code: private boolean verifyManifestHash(Manifest sf,
                                         ManifestDigester md,
                                         BASE64Decoder decoder,
                                         List manifestDigests)
           throws IOException
      {
          Attributes mattr = sf.getMainAttributes();
          boolean manifestSigned = false;
  
          // go through all the attributes and process *-Digest-Manifest entries
          for (Map.Entry<Object,Object> se : mattr.entrySet()) {
  
              String key = se.getKey().toString();
  
              if (key.toUpperCase(Locale.ENGLISH).endsWith("-DIGEST-MANIFEST")) {
                  // 16 is length of "-Digest-Manifest"
                  String algorithm = key.substring(0, key.length()-16);
  
                  manifestDigests.add(key);
                  manifestDigests.add(se.getValue());
                  MessageDigest digest = getDigest(algorithm);
                  if (digest != null) {
                      byte[] computedHash = md.manifestDigest(digest);
                      byte[] expectedHash =
                          decoder.decodeBuffer((String)se.getValue());
  
                      if (debug != null) {
                       debug.println("Signature File: Manifest digest " +
                                            digest.getAlgorithm());
                       debug.println( "  sigfile  " + toHex(expectedHash));
                       debug.println( "  computed " + toHex(computedHash));
                       debug.println();
                      }
  
                      if (MessageDigest.isEqual(computedHash,
                                                expectedHash)) {
                          manifestSigned = true;
                      } else {
                          //XXX: we will continue and verify each section
                      }
                  }
              }
          }
          return manifestSigned;
      }
docs: See if the whole manifest was signed.