import hudson.util.IOUtils;
+import org.apache.commons.io.output.NullOutputStream;
+import org.junit.Assert;
+import org.junit.Test;
+
+import java.io.File;
+import java.util.Enumeration;
+import java.util.jar.JarEntry;
+import java.util.jar.JarFile;
+
+/**
+ * @author Kohsuke Kawaguchi
+ */
+public class RemotingJarSignatureTest {
+ /**
+ * Makes sure that the remoting jar is properly signed.
+ */
+ @Test
+ public void testSignature() throws Exception {
+ File jar = Which.jarFile(Channel.class);
+// File jar = new File("/home/kohsuke/.m2/repository/org/jenkins-ci/main/remoting/1.421/remoting-1.421.jar");
+// File jar = new File("/home/kohsuke/.m2/repository/org/jenkins-ci/main/remoting/2.0/remoting-2.0.jar");
+ System.out.println("Verifying "+jar);
+
+ JarFile myJar = new JarFile(jar,true);
+
+ Enumeration entries = myJar.entries();
+ while (entries.hasMoreElements()) {
+ JarEntry entry = entries.nextElement();
+ if (entry.isDirectory()) continue;
+
+ // unsigned files that are related to signatures
+ String name = entry.getName();
+ if (name.equals("META-INF/MANIFEST.MF")) continue;
+ if (name.startsWith("META-INF/") && name.endsWith(".SF")) continue;
+ if (name.startsWith("META-INF/") && name.endsWith(".RSA")) continue;
+
+ // make sure bits are signed
+ IOUtils.copy(myJar.getInputStream(entry), new NullOutputStream());
+ if (entry.getCodeSigners()==null) {
+ Assert.fail("No signature for " + name);
+ }
+ }
+ }
+}
diff --git a/pom.xml b/pom.xml
index a362273f7cf5007d80d96b2ae6cca3a95520bf69..485d32bada3a43d38b52b86ce369d60c58d676bd 100644
--- a/pom.xml
+++ b/pom.xml
@@ -133,7 +133,7 @@ THE SOFTWARE.
org.jenkins-ci.main
remoting
- 2.2
+ 2.4