Missing signed entry in resource : urgent

Question

Hi
While trying to acces my apllication on Tomcat 4.0 Servber I get this error
Missing signed entry in resource: http://localhost:8080/Graf/GZ.jar
exception is
JNLPException[category: Download Error : Exception: null : LaunchDesc: null ]
at com.sun.javaws.security.SigningInfo.checkSigning(Unknown Source)
at com.sun.javaws.cache.DownloadProtocol$RetrieveAction.actionDownload Unknown Source)
at com.sun.javaws.cache.DownloadProtocol.doDownload(Unknown Source)
at com.sun.javaws.cache.DownloadProtocol.getResource(Unknown Source)
at com.sun.javaws.LaunchDownload.downloadJarFiles(Unknown Source)
at com.sun.javaws.LaunchDownload.downloadEagerorAll(Unknown Source)
at com.sun.javaws.Launcher.downloadResources(Unknown Source)
at com.sun.javaws.Launcher.handleApplicationDesc(Unknown Source)
at com.sun.javaws.Launcher.handleLaunchFile(Unknown Source)
at com.sun.javaws.Launcher.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
My jnlp file looks like
<?xml version="1.0" encoding="UTF-8"?>
<jnlp codebase="http://localhost:8080/Graf/" href="GrafZeppelin.jnlp">
<information>
<title>Graf Zeppelin</title>
<vendor>P&G</vendor>
<homepage href="GrafZeppeling.html"/>
<description>Graf Zeppelin</description>
<description kind="short">Grap Zeppelin Application to display Graf Zeppelin</description>
<description kind="one-line">Graf Zeppelin System</description>
<description kind="tooltip">P&G</description>
<icon href="images/gpblogo.jpg"/>
<offline-allowed/>
</information>
<security>
<all-permissions/>
</security>
<resources>
<j2se version="1.3+" initial-heap-size="24m" max-heap-size="256m" />
<jar href="y.jar"/>
<jar href="GZ.jar"/>
</resources>
<application-desc main-class="pathways.GZBase">
</application-desc>
</jnlp>
I have already done sigining of jar thru these commands
keytool -genkey -keystore myKeystore -alias myself
keytool -list -keystore myKeystore
jarsigner -keystore myKeystore test.jar myself
Can anypone tell me if something elase also needs to be done for this to make it work.I mean some other settings or something which I might be missing while deploying it.
Thanks
Sidh

Answer 1

I just got done spending some "quality time" (about 2 days worth) with jarsigner and Java Web Start to figure out a certificate problem, and I thought I'd share my findings to save others a bunch of time.
I have a JWS application that has two custom built jars and several third party jars. I'm looking to run it in "unrestricted" mode which means that all of the jars need to be signed. The building and signing went fine but I ran into the problems often mentioned in this forum of exceptions being thrown from the bowels of JWS while it was trying to launch my application.
I ran into a few different problems at different times. One was getting this exception during launch:
JNLPException[category: Download Error : Exception: null : LaunchDesc: null ]
     at com.sun.javaws.security.SigningInfo.checkSigning(Unknown Source)
     at com.sun.javaws.cache.DownloadProtocol$RetrieveAction.actionDownload(Unknown Source)
     at com.sun.javaws.cache.DownloadProtocol.doDownload(Unknown Source)
     at com.sun.javaws.cache.DownloadProtocol.getResource(Unknown Source)
     at com.sun.javaws.LaunchDownload.downloadJarFiles(Unknown Source)
     at com.sun.javaws.LaunchDownload.downloadEagerorAll(Unknown Source)
     at com.sun.javaws.Launcher.downloadResources(Unknown Source)
     at com.sun.javaws.Launcher.handleApplicationDesc(Unknown Source)
     at com.sun.javaws.Launcher.handleLaunchFile(Unknown Source)
     at com.sun.javaws.Launcher.run(Unknown Source)
     at java.lang.Thread.run(Thread.java:536)
Another was an exception that included the message "Missing signed entry in resource".
The source of all of these problems was an incorrectly created/signed jar file. My problems occured with jakarta-ojb-0.9.7.jar (Jakarta's OJB package), but I believe that it can happen with any jar file.
First let me review what I found out about how the jar building and signing is done. When you sign a jar file with jarsigner, it creates signature files which it puts in the META-INF directory of the jar file. For example if you sign a jar file with the alias "foo", it will add files FOO.SF and FOO.DSA to the META-INF directory (your extensions may be slightly different depending on what kind of keys you have).
jarsigner also creates a new manifest file META-INF/MANIFEST.MF. For my jar file, before I signed it the MANIFEST.MF contained only this:
Manifest-Version: 1.0
Created-By: Apache Ant 1.5
Name: ojb
Class-Path:
After I signed it, the file had 675 entries in it like this:
Manifest-Version: 1.0
Created-By: Apache Ant 1.5
Name: org/apache/ojb/broker/metadata/RepositoryTags.class
SHA1-Digest: bX/beup+4fwyuMQIF9sz55wz3Zk=
Name: org/apache/ojb/odmg/states/ModificationState.class
SHA1-Digest: xl0iS4ojhVh8pHwzabKK9T2ouLg=
Name: org/apache/ojb/jdo/JDOTransaction.class
SHA1-Digest: Z/EV2WgDPVbHkY3D78mOIjLyLI0=
Name: org/apache/ojb/broker/util/pooling/WrappedConnection.class
SHA1-Digest: B3r6HwsWePdNkMYh8jIeBmfjrUc=
Here is where the problems begin. Here is one known bug that I did not have but you should be aware of, which has to do with paths that have 133 or 134 characters:
http://developer.java.sun.com/developer/bugParade/bugs/4357504.html
Another problem is as follows. When JWS reads the manifest file from each jar file, it iterates through all of the manifest entries and for each one, verifies that there is an entry in the jar file for it. Here is the code decompiled from javaws version 1.2 to give you an idea:
Manifest manifest = jarfile.getManifest();
Set set = manifest.getEntries().entrySet();
for(Iterator iterator = set.iterator(); iterator.hasNext();)
java.util.Map.Entry entry = (java.util.Map.Entry)iterator.next();
String s1 = (String)entry.getKey();
if(jarfile.getEntry(s1) == null)
throw new JARSigningException(url, s, 4);
The problem is that the manifest can sometimes contain entries that are intended as headers like this:
Name: ojb
Class-Path:
This fragment was created by the application that created the original jar file (ant), and was included in the new manifest file created by jarsigner. Inexplicably, this fragment was about one third the way down the 2228 line file, rather than at the top where you would expect it.
When JWS iterates through the manifest entries, it finds this one named "ojb", and then it tries to find an entry in the jar file with this key, and fails, which throws the JARSigningException, which causes the application launch to fail. Unfortunately JWS doesn't give you any of this detail in the error message, I had to discover this through a lot of sleuthing (and so will yoU!).
JWS just uses the java.util.jar classes to read the jar and manifest files, so it is simple to write a small utility that reads jar and manifest files and reports on them to help you identify problems like this. Note that using the -verify flag to jarsigner doesn't find many problems. Below is a utility I wrote called GrokJar:
import java.io.*;
import java.util.*;
import java.util.jar.*;
public class GrokJar {
public static void main(String s[]) {    
String action = s[0];
if(!action.equals("-j") && !action.equals("-m")) {
System.err.println("Usage: GrokJar [-j | -m] file");
System.err.println("\t-j grok a jar file");
System.err.println("\t-m grok a manifest file");
System.exit(0);
String pathname = s[1];
if(action.equals("-j")) {                             
try {                                                
File jarFile = new File(pathname);
JarFile jar = new JarFile(jarFile);
Manifest manifest = jar.getManifest();
Set set = manifest.getEntries().entrySet();
System.out.println("Manifest has " + set.size() + " items");
for(Iterator iterator = set.iterator(); iterator.hasNext();) {
java.util.Map.Entry entry = (java.util.Map.Entry)iterator.next();
String key = (String)entry.getKey();
if(jar.getEntry(key) == null) {
System.out.println("Can't get entry from jar for key \""+key+"\"");
} catch(Throwable t) {
t.printStackTrace();
else if(action.equals("-m")) {                     
try {              
Manifest manifest = new Manifest(new FileInputStream(pathname));
Set set = manifest.getEntries().entrySet();
System.out.println("Manifest has " + set.size() + " items");
} catch(Throwable t) {
t.printStackTrace();
This utility reported the following for my jar:
Manifest has 675 items
Can't get entry from jar for key "ojb"
The solution to my problem was as follows:
1) First, make a copy of the unmolested jar file before you mess around with it (by default jarsigner modifies a jar file in place)
2) Sign the jar file with jarsigner
3) Run the GrokJar utility to discover any errant keys
4) If there are errant keys, un-jar the jar file into a temporary directory
5) Edit the file META-INF/MANIFEST.MF to remove the errant keys
6) Create a new jar file. Note that simply "jar cf" won't work. By default, the jar utility creates a new manifest file, which will overwrite the one you just edited. you need to either include the "m" parameter and specify your manifest file, or the "M" file so it won't create its own manifest file and it will use the one you edited.
7) Sign the jar file again with jarsigner. The reason is that jarsigner creates a signature for every entry in the manifest. If you sign it and then edit the manifest, the signature and manifest won't match. So you need to sign it again.
8) Run GrokJar against it again, and you should see a different number of manifest entrieS (not zero), and no errant keys.
That is what did it for me. Your mileage may vary. Here are some other links to good information that I found:
http://www.vamphq.com/download/jwsfaq.pdf
http://developer.java.sun.com/developer/bugParade/bugs/4625532.html
http://developer.java.sun.com/developer/bugParade/bugs/4357504.html
http://forum.java.sun.com/thread.jsp?thread=206075&forum=38&message=697559
Best of luck!
Randy