docs: public final void verifySingleJarFile(JarFile jf)
              throws IOException, CertificateException, VerifierException {
          Vector entriesVec = new Vector();
  
          // Ensure there is a manifest file
          Manifest man = jf.getManifest();
          if (man == null) {
              throw new VerifierException("The JAR is not signed");
          }
  
          // Ensure all the entries' signatures verify correctly
          byte[] buffer = new byte[8192];
          Enumeration entries = jf.entries();
  
          while (entries.hasMoreElements()) {
              JarEntry je = (JarEntry) entries.nextElement();
              entriesVec.addElement(je);
              InputStream is = jf.getInputStream(je);
              int n;
              while ((n = is.read(buffer, 0, buffer.length)) != -1) {
                  // we just read. this will throw a SecurityException
                  // if  a signature/digest check fails.
              }
              is.close();
          }
          jf.close();
  
          // Get the list of signer certificates
          Enumeration e = entriesVec.elements();
          while (e.hasMoreElements()) {
              JarEntry je = (JarEntry) e.nextElement();
  
              if (je.isDirectory()) {
                  continue;
              }
              // Every file must be signed - except
              // files in META-INF
              Certificate[] certs = je.getCertificates();
              if ((certs == null) || (certs.length == 0)) {
                  if (!je.getName().startsWith("META-INF")) {
                      throw new VerifierException("The JAR file has unsigned files.");
                  }
              } else {
                  // Check whether the file
                  // is signed as expected.
                  // The framework may be signed by
                  // multiple signers. At least one of
                  // the signers must be a trusted signer.
  
                  // First, determine the roots of the certificate chains
                  Certificate[] chainRoots = getChainRoots(certs);
                  boolean signedAsExpected = false;
  
                  for (int i = 0; i < chainRoots.length; i++) {
                      if (isTrusted((X509Certificate) chainRoots[i],
                              trustedCaCerts)) {
                          signedAsExpected = true;
                          break;
                      }
                  }
  
                  if (!signedAsExpected) {
                      throw new VerifierException("The JAR file is not signed by a trusted signer");
                  }
              }
          }
      }