Problems Signing a Jar File.

Hi Everyone
I'm having problems signing a jar file.
The applet in the jar file was previously signed by Duke.
Now I want to re-sign it with my company name.
So I unzip the jar file. I was careful to remove the manifest and the Duke .sa and .rsa. I re-signed it with the netscape signtool.
The applet works. It presents the prompt that it is signed by my company. I grant session. Then another prompt appears and it says it is signed by duke.
but i was careful to remove the duke signature and manifest file when i unzipped it. Is it possible that the fact that it is signed by duke is stored in the bytecode ??
It is using the <object tag by the way.
<OBJECT classid="clsid:CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA"
     WIDTH = "100%" HEIGHT = "50" border="0"
     codebase="http://www.homework911.com/java/j2re-1_3_1_02-win.exe#Version=1,3,1,2">
     <PARAM NAME = "CODE" VALUE = "com.s.SApplet"/>
     <PARAM NAME = "CODEBASE" VALUE = "/_phone"/>
     <PARAM NAME = "type" VALUE="application/x-java-applet;version=1.3"/>
stev

great suggestion - there are no other signed jar files on the browser for it to access. There is a winzip file but it has no rsa/dsa and signature file in it.
perhaps it is accessing something else that was signed by duke ?
Would it be possible for it to connect to a server program that was signed by duke and therefore present the prompt. ?
I'm trying to get the original unsigned classes and see if i can recompile and sign it just in case then name duke is in byte code.
any other thoughts as to what this code be ?
stephen

Similar Messages

Problem Signing midlet .jar file.

Hi,
Step - 1 :
======
- I have created a keystore first like.
- c:> keytool -genkey -alias <alias> -keystore c:/abcd.sks -keyalg RSA*
o/p : So it created a keystore.
Step - 2:
======
- I imported my certificate from Verisign into the keystore..
- keytool -import -alias <alias> -keystore c:/abcd.sks -file <CompanyCert.cer>
o/p : The certificate imported successfully.
Problem :
=======
Problem occurs at the time of signing the jar file with jarsigner
jarsigner Myjar.jar <alias>
o/p :Jar is signed and It says, "your certificate will expire in six months". But our certificate has an expiry in 2011.
Also when the jar file installed in the mobile, it occurs as an invalid application.

The following may help you..
JavaJar(written by java) can compress and decompress jar,war, ear and.zip...
it can deal with manifest file and executable .jar file .specially.
may download from http://www.qwerks.com/download/4114/JavaJar.zip
the tool is very verygood tool.
but the homepage(www.pivotonic.com) of JavaJar cannot be accessed.
it is funny.
good lucky.

How to sign multiple jar files using the same certificate..?

hi,
I want to run my application using Java Web Start.. i am using around 16 different jar files out of which around 13 are 3rd party component jars. I want to sign these jars using the same certifcate..., i am using the follwing code to sign the jars:
(for the jar file ischeduler.jar)
keytool -genkey -alias signFiles91 -keystore dtss -keypass dtss1351 -dname "cn=dtss" -storepass decisioncraft
jarsigner -keystore dtss -storepass decisioncraft -keypass dtss1351 -signedjar signedischeduler.jar ischeduler.jar signFiles91
keytool -export -keystore dtss -storepass decisioncraft -alias signFiles91 -file ischeduler.cer
keytool -import -alias DCA2 -file ischeduler.cer -keystore Impischeduler -storepass ischeduler
(for the jar file ischedulerclient.jar)
keytool -genkey -alias signFiles92 -keystore dtss -keypass dtss1351 -dname "cn=dtss" -storepass decisioncraft
jarsigner -keystore dtss -storepass decisioncraft -keypass dtss1351 -signedjar signedischedulerclient.jar ischedulerclient.jar signFiles92
keytool -export -keystore dtss -storepass decisioncraft -alias signFiles92 -file ischeduler.cer
keytool -import -alias DCA3 -file ischeduler.cer -keystore Impischeduler -storepass ischeduler
but when i use the above signed jars in my application i get an error saying:
"jars not signed by the same certificate"
can someone plz tel me wher is the error....thanx
andy

Well for mulitple signing of jar files you can use ANT tool. Its easier and faster.
Regarding the present problem -- hmm.. well it looks like you are using 2 different alias names for signing the jar file. Try using the same alias name and that might solve your problem.
regards
Saby

Digitally sign a jar file for distribution?

I recently got a jar of mine hosted for client use though a web page.
The problem is that the jar needs to access the internet for several functions. JWS prompts the user for security reasons every time it makes a connection to a new url endpoint. Since one operation alone can hit 56 url's i thought this could be a bit of a hassle to the users.
The solution, as I understand it to be, is to digitally sign the jar file, so the user is prompted once on download.
I found a site ascertia which offers free certificates, but for the life of me I canb not get this to work.n I have seen keytool generate numerous errors, none of which mean anything to me. (too long >59, cant read chain from reply, invalid cert)
Does someone know a clear and thorough tutorial on digital code signing and certs? Or a CA that provides certs for free, and has some instructions to go along?
Thanks so much.
The step i have trouble on is turning the CSR into a cert, and importing the returned cert back into the keystore.

Masterkeedu wrote: !! It worked.
Congratulations. :-)
Masterkeedu wrote: So it's not certified, but is signed.
So as I understand this, it means the end-user has no way to know it was me that truly signed it. But relies on their common sense I suppose.
That is correct. The CA has verified, and is certifying, that you are who you claim to be. If you or I use a 'self signed' certificate, it does not carry the same level of trust. As you might understand already, the dialogs are different between the two certificate types, and some users cannot accept trusted code from an unverified (self-signed) certificate.
I have been meaning to write a page on the differences between the two certificates. It is well worth looking into getting a cert. from a CA.
There was a stage when one of the major CAs were offering 'freemail' certificates that came emblazoned not with your name, but 'free mail' itself. I did not like them because of that, and continue to use a self-signed certificate.

Error not alloving sign my jar file - help needed

hi guys i am getting the following error while trying to sign the jar file.
unable to sign the jar ; jar.util.zip.zip exception: invalid entry compressed size .
i got this while signing the msbase and msutil of MS jdbc jar files.
what am i suppose to do.
I am unable to understand one more thing. Do i need to have both jdbcodbc.dll library and msbase,msutil, mssqlserver jar files to connect using jdbc or its ok if i only have the jar files. I would appreciate if somebody can help me in this regard.
thanks,
ravi.

hi guys i got the problem solved i unzipped the files and zipped them agian. Its working well .
thanks,
ravi.

Signing a jar file

Guys, I've googled the crap out of this one. I need some help signing a jar file.
Here is what I'm doing:
1. Generating a key:
keytool -genkey -keystore myKeyStore -alias myName2. Trying to sign the jar file:
jarsigner -keystore myKeyStore -storepass myPassword -keypass myNamePassword myJar.jar myNameHere is the error I'm getting:
jarsigner error: java.lang.RuntimeException: keystore load: Invalid keystore formatI'm using Ubuntu Linux.
I wrote and built my project with Netbeans.
Any ideas?

Here is what the latest process looks like. What am I doing wrong?
thomasaaron@ubuntu:~/Desktop$ keytool -genkey -alias thomasaaron -keystore myKeyStore
Enter key store password: password1
Enter key password for <thomasaaron>: password2
You are about to enter information that will be incorporated into
your certificate request. This information is what is called a
Distinguished Name or DN. There are quite a few fields but you
can use supplied default values, displayed between brackets, by just
hitting <Enter>, or blank the field by entering the <.> character
before hitting <Enter>.
Common Name (hostname, IP, or your name): Thomas Aaron
Organization Name (company) [The Sample Company]: Tom's Company
Organizational Unit Name (department, division): Tom's Department
Locality Name (city, district) [Sydney]: TommyLand
State or Province Name (full name) [NSW]: Colorado
Country Name (2 letter code) [AU]: US
thomasaaron@ubuntu:~/Desktop$
thomasaaron@ubuntu:~/Desktop$
thomasaaron@ubuntu:~/Desktop$ jarsigner -storepass password1 -keystore myKeyStore SupportManager.jar thomasaaron
jarsigner error: java.lang.RuntimeException: keystore load: Invalid keystore format

Why need to sign the jar files ????

Hi
Why does i have to sign the jar files to run my app ??
are not another away to run the app???

U just have to sign your jar if your application needs full access to the client-resources.
http://java.sun.com/products/javawebstart/docs/developersguide.html
andreas

Is there a way to sign a JAR file programatically?

Is there a way to sign a JAR file programatically?

great! can you give me a short code snippet?
what about signing J2ME MIDlets?

Webstart : sign a jar file

I have a desktop app that has to access local data files as well as network database server. At the moment, I have a executable jar file now when I try to run it with Webstart it complains about unsigned jar file asking for full access on a file. what do i need to sign a jar file. the jar file as is will work when someone double clicks the file icon but if the computer is not set up for java to open jar files, most likely if you have winzip , it will open the jar file. So other than the sdk what else do i need
Thanks in advance

thanks that was helpfull , but, I found a page on the suns web page which i found using another serch engine . I couldnt find it by searching this website.
I apprectiat you taking the time, thanks

Sign a JAR file & PKI card

Can I use the certificates from my PKI card to sign a JAR file? The certificates are X.509 standard compliant.
Many thanks!

On a more serious helpful note... :) Jack up this value in the sign_webutil.bat file... Its defaulted to 360.. I set mine to 5000. Not sure how high it will go...
REM
REM Number of days before this certificate expires
REM
SET VALIDDAYS=5000
REM
REM Signing script starts here...
REM
Message was edited by:
Mark Reichman

Can I progamatically sign a jar file? i.e. w/o jarsigner tool

Hi,
I am new to development and am using Ant to build my packages.
I need to sign the jar files that I produce, and now the only way I know how is with jarsigner.
I'd like to find a way to do the signing within Ant, but can't find one.
Is that possible?
George

I'm having trouble with the opposite: I'm trying to verify a signed jar programmatically.
I've already read this article, and thought that I could do similar things in order to verify.
However, this code uses classes from sun.security.util, and I couldn't find any documentation of this package.
Any suggestion will be greatly appreciated!

Simply signing a *.jar file make applet able to read Client PC?

If I simply sign my jar file, which is supposed to open a JFileChooser, and make a default web page that loads the jar as an applet supposed to grant all permisions? I tried this, and the applet pops up the "grant permisions". However the JFileChooser won't pop up?
what if I put a .policy file online in the same directory, could this help or be modified to?

Fractalz wrote:
. . . Now that's the part I have been facing difficulties, cuz I have to include all the classes that the applet is using from other jar
files. And I can not come up with a way to find out all those classes.See the Class-Path: parameter (of a Manifest file) documentation here:
http://java.sun.com/javase/6/docs/technotes/guides/jar/jar.html#Manifest-Overview

Help Signing a JAR File

I currently have the j2sdk1.4.2_04 and j2re1.4.2_04 installed on my computer along with NetBeans 3.6. Do I need any other tools to be able to sign JAR files? Many websites say that I need "jarsigner" utility bundled along with JDK1.2/1.3 and "keytool" utility bundled along with JDK1.2/1.3. Is this true? Where can I get the appropriate files to download so that I can proceed?

If you have the j2sdk installed, you already have the jarsigner and keytool utility programs. You don't need any other tools to sign JAR files.
Instructions for generating keys and signing a jar file can be found from the security tutorial: http://java.sun.com/docs/books/tutorial/security1.2/toolfilex/sender.html

Signing of jar file

Does it require to be sign the jar file only by a certificate authority?
Will the self signed jars work in final deployment if the user trusts and is OK with it? (or the self signed is only for testing).

Yes, self-signed jars will work in final production, if the user is willing to trust you. Keep in mind that the user will get a message specifically recommending that they not trust you.
Chris

Signing webutil jar files

We are making a install package for our developers here for 10.1.2 forms. We would like to add the final signing of the jar files to the script so after the install is done the developers dont have to do anything to get going. Can we just sign the frmwebutil.jar and jacob.jar once and make them part of the install package for everyone or do those jar files have to be signed on each individual pc? The key is set in sign_webutil.bat and everybody is using the same default key anyway when they do a manual install.

What Im doing is making and an enterprise wide install package for Developer Suite which allows the Developers to click a button and oracle Forms Developer suite will get installed on their pc with the latest patch 10.1.2.2. Someone asked me if we could incorporate the final step of signing the jar files iin the install package so the developers dont have to do that after the install is done. So, I can either write the script so that the two jar files are signed on each pc after the install done or I can just sign them now on my pc, put them in the install package and deploy them to each developer already signed. It would be simpler to just sign them once and give them to each develolper. Will that work or do the jar files have to be signed on each pc after they are deployed. Like I said, when the developers do a manual install of developer suite everybody uses the default key in the sign_webutil.bat file anyway.

Problems Signing a Jar File.

Similar Messages

Maybe you are looking for