Is it legal to sign 3rdparty jars?

Is it legal to sign other jars? We sign are application jar files and make use of Webstart. We have open source code being distributed also. per most common licenses GPL,LGPL, Apache.. Do I have the authority to sign those jars? log4j.jar for instance?

Sure there are "jailbreaks" for Symbian but the Q is whether there is any point.
It is not like the Iphone/Ipad which, for any serious user, screams out to be jailbroken because even trivia like adding ringtones are convoluted, requiring several steps followed by using that virus called Itunes whose functionality is impenetrable and which is quite capable of deleting stuff from your phone if you do a sync with a PC which has been synced to a different Iphone (etc etc etc). Then you can use Iphone Explorer to fully explore the device, and avoid Itunes altogether.
With a Symbian phone, having root access would basically allow you to copy across paid-for apps, which in most cases you don't need to do because you can download paid-for (Nokia shop) apps to more than one phone anyway. You don't need to jailbreak a Symbian phone to get access to all data directories (folders), to copy media files to and from, etc. On an Iphone you cannot do this - except in a very restricted manner - unless you jailbreak.
What I would like is to be able to TOTALLY back up my phone (apps and all) so I could simply restore to a newly bought phone if I lost mine. This is not possible and never will be unless Nokia adopt the Apple IOS auto-update model which is not going to happen (for Symbian). Also, any implementation of such a "total backup" would involve a massive tightening up of the whole thing, Apple-DRM-style, which would be a backward step. But with a jailbreak you can do exactly that - a total backup. Except, that is, if you have any apps which are IMEI-locked... like some I had on the E51 and they got orphaned once the company went bust.

Similar Messages

Access Denied Socket Permission Error using 3rdParty jar in webstart

Hi,
I am trying to create a multisocket in my application, and this app is downloaded through webstart,
Following are the things I ve done,
1. I use two jnlp file, one mail jnlp file (say a.jnlp) and the other an extension jnlp file (a_ext.jnlp) which contains the third party jars.
2. I used <security><allpermission/><security/> in both the jnlp files.
3. If I try to create a multisocket in my code that is downloaded through main jnlp i.e. a.jnlp file, then it is working fine.
4. But the problem is, the third party jar which is downloaded throught "a_ext.jnlp" file is trying to create a multisocket
and i am getting the following error,
+java.security.AccessControlException: access denied (java.net.SocketPermission 228.0.0.4 connect,accept,resolve)+
+ at java.security.AccessControlContext.checkPermission(Unknown Source)+
+ at java.security.AccessController.checkPermission(Unknown Source)+
+ at java.lang.SecurityManager.checkPermission(Unknown Source)+
+ at java.lang.SecurityManager.checkMulticast(Unknown Source)+
+ at java.net.MulticastSocket.joinGroup(Unknown Source)+
+ at inria.net.MulticastSession.initialize(MulticastSession.java:143)+
+ at inria.net.lrmp.LrmpImpl.<init>(LrmpImpl.java:105)+
+ at inria.net.lrmp.LrmpImpl.<init>(LrmpImpl.java:89)+
+ at inria.net.lrmp.Lrmp.<init>(Lrmp.java:194)+Please help me.
Note that I dont want to create any policy file, I want some configurations to be done in jnlp files or in the jars, because i cannot create a policy file and copy it manually in each client deployment.

>
And sorry that jnlp is a valid jnlp only, ..>
How do you know? Did you validate it, or are you just guessing?
>
..and it was a typing mistake, ..>So don't retype these things, instead copy/paste them.
>
it is </security> not <security/>>it is also <all-permissions/>, not <allpermission/>
>
and when i start through webstart it is asking for confirmation also, so i think this <security> tag is working fine.>Stop thinking and start validating.
>
But the problem is with security for the 3rdParty jar downloaded through jnlp extension. >So it will be most important to validate that. Note that if this 3rd party extension is signed by the people that supplied it, you should get a second security prompt.
>
... I hope JNLP doesnt check or give permission for the jars downloaded via extension jnlp?>What does that mean?
OTOH, I just noticed you assigned the princely sum of 1 entire duke star for this question. It is obviously of only minor importance to you, so my time is better spent elsewhere.
Good luck with it.

Issue while signing a jar using RSA certificate

Hi,
I am trying to sign a java applet using trusted certificate with the help of Java keytool and jarsigner of JRE1.6. For this I have followed the following steps:
1.Generated key pair in a keystore - keytool -genkeypair -keyalg RSA -alias eaikey -keystore eaikeystore -validity 3650 -keysize 2048
2.Generated CSR using command keytool -certreq -alias eaikey -file eaicert.csr -keystore eaikeystore and send the .csr file to the CA
3.CA has returned the certificate reply (.cer file)that contained a root certificate
4.When I tried to import the certificate using command keytool -import -file eaicert.cer -alias eaicertkey -keystore eaikeystore to keystore, initially it gave me error as Input not an X.509 certificate.So I opened the .cer file in my text editor and removed the texts before the Begin And End Certificate.Then it got imported correctly by running the
5.When I tried to sign the jar using command jarsigner application.jar eaicertkey -keystore eaikeystore
it gave the exception as jarsigner: Certificate chain not found for: eaicertkey. eaicertkey must reference a valid KeyStore key entry containing a private key and corresponding public key certificate chain.
Please help me with the step I am missing here.I doubt I am doing something wrong in the import step.
Thanks in advance.

you can mail me directly to [email protected], and I'll try to help.
no guarenty :-)
Tal
[email protected]

It's urgent : Signing the JAR

In my application there is a applet which tries to open a socket connection on client machine.
And as per JAVA specification it throws a security exception.
Which is absolutely right.
But I want to test this application.
Is there any utility or temporary signing clause which allows me to test the above thing with some limitations like u must have server and client (browser) running on same machine or anything.
Regards,
Sachin.

if you want to test it temporarily, sign the jar and install its certificate on your local machine and feel free to test the Applet. When finished, you can uninstall the certificate. If you need help about Java security, refer to the Java Security tutorial 1.2 at the sun tutorials.
Regards,
Mohammed Saleem

Signing a jar file

Guys, I've googled the crap out of this one. I need some help signing a jar file.
Here is what I'm doing:
1. Generating a key:
keytool -genkey -keystore myKeyStore -alias myName2. Trying to sign the jar file:
jarsigner -keystore myKeyStore -storepass myPassword -keypass myNamePassword myJar.jar myNameHere is the error I'm getting:
jarsigner error: java.lang.RuntimeException: keystore load: Invalid keystore formatI'm using Ubuntu Linux.
I wrote and built my project with Netbeans.
Any ideas?

Here is what the latest process looks like. What am I doing wrong?
thomasaaron@ubuntu:~/Desktop$ keytool -genkey -alias thomasaaron -keystore myKeyStore
Enter key store password: password1
Enter key password for <thomasaaron>: password2
You are about to enter information that will be incorporated into
your certificate request. This information is what is called a
Distinguished Name or DN. There are quite a few fields but you
can use supplied default values, displayed between brackets, by just
hitting <Enter>, or blank the field by entering the <.> character
before hitting <Enter>.
Common Name (hostname, IP, or your name): Thomas Aaron
Organization Name (company) [The Sample Company]: Tom's Company
Organizational Unit Name (department, division): Tom's Department
Locality Name (city, district) [Sydney]: TommyLand
State or Province Name (full name) [NSW]: Colorado
Country Name (2 letter code) [AU]: US
thomasaaron@ubuntu:~/Desktop$
thomasaaron@ubuntu:~/Desktop$
thomasaaron@ubuntu:~/Desktop$ jarsigner -storepass password1 -keystore myKeyStore SupportManager.jar thomasaaron
jarsigner error: java.lang.RuntimeException: keystore load: Invalid keystore format

What is the next step after I signed my jar ?

Hello,
I've signed my jar.
It works but still display before this message :
"The application digital is invalid. Do you want to run the application"
if I say OK, it works but I would like to avoid this "not very funny" message.
I know I have something more to do and related to certificates but to be honest I'm a little bit lost...
Any help are welcome. :o)
Thanks in advance,
Mangeur de foin

Re,
Just to add :
I checked with : jarsigner -verbose -certs -verify myjar.jar and the answer is "jar verified".
And I can access local directories once the jar is launched.
Mangeur de foin

How to sign multiple jar files using the same certificate..?

hi,
I want to run my application using Java Web Start.. i am using around 16 different jar files out of which around 13 are 3rd party component jars. I want to sign these jars using the same certifcate..., i am using the follwing code to sign the jars:
(for the jar file ischeduler.jar)
keytool -genkey -alias signFiles91 -keystore dtss -keypass dtss1351 -dname "cn=dtss" -storepass decisioncraft
jarsigner -keystore dtss -storepass decisioncraft -keypass dtss1351 -signedjar signedischeduler.jar ischeduler.jar signFiles91
keytool -export -keystore dtss -storepass decisioncraft -alias signFiles91 -file ischeduler.cer
keytool -import -alias DCA2 -file ischeduler.cer -keystore Impischeduler -storepass ischeduler
(for the jar file ischedulerclient.jar)
keytool -genkey -alias signFiles92 -keystore dtss -keypass dtss1351 -dname "cn=dtss" -storepass decisioncraft
jarsigner -keystore dtss -storepass decisioncraft -keypass dtss1351 -signedjar signedischedulerclient.jar ischedulerclient.jar signFiles92
keytool -export -keystore dtss -storepass decisioncraft -alias signFiles92 -file ischeduler.cer
keytool -import -alias DCA3 -file ischeduler.cer -keystore Impischeduler -storepass ischeduler
but when i use the above signed jars in my application i get an error saying:
"jars not signed by the same certificate"
can someone plz tel me wher is the error....thanx
andy

Well for mulitple signing of jar files you can use ANT tool. Its easier and faster.
Regarding the present problem -- hmm.. well it looks like you are using 2 different alias names for signing the jar file. Try using the same alias name and that might solve your problem.
regards
Saby

Jar signing returns "jar is unsigned"

Hi all, i am been trying to sign a jar, because i nedd an applet to access and update a database.
What i've done was:
keytool -genkey -alias MYALIAS -keypass mypass -keystore MYKEYSTORE -storepass mykeystorepass
and then
jarsigner -keystore MYKEYSTORE -storepass mykeystorepass -keypass mypass -signedjar SGID.jar GID.jar MYALIAS
The result of >jarsigner -verify SGID.jar
is
jar is unsigned. (signatures missing or not parsable)
Why is this returning that the jar is unsigned? I think 've created this correctly, if you can find any error or probable cause, please tell me.
Thanks.
Edited by: nfteodoro on Nov 27, 2009 3:01 AM
Edited by: nfteodoro on Nov 27, 2009 3:03 AM

I just tried again, here my result, so you can see if something is wrong or missing:
1 - C:\Sun\SDK\jdk\bin>keytool -genkey -v -keyalg dsa -alias MYALIAS -keypass mypass -keystore MYKEYSTORE -storepass mykeystorepass
What is your first and last name?
[Unknown]: MYNAME
What is the name of your organizational unit?
[Unknown]: SCCM
What is the name of your organization?
[Unknown]: MYCOMPANY
What is the name of your City or Locality?
[Unknown]: LISBON
What is the name of your State or Province?
[Unknown]: LISBON
What is the two-letter country code for this unit?
[Unknown]: LX
Is CN=NOESIS, OU=SCCM, O=NOESIS, L=LISBON, ST=LISBON, C=LX correct?
[no]: YES
Generating 1.024 bit DSA key pair and self-signed certificate (SHA1withDSA) with
a validity of 90 days
for: CN=NOESIS, OU=SCCM, O=NOESIS, L=LISBON, ST=LISBON, C=LX
[Storing MYKEYSTORE]
2 - C:\Sun\SDK\jdk\bin>jarsigner -keystore MYKEYSTORE -storepass mykeystorepass -key pass mypass GID.jar MYALIAS
Warning:
The signer certificate will expire within six months.
3 - C:\Sun\SDK\jdk\bin>jarsigner -verify GID.jar
jar is unsigned. (signatures missing or not parsable)
So, as you can see, this really is not working for me :s
I've tried different approaches, an none worked, why can't i sign a .jar file??..this is really weird, i thought creating an applet to access and manipulate a database wouldn't be so dificult..
I guess i was wrong..

There were warnings or errors while signing the jar - webutil

As oracle 10g comes with webutil, i am now trying to configure it with jocob and trying to run webutil_demo form, but I am getting bean not found error, I searched many forums but could not resolve my problem, everything seems to be at its place, but I am also getting error when i try to sign jacob.jar and webutil.jar files.
First is it necessary to sign these files if yes then what cause will be preventing it to be signed.
I am using forms AS 10.1.2, JRE 1.6, on Windows XP,
Looking for help
Thanks
Naveed

Hello,
+"...but I am also getting error ..."+
Are you a developer ? if so, what do you answer to your end-user when he/she calls you saying "I have an error" ?
Francois

Error while signing jacob.jar in FMW 11g

Hi,
after setting the PATH like:
set PATH=C:\Programme\ORACLE11g\Oracle\Middleware\PFRD11g\jdk\bin;%PATH%
while signing the jacob.jar file for the first time after installing 11g Forms in Windows the following error occurs:
C:\Dokumente und Einstellungen\bten>C:\Programme\ORACLE11g\Oracle\Middleware\ins
tances\FRinst\bin\sign_webutil.bat C:\Programme\ORACLE11g\Oracle\Middleware\PFRD
11g\forms\java\jacob.jar
Generating a self signing certificate for key=webutil2...
Keytool-Fehler: java.lang.RuntimeException: Verwendungsfehler: 360 ist kein g³lt
iger Befehl.
There were warnings or errors while generating a self signing certificate. Pleas
e review them.
Backing up C:\Programme\ORACLE11g\Oracle\Middleware\PFRD11g\forms\java\jacob.jar
as C:\Programme\ORACLE11g\Oracle\Middleware\PFRD11g\forms\java\jacob.jar.old...
1 Datei(en) kopiert.
Signing C:\Programme\ORACLE11g\Oracle\Middleware\PFRD11g\forms\java\jacob.jar us
ing key=webutil2...
jarsigner error: java.lang.RuntimeException: keystore load: C:\Dokumente und Ein
stellungen\bten\.keystore (Das System kann die angegebene Datei nicht finden)
There were warnings or errors while signing the jar. Please review them.
C:\Dokumente und Einstellungen\bten>
What is the reason, and how can I solve this?
Thanks Bea

Perhaps you are using old WLST code (used for OSB 10g), with OSB 11g.
The ALSBConfigurationMBean (com.bea.wli.sb.management.configuration.ALSBConfigurationMBean) Interface in the com.bea.wli.sb.management.configuration package in the Oracle Fusion Middleware Java API Reference for Oracle Service Bus includes example code illustrating how to import and export Oracle Service Bus 11g configurations, how to change environment values, how to query resources, and so on. Please find it here -
http://download.oracle.com/docs/cd/E14571_01/apirefs.1111/e15033/toc.htm
Regards,
Anuj

Why need to sign the jar files ????

Hi
Why does i have to sign the jar files to run my app ??
are not another away to run the app???

U just have to sign your jar if your application needs full access to the client-resources.
http://java.sun.com/products/javawebstart/docs/developersguide.html
andreas

Sign jacob.jar In Oracle fusion

Hi,
Forms [32 Bit] Version 11.1.1.6.0 (Production)
I am trying to sign jacob.jar but i can't syntax error.
C:\Program Files\Java\jdk1.6.0_25\bin>C:\Oracle\Middleware\as_1\forms\templates\
scripts\sign_webutil.bat C:\Oracle\Middleware\as_1\forms\java\jacob.jar
regards,
Edited by: kingadmin on May 14, 2012 6:52 PM
Edited by: kingadmin on May 14, 2012 9:55 PM

I am try to solve this problem :
Exception in thread "thread applet-oracle.forms.engine.Main-2" java.lang.NoClassDefFoundError: com/jacob/com/ComFailException
     at java.lang.Class.forName0(Native Method)
     at java.lang.Class.forName(Unknown Source)
     at oracle.forms.handler.UICommon.instantiate(Unknown Source)
     at oracle.forms.handler.UICommon.onCreate(Unknown Source)
     at oracle.forms.handler.JavaContainer.onCreate(Unknown Source)
     at oracle.forms.engine.Runform.onCreateHandler(Unknown Source)
     at oracle.forms.engine.Runform.processMessage(Unknown Source)
     at oracle.forms.engine.Runform.processSet(Unknown Source)
     at oracle.forms.engine.Runform.onMessageReal(Unknown Source)
     at oracle.forms.engine.Runform.onMessage(Unknown Source)
     at oracle.forms.engine.Runform.sendInitialMessage(Unknown Source)
     at oracle.forms.engine.Runform.startRunform(Unknown Source)
     at oracle.forms.engine.Main.createRunform(Unknown Source)
     at oracle.forms.engine.Main.start(Unknown Source)
     at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Unknown Source)
     at java.lang.Thread.run(Unknown Source)
Caused by: java.lang.ClassNotFoundException: com.jacob.com.ComFailException
     at sun.plugin2.applet.Applet2ClassLoader.findClass(Unknown Source)
     at sun.plugin2.applet.Plugin2ClassLoader.loadClass0(Unknown Source)
     at sun.plugin2.applet.Plugin2ClassLoader.loadClass(Unknown Source)
     at sun.plugin2.applet.Plugin2ClassLoader.loadClass(Unknown Source)
     at java.lang.ClassLoader.loadClass(Unknown Source)

Hi guys, is it legal to sign "Terms & conditions" on the iPad with your finger

Hi guys, is it legal to sign "Terms & conditions" on the iPad with your finger?

I recently purchased Steve Adams' book Oracle 8i Internal Services. As mentioned in the other thread, Oracle9i can be downloaded from Oracle e-Delivery website but Oracle8i is not longer available for download. Please see this thread for similar discussion -- Re: oracle 8i and 9i
On the authors website (www.ixora.com.au/scripts) there are scripts which are to be run
in conjunction with the text.
I have done this with 10 XE but it doesn't appear to work so well. On the database
forum I requested (for the princely sum of €5 (for postage and trouble - not for the
product itself)) that I be sent a CD if some kind soul had one lying around.I guess you are referring to this thread -- Re: Getting older versions of Oracle?
I was then informed that this was illegal - I did put "as long as it's legal and above board
and all that" in my original request.
I wish to emphasise that I am doing this to learn - I am not trying to do anything illegal and/or
that would be a breach of Oracle's software licencing terms.
Can any learned person clarifiy if it is acceptable to obtain old versions of Oracle's software
in this manner?Please see this thread for details about Oracle license agreement -- Re: Oracle 11g freeware or shareware
I also believe it is illegal and you have to get the software directly from Oracle or from an Oracle Partner -- You could contact your Oracle Sales representative to confirm.
If you have an access to My Oracle Support (MOS) website and a valid CSI number, you could try to log a SR and ask Oracle Support the Media Pack (though I believe you will be requested to use another version since Oracle8i is no longer supported).
Thanks,
Hussein

Sign the jar problem, HELP

Hi All
Now I can successfully use this command as below and and get the tmpfoo file
appletviewer http://java.sun.com/security/signExample12/signedWriteFile.html
while doing my sign the jar it come out the below message
jarsigner: Certificate chain not found for: duke. duke must reference a valid K
eyStore key entry containing a private key and corresponding public key certific
ate chain.
Also .java.policy file added as below by policytool
grant signedBy "Duke", codeBase "file:/c:/final_project/my.jar" {
permission java.io.FilePermission "<<ALL FILES>>", "read, write, delete, execute";
What can I do now :(

Are you trying to use a self signed certificate or one you obtained from Verisign, etc

Signed jh.jar Problem

I'm deploying my app by java webstart and since it needs to access local resources, I signed my app and other jar files. THe problem now is that when my app loads jh.jar (JavaHelp) from classpath, it says that jh.jar is signed more than once. Is there anywhere I could download a non-signed jh.jar? Thanks

i placed in keystore URL the following "c:\program files\java\jdk1.6_13\jre\lib\security\cacerts "The keystore URL, if points to a file on the local system,. should look like
file:c:/program files/java/jdk1.6_13/jre/lib/security/cacerts

Is it legal to sign 3rdparty jars?

Similar Messages

Maybe you are looking for