JAR signing
im using JTWAIN to do an applet to scan images then save it to the web server... so i have to sign the JARS? my java commands only work in my java/bin dir so i have to copy my jars there. sign the, and copy them back. would this cause problems? what the correct way to sign them? is there some easy way to do this through netbeans? how do i know if ive done this correctly
http://java.sun.com/developer/technicalArticles/Security/Signed/
Similar Messages
-
Applets, Policy Files, jar signing, JNI, etc
Hi,
I need an Applet to be able to connect to sockets and use some JNI. Hence, as far as I can tell, I need to use a Policy File. In a standalone application, I have written my policy file tried it out by switching on the security manager. However I am not sure how I do this with an applet.
I have read many examples of Jar signing, yet every example uses appletviewer and the -J-Djava.security.policy to show the security policy in action.
However I want this to work through a normal browser, so how do I achieve this?
Do I specify a URL to the java.security.file in the embed/object/applet tags in the HTML?
Do I put the policy file in the jar and reference it via the Manifest?
Any ideas much appreciated,
John BThe standard AccessControlException:
java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:270)
at java.security.AccessController.checkPermission(AccessController.java:401)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:542)
at java.lang.ClassLoader.getParent(ClassLoader.java:701)
Or something like that.
That's what I'm trying to solve, I wish to use the Java Security Policy system to allow my applet access to various resources, such as writing files. Now I've seen that signing an applet will give it full access (in my view, this is rather insecure, but anyway), however following the steps to sign an applet two or three times has still presented me with the same problem. The signing is ignored, and the exception is thrown.
Applet signing aside, I fail to see any documentation stating how the policy file is used by the VM when running on a browser. I assumed it might be an entry in the Jar's manifest file, but again, I can find no documentation.
It's all very annoying, and Sun have done quite a bad job at documenting this. For example, their example talkes about -D-Jjava.security.policy=.... being passed to appletviewer. Who on earth uses appletviewer! If policies only work with that, then they are useless. I want them to work with whatever browser the applet is being run within.
Surely this isn't too much to ask? :) -
Need some advices on jar signing
Hi, our's company project will have an app server and some desktop apps.
App server - tomcat, desktop - are just some application.jar.
The question is how server may know if the data is from our application.jar or from any thirdparties? May jar signing solve this or there is another way.
P.S. There will be no Java Web Start
Thanks in advance.1) If you can mount those disks on your database server then YES you can store the RMAN backups of those. You must NFS Mount the disks on your DB server so that RMAN can see them put the bakcups on them. Or you can directly write to the tapes.
2) No, Flash recovery area is only one parameter pointing to one mounted space and you can't spread it over multiple volumes. What is the size of your database?
Daljit Singh -
Hi,
My requirement is to bring a set of files from the server to the client thru JApplet..
(Japplet,jdk1.3,weblogic,jre1.3) is the environment.
I know that the jar file has to signed etc.. but is there any way by which i can accomplish this
without jar signing..
If it is not possible, is there any way to test the jar signing (any trial version etc).I just want to
test it before buying the Verisign etc..
Could any one help me on this...
ThanksCan we customize sign_webutil.bat to do this?Yes, you can. Only be careful to webutil password
-
hi,
i want to use some jar file as :
http://forms.pjc.bean.over-blog.com/article-1830062.html
but need to sign and i don't know how to sign .
plz help for sign .Thanks for the response. I looked over getting JAR signing to work, but this applet is being hosted on the local machine and that process required an online URL. Knowing that my command line argument was wrong helped a lot though, I eventually loaded up the policytool program and got the syntax I needed for the policy file.
grant codeBase "file:/C:/WINDOWS/java/classes/Client_2.0/classes/Client/*" {
permission java.security.AllPermission;
}; -
Jars signed with revoked certificate
Hello,
I have a situation here where i have jars and wars which were signed using jarsigner. The certificate used to sign the jars is now revoked.
When java runtime loads these jars, it does not throw any errors/exceptions. Is it the right behavior ?
Is there any way by which I can configure java runtime to contact the CRL and to throw an error while the jar is loaded. The certificate has information
about CRL distribution point and also has authorityinfo access details. I tried configuring OCSP in java.security file. But still no luck.
Any information on this will be helpful.
Thanks in advanceHello EJP,
Thanks for replying.
Yes the certificate was valid when the jar was signed. Please note that, there was no timestamp put in the signature.
So now after the certificate has been revoked, if Java runtime tries to load that jar, isn't it the responsibility of Java runtime to make use of the CRL/OCSP information
of the public key certificate (present in the jar put by the jarsigner when signing) and validate it for revocation ? (Also, in this scenario, what happens if OCSP is enabled in java.security ?) -OR--- Is it the responsibility of the code that makes use of the jar, to verify whether the certificate used for jar signing has been revoked or not ?
PS:- I have enabled the security settings in java control panel for certificate revocation checking.
Please let me know if I am wrong or if I am missing something.
Also i noticed something with jarsigner. In a signed jar, If i delete a few files and then verify its signature using jarsigner, "jar verified" is returned as result. Isn't the jar tampered when I delete a few files from it ? and hence the Hash of its data changes ? and hence verification should fail ?
One more question, in case of signed applets, if the certificate is revoked, as soon as the browser tries loading the applet, it throws an error saying certificate that was used for signing has been revoked. (provided browser settings and java control panel settings are all properly set). Is this check initiated by the browser OR Java runtime ?
Thanks a lot -
Can anyone help me with this error:
keytool error: java.lang.Exception: Key pair not generated, alias <####> already existsCheck whether there is a file named ".keystore". If yes, delete this file and again try to sign the jar file.
Hope it helps u... -
Hello,
I am now trying to sign my jars so that they get past WebStart security qualifications.
I already have a .spc certificate from VeriSign.
What do I do with it/how do I use it?
How do I sign my jars?
thanks in advance,
-ssOnce you have the certificate from Verisign you need to put it into a keystore using the following command:
keystore -import -alias <your alias> -file <your file from verisign>
You may also have to specify the keystore using "-keystore <keystore>" unless you're using the default.
Now that you have the cert in a keystore, you can use jarsigner to sign a jar file.
jarsigner <jar file> <your alias>
The <your alias> should be the same for both commands. The jarsigner also has an option for specifying a keystore, "-keystore <keystore>", which is only needed if you're not using the default.
Hope that helps. You should also take a look at the tools documentation for your jvm:
http://java.sun.com/j2se/1.3/docs/tooldocs/tools.html
-Rob -
Jar signing problem? (continue with HOST PJC)
<1> I've sign jar-file on Oracle9iAS server.
<2> First form (with bean from that jar-file) loading asked me for "Granting", and after it runs without problem, bean is worked prefectly.
<3> Second form loading shows me nothing, just explorer hanging.
I've check JInitiator (1.3.1.9) Control Panel, Certificates tab... there is now any records. Maybe there is problem.
(I also have(installed) Sun JSDK 1.4.1_01)
Java Console also doesn't show any errors.
Again form with bean doesn't loading at the second time.
What is the problem ?
Thank YouHave you read the paper on Signing JAR files for JInitiator 1.3 - it details some changes that you'd be advised to make to your HTML template and the HOST bean code to get around this problem..
-
Jar signing returns "jar is unsigned"
Hi all, i am been trying to sign a jar, because i nedd an applet to access and update a database.
What i've done was:
keytool -genkey -alias MYALIAS -keypass mypass -keystore MYKEYSTORE -storepass mykeystorepass
and then
jarsigner -keystore MYKEYSTORE -storepass mykeystorepass -keypass mypass -signedjar SGID.jar GID.jar MYALIAS
The result of >jarsigner -verify SGID.jar
is
jar is unsigned. (signatures missing or not parsable)
Why is this returning that the jar is unsigned? I think 've created this correctly, if you can find any error or probable cause, please tell me.
Thanks.
Edited by: nfteodoro on Nov 27, 2009 3:01 AM
Edited by: nfteodoro on Nov 27, 2009 3:03 AMI just tried again, here my result, so you can see if something is wrong or missing:
1 - C:\Sun\SDK\jdk\bin>keytool -genkey -v -keyalg dsa -alias MYALIAS -keypass mypass -keystore MYKEYSTORE -storepass mykeystorepass
What is your first and last name?
[Unknown]: MYNAME
What is the name of your organizational unit?
[Unknown]: SCCM
What is the name of your organization?
[Unknown]: MYCOMPANY
What is the name of your City or Locality?
[Unknown]: LISBON
What is the name of your State or Province?
[Unknown]: LISBON
What is the two-letter country code for this unit?
[Unknown]: LX
Is CN=NOESIS, OU=SCCM, O=NOESIS, L=LISBON, ST=LISBON, C=LX correct?
[no]: YES
Generating 1.024 bit DSA key pair and self-signed certificate (SHA1withDSA) with
a validity of 90 days
for: CN=NOESIS, OU=SCCM, O=NOESIS, L=LISBON, ST=LISBON, C=LX
[Storing MYKEYSTORE]
2 - C:\Sun\SDK\jdk\bin>jarsigner -keystore MYKEYSTORE -storepass mykeystorepass -key pass mypass GID.jar MYALIAS
Warning:
The signer certificate will expire within six months.
3 - C:\Sun\SDK\jdk\bin>jarsigner -verify GID.jar
jar is unsigned. (signatures missing or not parsable)
So, as you can see, this really is not working for me :s
I've tried different approaches, an none worked, why can't i sign a .jar file??..this is really weird, i thought creating an applet to access and manipulate a database wouldn't be so dificult..
I guess i was wrong.. -
Jar Signing // Missing Digest entries
I have a signed jar's manifest file which does not contain all of the classes ( digest entries) archived in the jar. Shouldn't this be one to one -jar classes to digest entries? Is there a reason why some classes are omitted, whereby others are included? I receive a NoClassDefFoundError when the applet loads when attempting to run a static method from a class which does not have a digest entry. The class throwing the exception is in the same jar as the applet, yet in a different package. Version: 1.6.0_15.
Edited by: rapunzel on Feb 20, 2010 4:46 AMI just tried again, here my result, so you can see if something is wrong or missing:
1 - C:\Sun\SDK\jdk\bin>keytool -genkey -v -keyalg dsa -alias MYALIAS -keypass mypass -keystore MYKEYSTORE -storepass mykeystorepass
What is your first and last name?
[Unknown]: MYNAME
What is the name of your organizational unit?
[Unknown]: SCCM
What is the name of your organization?
[Unknown]: MYCOMPANY
What is the name of your City or Locality?
[Unknown]: LISBON
What is the name of your State or Province?
[Unknown]: LISBON
What is the two-letter country code for this unit?
[Unknown]: LX
Is CN=NOESIS, OU=SCCM, O=NOESIS, L=LISBON, ST=LISBON, C=LX correct?
[no]: YES
Generating 1.024 bit DSA key pair and self-signed certificate (SHA1withDSA) with
a validity of 90 days
for: CN=NOESIS, OU=SCCM, O=NOESIS, L=LISBON, ST=LISBON, C=LX
[Storing MYKEYSTORE]
2 - C:\Sun\SDK\jdk\bin>jarsigner -keystore MYKEYSTORE -storepass mykeystorepass -key pass mypass GID.jar MYALIAS
Warning:
The signer certificate will expire within six months.
3 - C:\Sun\SDK\jdk\bin>jarsigner -verify GID.jar
jar is unsigned. (signatures missing or not parsable)
So, as you can see, this really is not working for me :s
I've tried different approaches, an none worked, why can't i sign a .jar file??..this is really weird, i thought creating an applet to access and manipulate a database wouldn't be so dificult..
I guess i was wrong.. -
Is there a document out there explains signing the webutil jar files on Unix?
SandySandra,
there steps are the same, except for that the batch file that is shipped with webutil need to be translated into a shwll script. Because the signing happens with the Java jarsigner utility, the commands are the same. You can also sign webutil.jar on Windows and tehn copy the jar files to Unix.
Frank -
Why isn't jnlp.jar signed by Sun?
The jnlp.jar in the developer pack is not signed with Sun's certificate. Why is that? An omission or intentional?
If I'm delivering my app signed with my Verisign cert, I have to now deliver jnlp.jar also signed with my cert, right?
Thx,
MaxThe jnlp.jar is part of Java Web Start, so no - you don't have to sign and supply it, the JWS install takes care of it for you.
Cheers,
Gavin -
Folk'ses,
I have just done my first JNLP stuff, and I am experiencing a very strange problem:
my application launch works just fine but only every 2nd time!
I alternatingly get the following error: {color:#ff0000}Unable to launch the application.{color}
{noformat}And the details state: {color:#ff0000}JAR resources in JNLP file are not signed by same certificate{color}{noformat}
I perform the exact same operation again without changing anything in between, and hey presto, my application is launched.
Following is my JNLP file:
<?xml version="1.0" encoding="utf-8"?>
<!-- JNLP File for Session Client -->
<jnlp spec="1.0+" codebase="http://oneclickserver9/CONTINUITY" href="/CONTINUITY
/licensing.jnlp">
<information>
<title>CONTINUITY Licensing</title>
<vendor>ICS GmbH</vendor>
<homepage href="index.jsp"/>
<description>CONTINUITY License View</description>
<description kind="short">CONTINUITY</description>
<icon href="continuity.log.gif"/>
</information>
<security>
<all-permissions/>
</security>
<resources>
<property name="sun.awt.noerasebackground" value="true"/>
<j2se version="1.6.0_07" href="http://java.sun.com/products/autodl/j2se"
initial-heap-size="64m" max-heap-size="256m" java-vm-args="-Duser.name
=kloeber"/>
<jar href="lib/IcsLicenseView.jar" main="true"/>
<jar href="lib/global90.jar" download="lazy"/>
<jar href="lib/ssorb90.jar" download="lazy"/>
<jar href="lib/ssorbutil90.jar" download="lazy"/>
<jar href="lib/utilapp90.jar" download="lazy"/>
<jar href="lib/util90.jar" download="lazy"/>
<jar href="lib/utilsrv90.jar" download="lazy"/>
<jar href="lib/utilnet90.jar" download="lazy"/>
<jar href="lib/vbhelper90.jar" download="lazy"/>
<jar href="lib/vbjorb.jar" download="lazy"/>
<jar href="lib/lm.jar" download="lazy"/>
<jar href="lib/jsafeJCEFIPS.jar" download="lazy"/>
</resources>
<a... [Show more]BS,
thanx for your reply:
You might want to check how the referenced resources/JARs are signed on the serverI do the signing "manually" in a for loop over all jar files:
for f in *.jar; do echo $f; jarsigner -keystore G:/Keystore/continuityKeystore -storepass XXXX -keypass +YYYYY+ $f +ZZZZ+; done
are they getting generated/signed dynamically every time you access the JNLP?no, see above
Could it be possible that different requests be served by different web servers (may be in a cluster)?no, I only have one tomcat server running -
The following link says that the public key that corresponds to the private key used to sign the JAR is placed in the JAR, along with its certificate.
http://java.sun.com/docs/books/tutorial/deployment/jar/intro.html
I have a couple of questions: are both the public key and certificate in the DSA file? (The document makes it seem like the public key and its certificate are separate - but doesn't the certificate contain the public key its certifying?)
Are the only 2 ways the public certificate trusted is if the public certificate is imported into the "cacerts" file or into another keystore specified in the jarsigner -verify command? (In the cacerts case you could just omit options relating to the keystore?)
Why are the SHA1-Digest values different in MANIFEST.MF and the SF file for a given file within the JAR?
What's the difference between the SHA1-Digest-Manifest and SHA1-Digest-Manifest-Main-Attributes values in the SF files?
Thanks.I know some answers:
1. Yes, public key is inside the certificate, in DSA file
2. AFAIK, if the certificate is signed by someone in the cacerts file, it's OK
3. In MANIFEST.MF, hash value is for file content. In SF file, hash value is for the section in MANIFEST.MF
4. SHA1-Digest-Manifest-Main-Attributes is the hash value for the header part of MANIFEST.MF
You can find out all the details by reading the source codes in OpenJDK.
BTW, Are you going to write a jarsigner yourself?
Maybe you are looking for
-
Why am I unable to change text color from black in LR5 book module?
Why am I unable to change text color from black in LR5 Book Module?
-
Sound in system and Rhythmbox is scratchy and skips
Two problems. Since a few hours ago, the sound on my system and in Rhythmbox has been *extremely* scratchy. I'm playing mp3 files through Rhythmbox, and in the system, the terminal beep is also quite scratchy. However, the scratches aren't present in
-
I've got a portlet with an edit JSP that allows the user to set some portlet settings. The edit JSP uses a form defined with the tag <portlet:form event="bea.portal.framework.internal.refresh" >. This in essence allowed the edit JSP to submit the for
-
PSA showing Request not updated to any data target using delta
Hi BWers, I am very new to SAP and have a IDES installed with BW. I am trying to do a simple data load from a flat file. I have managed to create a InfoPackage, but when I schedule it and then go into the data source -> manage and look at the screen
-
Cannot create SQL database with free trial subscription
Hello, I get the error message 'The operation is not supported for your subscription offer type.' when trying to create a sql database with my free trial subscription. Regards Julian