code: public CodeSigner[] verify(Hashtable<String, CodeSigner[]> verifiedSigners,
                  Hashtable<String, CodeSigner[]> sigFileSigners)
          throws JarException
      {
          if (skip) {
              return null;
          }
  
          if (signers != null)
              return signers;
  
          for (int i=0; i < digests.size(); i++) {
  
              MessageDigest digest  = digests.get(i);
              byte [] manHash = manifestHashes.get(i);
              byte [] theHash = digest.digest();
  
              if (debug != null) {
                  debug.println("Manifest Entry: " +
                                     name + " digest=" + digest.getAlgorithm());
                  debug.println("  manifest " + toHex(manHash));
                  debug.println("  computed " + toHex(theHash));
                  debug.println();
              }
  
              if (!MessageDigest.isEqual(theHash, manHash))
                  throw new SecurityException(digest.getAlgorithm()+
                                              " digest error for "+name);
          }
  
          // take it out of sigFileSigners and put it in verifiedSigners...
          signers = sigFileSigners.remove(name);
          if (signers != null) {
              verifiedSigners.put(name, signers);
          }
          return signers;
      }
docs: go through all the digests, calculating the final digest
  and comparing it to the one in the manifest. If this is
  the first time we have verified this object, remove its
  code signers from sigFileSigners and place in verifiedSigners.