DownloadService.loadResource for external jars for 1.6.0-19+

Question

First, be kind with my english, i'm french (nobody's perfect...)
I have a JNLP into which i declare a signed jar resource main.jar. This application retreive at execution a list of signed jar names (+a.jar, b.jar+...) that i dynamically load on my need through DownloadService.loadResource. My a.jar, b.jar are cached and it rules! But if i made a new main.jar, a.jar and b.jar, and deploy them on my server, here what's happend:
- main.jar is tested for modification date on server (thanks to "If-Modified-Since" HTTP header), cache date is before this date, so JWS update main.jar by downloading this new main.jar. This is the behaviour described into specs and it is perfect for me!
- but for others resources (a.jar, b.jar) i was excpected the same behaviour but JWS does not seems to check for modification date. So a.jar and b.jar are not updated.
So my first question: Is there a way to tell to DownloadService.loadResource to check for modification date? i could deal with jar version but this basic date checking was great for me...
Except this cache minor problem, external jar download works just fine except i get the warning security problem [Mixing Signed and Unsigned Code |http://java.sun.com/javase/6/docs/technotes/guides/jweb/mixed_code.html].
All my jars are signed with the same certificate, so i was a bit confused.
Anyway, i follow indications and put the Trusted-Only: true attribut into the manifest of main.jar.
But it leads to this exception:
java.lang.SecurityException: Trusted-Only loader attempted to load sandboxed resource from http://monserveur/a.jar
     at com.sun.deploy.security.CPCallbackHandler$ParentCallback.check(Unknown Source)
     at com.sun.deploy.security.CPCallbackHandler$ParentCallback.access$1400(Unknown Source)
     at com.sun.deploy.security.CPCallbackHandler$ChildElement.checkResource(Unknown Source)
     at com.sun.deploy.security.DeployURLClassPath$JarLoader.checkResource(Unknown Source)
     at com.sun.deploy.security.DeployURLClassPath$JarLoader.getResource(Unknown Source)
     at com.sun.deploy.security.DeployURLClassPath.getResource(Unknown Source)
     at java.net.URLClassLoader$1.run(Unknown Source)
     at java.security.AccessController.doPrivileged(Native Method)
     at java.net.URLClassLoader.findClass(Unknown Source)
     at com.sun.jnlp.JNLPClassLoader.findClass(Unknown Source)
     at java.lang.ClassLoader.loadClass(Unknown Source)
     at java.lang.ClassLoader.loadClass(Unknown Source)
     at my.package.a$5.run(a.java:348)
     at java.lang.Thread.run(Unknown Source)I found some posts that deal with similar problems but it does not give me a working solution. The difference seems to be the fact that i load external jars (not defined into JNLP).
My JNLP is validated though JaNeLA.
I cannot set a.jar, b.jar as resources into jnlp because i retreive their location during execution...
My JNLP also declare:
<security>
        <all-permissions/>
</security>I think i'm a bit confused with the sandbox notion and the Trusted-Only: true attribut of the manifest. I also tried to add it to a.jar, b.jar and not main.jar but vainly. I also tried to set it on all jars but it does not work better.
Is there a way to load external jar without having the Mixing Signed and Unsigned Code warning popup? What do i not well understand?
Sorry to be so chatty...
Thanks in advanced for any answer.

Answer 1

So, I finally succed in finding a solution.
But this solution seems perhaps a barbarian way to solve my problem but it works.
The idea (as far as i understand) is that when you define "all-permission" into JNLP file, then these permission are granted for JNLP ClassLoader. When you load external jar through DownloadService.loadResource, then another classloader is used. It seems that this classloader does not inherit security policy from JNLP ClassLoader.
My solution is to define my own policy:
Policy.setPolicy(getAllPermissionPolicy());
    * @return a {@link Policy} with all permission granted
   private Policy getAllPermissionPolicy()
      Policy policy = new Policy() {
         private PermissionCollection m_permissionCollection;
         @Override
         public PermissionCollection getPermissions(CodeSource p_codesource)
            return getAllPermissionCollection();
         @Override
         public PermissionCollection getPermissions(ProtectionDomain p_domain)
            return getAllPermissionCollection();
          * @return an AllPermissionCollection
         private PermissionCollection getAllPermissionCollection()
            if (m_permissionCollection == null)
               m_permissionCollection = new AllPermission().newPermissionCollection();
               m_permissionCollection.add(new AllPermission());
            return m_permissionCollection;
      return policy;
   }For sure, you can decline this with permission you need. Here, all permission are allowed.
I'm not quite satisfied because it's seems to be a barbarian style solution. But for now, it fits my uses => no warning popup!
If anybody has a more proper way to deal with such an issue, i'll be glad to hear it!
Hope it helps.