Verifying Release Signatures

© 2026 Obsvra. This document describes SpiceGrinder and is provided to help you evaluate and use it. It is not a license to reproduce, adapt, or use this material to build a competing product or service. Full terms: the SpiceGrinder EULA.

Every SpiceGrinder release jar (spicegrinder-<version>-free.jar / spicegrinder-<version>-pro.jar, whether you got it as a standalone jar or unzipped it from inside a jpackage app-image) is signed with SpiceGrinder’s own code-signing certificate. This is a self-signed certificate, not one issued by a public certificate authority — see “What this does and doesn’t prove” below for exactly what that means. The short version: it lets you confirm a jar you have is byte-for-byte what was actually signed and shipped, not a copy someone modified afterward.

The certificate

The public certificate is spicegrinder-codesign.pem, shipped alongside this doc in every release. Its fingerprints, so you can confirm you have the right one without even importing it:

SHA256: C9:F2:68:03:01:6C:98:87:72:78:11:67:E9:2D:19:D5:AE:2E:DB:A5:2C:78:5B:F0:0B:AF:31:DF:22:8C:B4:35
SHA1:   5B:C7:11:5E:7A:78:1C:0E:A8:33:BB:BB:E7:AF:FB:99:57:EB:76:29

Owner: CN=SpiceGrinder Code Signing, O=Obsvra, C=US. Valid 2026-08-21 through 2036-08-18.

Quick check

Two commands, both part of every JDK, neither needs the certificate file:

jarsigner -verify -verbose -certs spicegrinder-1.0.0-pro.jar

Confirms the jar hasn’t been altered since signing. Look for jar verified and a line naming CN=SpiceGrinder Code Signing, O=Obsvra, C=US. If any entry had been tampered with, this fails outright instead.

keytool -printcert -jarfile spicegrinder-1.0.0-pro.jar

Prints the signing certificate’s actual fingerprints. Compare the SHA256/SHA1 lines it prints against the ones published above — if they match, the jar was signed with SpiceGrinder’s real certificate, not a substitute.

If any class in the jar had been altered after signing, jarsigner -verify fails outright, and the JVM itself refuses to load the tampered class at runtime with a SecurityException — this isn’t just a check you can run manually, it’s enforced automatically every time the jar runs.

What this does and doesn’t prove

Does prove: the jar you have matches exactly what was signed under this certificate. Tampering after signing — a modified .class file, a swapped-in malicious component, anything — breaks the signature and both jarsigner -verify and the JVM’s own class loading will say so.

Does not prove, on its own: that this certificate itself was issued by an independently-verified “SpiceGrinder” identity the way a certificate from a public CA (DigiCert, Sectigo, etc.) would be. This is a self-signed certificate — nobody but SpiceGrinder vetted it. The trust anchor is this page: you’re trusting that the fingerprint published here, on SpiceGrinder’s own site/repo, is the real one. If you obtained a jar from somewhere other than an official SpiceGrinder source and want independent identity assurance (not just tamper-detection), that’s a real limitation of a self-signed certificate — cross-check the fingerprint against multiple official channels rather than relying on this page alone.