Netlet descriptors are surrounded by the <netlet-descriptor> tag. The signatures, if present, cover the whole <descriptor-content> tag.
Here is an example descriptor:
<!DOCTYPE netlet-descriptor SYSTEM "jtrix.dtd">
<netlet-descriptor version='1.0'>
<!-- expiry is number of seconds since 01/01/1970 GMT -->
<descriptor-content serial='349' starts='98438010' expires='98438030'>
<!-- service ID is optional, but absence may prevent
Node-wide service registration -->
<codebase>
<platform-version>
<java-version>1.2</java-version>
<java-version>1.3</java-version>
<jtrix-version>1</jtrix-version>
</platform-version>
<main-class>Main</main-class>
<parameter-bean encoding="base64">
<!-- serialised parameter bean -->
344394-039504390-adscxbvcre0-igoidf
</parameter-bean>
<jar lazy='true' size="2345653">
<digest algo='SHA1' encoding="base64">fde345678901234567890'</digest>
<!-- this is a hint so Node can find classes quickly -->
<package>com.verisign.cert</package>
<package>com.verisign.ca</package>
<!-- JAR sources -->
<url>http://www2.verisign.net/gd/rt.jar</url>
<url>http://www3.verisign.net/gd/rt.jar</url>
</jar>
<jar size="54365">
<digest algo='SHA1' encoding="base64">fdegddfcb456346dgdszg0</digest>
<package>org.debian.fun</package>
<package>org.debian.spacemaster</package>
<url>http://www.debian.org/gd/sm.jar'</url>
<url>http://www.uk.debian.org/gd/rt.jar'</url>
</jar>
</codebase>
<secret encoding="base64" algo="RC5" name="tagA">
308302dadg9431f
</secret>
</descriptor-content>
<!-- signature over descriptor-content -->
<content-signature>
<!-- X.500-style distinguished name -->
<dn>
<ne name='uid'>prabbit</ne>
<ne name='ou'>development</ne>
<ne name='o'>boOthewstreet</ne>
<ne name='c'>us</ne>
</dn>
<sig encoding="base64" algo='SHA1RSA'>
4909239fs9sd3520534904593089308
</sig>
</content-signature>
<content-signature>
<!-- X.500-style distinguished name -->
<dn>
<ne name='uid'>ulf</ne>
<ne name='ou'>jtrix</ne>
<ne name='o'>hyperlink</ne>
<ne name='c'>uk</ne>
</dn>
<sig encoding="base64" algo='SHA1RSA'>
4909239fs9sd3520534904593089308
</sig>
</content-signature>
<!-- optional, unsigned set of JAR files -->
<codebase-files>
<file>
<!-- the URL ties the file to the descriptor's codebase -->
<url>http://www2.verisign.net/gd/rt.jar</url>
<file-content encoding="base64">
CQENTkFNRToJQ0hSSVMgR1JFU1RZDQ1EQVRFIE9GIEJJUlRIOgkxMCBPQ1RPQkVSIDE5NzANDU5B
VElPTkFMSVRZOglCUklUSVNIDQ1SRVNJREVTOglTVVJSRVkNDVRSQU5TUE9SVDogCUZVTEwgRFJJ
VklORyBMSUNFTkNFDQ1wcmVzZW50IFBPU0lUSU9OOglERVZFTE9QTUVOVCBURUFNIExFQURFUg0N
cmVxdWlyZWQgcG9zaXRpb246CUpBVkEgREVTSUdORVIvREVWRUxPUEVSDQ1wcmVzZW50IFNBTEFS
WToJozM3LDUwMA0NUkVRVUlSRUQgU0FMQVJZOgmjNTAsMDAwIChORUdPVElBQkxFIE9OIFJPTEUp
DQ1ub3RpY2U6CTQgV0VFS1MNCQ0NDVByb2Zlc3Npb25hbCBRdWFsaWZpY2F0aW9ucw1NaWNyb3Nv
ZnQgQ2VydGlmaWVkIFNvbHV0aW9ucyBEZXZlbG9wZXIgKE1DU0QpIJcgSnVseSAxOTk5DQ1FZHVj
YXRpb24gKDE5ODcglyAxOTkzKQ0xOTg3LTg5IJcgNSBBLUxldmVscyCXIE1hdGhzIChBKSwgRnVy
dGhlciBNYXRocyAoQSksIFBoeXNpY3MgKEEpLCBFY29ub21pY3MgKEIpLCBHZW5lcmFsIFN0dWRp
ZXMgKEEpDTE5ODktOTIglyBEdXJoYW0gVW5pdmVyc2l0eSCXIEJTYyBIb25zIE1hdGhlbWF0aWNz
LCBDbGFzcyBJSS9pDTE5OTItOTMglyBTaGVmZmllbGQgVW5pdmVyc2l0eSCXIE1TYyAoRW5nLikg
Q29udHJvbCBTeXN0ZW1zDSANDQ0NU1VNTUFSWQ0gDSoqIDIgWUVBUlMgQ09NTUVSQ0lBTCBKQVZB
IERFVkVMT1BNRU5UICoqDQ1DaHJpcyBpcyBzZWVraW5nIGEgcG9zaXRpb24gYXMgYSBKYXZhIERl
c2lnbmVyL0RldmVsb3BlciB3aXRoIGEgZm9yd2FyZC1sb29raW5nIGNvbXBhbnkuICBIZSBpcyBs
b29raW5nIHRvIHV0aWxpc2UgdGhlIEphdmEvT08gc2tpbGxzIGhlIGhhcyBidWlsdCB1cCBvdmVy
</file-content>
</file>
</codebase-files>
</netlet-descriptor>