Signed Jars from Sun?

Question

I also posted this topic in the "Security General" forum. Please write your answers there. Thank you!
Hello,
why are the jars provided by Sun for the different Java technologies not signed with a trusted certificate from Sun?
I have the requirement that my WebStart enabled application must run in privileged mode, but then all resources including for example the ejb.jar must be signed.
I know that I could easily run the jarsigner tool myself on the ejb.jar but this would probably evoke legal problems: My company can't claim authorship for a piece of software built by Sun.
My personal opinion is, that this makes the utilizability of WebStart for commercial products highly questionable.
sanostol

Answer 1

It dosnt make utilizability of WebStart for commercial products highly questionable - It's up to your company to ensure your code is signed with their own key, and to ensure nothing has been tampered with - if a user downloads something from your site that proceeds to wipe their disk or perform a denial of service attack on Microsoft for that matter that's your liability.
You have to understand that all the jars in a web start app currently have to be signed by the same key, furthermore each jar cannot be signed more than once. Were Sun to sign their jars we'd all be having to unpack to remove the signatures, re-jar the contents and sign with out own keys again - it's often a royal pain when third party jars come signed.
We can get around this by making these third-party jars a separate <part> each having its own jnlp file, but this is more work and if this part needs security settings the user will be prompted about wether they want to install every indivdual jar in your app - defiantly not desirable. Currently we have this with JavaHelp which frustratingly does come signed, and needs at least client-privs to allow users to print pages.
- Richard