Signing a jar file with a java program

Hello folks,
It's easy to create a jar file with a java programm, but can I sign it as well with pure java code or do you have to invoke jarsigner?
Regards
Der Hinterwaeldler

Well J2SE 1.x supports ZipOutputStream (jar's are zips with a META-INF/MANIFEST.MF file) and www.bouncycastle.org has API's for signing etc.
So in theory you could take a directory or an existing jar and make a jar and sign it.
The only question is the format on how to sign them properly. I wouldn't be suprised if someone already wrote an API for this format. For example BouncyCastle supports S/MIME and PGP, but I don't know what is the format for jars.

Similar Messages

Running a .jar with a java program on unix

I am trying to run a jar file with this java code but when i run it, it comes up with built successfully but the file doesn't run.
ps- I use a unix os
public class Main {
public static void main(String args[]) throws IOException, InterruptedException {
// first method i tried:
Runtime.getRuntime().exec( new String[] {"/bin/sh", "-c",
"/Users/cb/NetBeansProjects/MultiCalc/dist/MultiCalc.jar output.out ascii workload2.trace 0"});
//second method i tried:
ProcessBuilder pb = new ProcessBuilder( new String[] {"/bin/sh", "-c",
"/Users/cb/NetBeansProjects/MultiCalc/dist/MultiCalc.jar"});
pb.redirectErrorStream( true );
pb.start();
thanks a lot in advance!

javalavaguava-- wrote:
I am trying to run a jar file with this java code but when i run it, it comes up with built successfully but the file doesn't run.
ps- I use a unix os
public class Main {
public static void main(String args[]) throws IOException, InterruptedException {
// first method i tried:
Runtime.getRuntime().exec( new String[] {"/bin/sh", "-c",
"/Users/cb/NetBeansProjects/MultiCalc/dist/MultiCalc.jar output.out ascii workload2.trace 0"});
//second method i tried:
ProcessBuilder pb = new ProcessBuilder( new String[] {"/bin/sh", "-c",
"/Users/cb/NetBeansProjects/MultiCalc/dist/MultiCalc.jar"});
pb.redirectErrorStream( true );
pb.start();
thanks a lot in advance!I don't see any mention of 'java' when trying to execute the jar file. You have to specify which application should process a jar file - it doesn't magically know to use java.
P.S. You should read the 4 sections of [http://www.javaworld.com/javaworld/jw-12-2000/jw-1229-traps.html|http://www.javaworld.com/javaworld/jw-12-2000/jw-1229-traps.html] and implement ALL the recommendations.

Signing JAR file with DSA algorithm

Hi everybody,
I need to sign my JAR file with DSA algorithm.
Can anybody explain how to generate certificate for this and how to sign using DSA algorithm.
Thanks.

Well J2SE 1.x supports ZipOutputStream (jar's are zips with a META-INF/MANIFEST.MF file) and www.bouncycastle.org has API's for signing etc.
So in theory you could take a directory or an existing jar and make a jar and sign it.
The only question is the format on how to sign them properly. I wouldn't be suprised if someone already wrote an API for this format. For example BouncyCastle supports S/MIME and PGP, but I don't know what is the format for jars.

Problem Signing midlet .jar file.

Hi,
Step - 1 :
======
- I have created a keystore first like.
- c:> keytool -genkey -alias <alias> -keystore c:/abcd.sks -keyalg RSA*
o/p : So it created a keystore.
Step - 2:
======
- I imported my certificate from Verisign into the keystore..
- keytool -import -alias <alias> -keystore c:/abcd.sks -file <CompanyCert.cer>
o/p : The certificate imported successfully.
Problem :
=======
Problem occurs at the time of signing the jar file with jarsigner
jarsigner Myjar.jar <alias>
o/p :Jar is signed and It says, "your certificate will expire in six months". But our certificate has an expiry in 2011.
Also when the jar file installed in the mobile, it occurs as an invalid application.

The following may help you..
JavaJar(written by java) can compress and decompress jar,war, ear and.zip...
it can deal with manifest file and executable .jar file .specially.
may download from http://www.qwerks.com/download/4114/JavaJar.zip
the tool is very verygood tool.
but the homepage(www.pivotonic.com) of JavaJar cannot be accessed.
it is funny.
good lucky.

Exporting a jar file with its libraries

Hi there,
I have problem while exporting jar files with Eclipse.My program uses db2driver libraries and i want to make stay these library files while exporting the main program but there is no choice to make it like that. And when i execute my program jar file it throws a class not found exception for db2drivers ...
How can i pack the jar files with my program jar?
Thanks for help.

Hi Peter,
I made the changes but still got the problem...
here is my .classpath file:
<?xml version="1.0" encoding="UTF-8"?>
<classpath>
<classpathentry kind="src" path="src"/>
<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER"/>
<classpathentry exported="true" kind="lib" path="db2jcc_license_cu.jar"/>
<classpathentry exported="true" kind="lib" path="db2jcc.jar"/>
<classpathentry kind="output" path="bin"/>
</classpath>
when i execute my jar file it throws a ClassNotFoundExeption for DB2Drivers which are in db2jcc.jar ...(my startng class is at src package)
Thanks..

How to run jar file with classpath?

Hi, all,
I have some package in my project, with which I have a java help jar file as classpath, when I run my project, I need the jh.jar file in directory /jar/jh.jar.
Now, I bundled all my class packages into a jar file, my.jar, together with the /jar directory. When i run my jar file with command:
java -jar my.jar
It tells me couldn't find javahelp class.
What shall I do? How can I create my jar file with the jh.jar?
Thanks in advance.

Thanks, hjembaek,
But it doesn't work for me. I am running in windows, it still generate the error:
Exception in thread "main" java.lang.NoClassDefFoundError: javax/help/HelpSet
at own.gui.OwnMenuToolBar.getOwnHelpBroker(OwnMenuToolBar.java:560)
at own.gui.OwnMenuToolBar.addHelpMenu(OwnMenuToolBar.java:327)
at own.gui.OwnMenuToolBar.getOwnMenuBar(OwnMenuToolBar.java:188)
at own.gui.OWNDPTool.initGui(OWNDPTool.java:55)
at own.gui.OWNDPTool.<init>(OWNDPTool.java:39)
at own.gui.OWNDPTool.main(OWNDPTool.java:100)
Here is my command to generate the jar file:
jar cfm Own.jar temp.txt help own log others
temp.txt is the file including the main class and class path information
I have help folder, log folder and own package, others is directory that has the jar file(others/jh.jar)

ServiceBus java callout - how to pack the JAR file with libraries?

Hello
I want to use a Java Callout from a Service Bus flow.
What is the correct way to pack the JAR file with its nessecary libraries?
I tried different methods to pack my JAR, but yet, as though the Java runs perfectly from the Workshop (Eclipse) , when I am trying to use the exported Jar on the ServiceBus flow, it fails with an ClassNotFoundException.
I would really appreciate your advice here.
Thanks
Koby

Well.. Looking inside my exported JAR file, I got all of the files there inside, including the jar file containing the library.
What I'm trying to do is run a simple java program that connect through SSH and therefore use an SSH library.
On the workshop I got it as an imported library JAR. And it works perfectly there.
Any idea?
Here's the complete error I get:
<BEA-382515> <Callout to java method "public static java.lang.String sshpackage.SshProg.remoteScriptInvoke(java.lang.String,java.lang.String,java.lang.String,java.lang.String)" resulted in exception: null
java.lang.reflect.InvocationTargetException
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at stages.transform.runtime.JavaCalloutRuntimeStep$1.run(JavaCalloutRuntimeStep.java:158)
Truncated. see log file for complete stacktrace
java.lang.NoClassDefFoundError: ch/ethz/ssh2/Connection
at sshpackage.SshProg.remoteScriptInvoke(SshProg.java:29)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
Truncated. see log file for complete stacktrace
java.lang.ClassNotFoundException: ch.ethz.ssh2.Connection
at weblogic.utils.classloaders.GenericClassLoader.findLocalClass(GenericClassLoader.java:283)
at weblogic.utils.classloaders.GenericClassLoader.findClass(GenericClassLoader.java:256)
at java.lang.ClassLoader.loadClass(ClassLoader.java:306)
at com.bea.wli.sb.resources.archive.HookedJarClassLoader.loadClass(HookedJarClassLoader.java:251)
at java.lang.ClassLoader.loadClass(ClassLoader.java:251)
Truncated. see log file for complete stacktrace
Edited by: kobyssh on 04:12 01/02/2010

Signing Bouncy Castle or third party provider's jar file with signtool

Hi,
I am using JDK 1.4.2 and bouncy castle as a provider for RSA.
It worked fine until recently when my company asked me to compile and build the jar from the source code from bouncy castle, instead of using the binary version provided in their website.
But I only have a certificate obtained from Verisign. So I used signtool 1.3 from netscape to sign the jar file, which could be verified by jarsigner. But when use this one signed by my company's certificate. it didn't work. The exception is
java.security.NoSuchAlgorithmException: Cannot find any provider supporting RSA/
ECB/PKCS1Padding
at javax.crypto.Cipher.getInstance(DashoA6275)
When I switch back to the signed jar file provided by bouncy castle, everything worked ok again.
It looks that jar file is not recognized properly.
Can anyone tell me if I can use the signtool to sign the provider's jar file? Or I have to sign with jarsigner?
Thanks for the help.

Thanks for your reply.
I am reluctant to use the lightweight crypto API
becaues it will be difficult to switch to anther
service provider.True. However, if you switch to another Provider, you'll have the same trouble you're having with BC regarding rebuilding from source.
In BC's website, they don't have "cleanroom" JCE
listed for JDK 1.4
Can you give some resource for that?Hmmm - no, I can't. I haven't needed the cleanroom impl, so I stopped paying attention to it. I do't know if BC is working on a 1.4-compatible one or not. You might post a note to the dev-crypto mailing list BC runs.
Can I sign BC's jar file by my JCE certificate if I
obtain one from SUN?Unless you're recognized by Sun as a company that does significant security development, you will NOT get a security-signing cert. Several of us have already made the attempt.
The net is, what your bosses are asking for is unreasonable, and is preventing you from getting your job done. If they continue to insist that you build your security code from source, then your CANNOT use the JCE structure, period. In that case, you might as well use the BC lightweight API.
Grant

Help Signing a JAR File

I currently have the j2sdk1.4.2_04 and j2re1.4.2_04 installed on my computer along with NetBeans 3.6. Do I need any other tools to be able to sign JAR files? Many websites say that I need "jarsigner" utility bundled along with JDK1.2/1.3 and "keytool" utility bundled along with JDK1.2/1.3. Is this true? Where can I get the appropriate files to download so that I can proceed?

If you have the j2sdk installed, you already have the jarsigner and keytool utility programs. You don't need any other tools to sign JAR files.
Instructions for generating keys and signing a jar file can be found from the security tutorial: http://java.sun.com/docs/books/tutorial/security1.2/toolfilex/sender.html

Problems Signing a Jar File.

Hi Everyone
I'm having problems signing a jar file.
The applet in the jar file was previously signed by Duke.
Now I want to re-sign it with my company name.
So I unzip the jar file. I was careful to remove the manifest and the Duke .sa and .rsa. I re-signed it with the netscape signtool.
The applet works. It presents the prompt that it is signed by my company. I grant session. Then another prompt appears and it says it is signed by duke.
but i was careful to remove the duke signature and manifest file when i unzipped it. Is it possible that the fact that it is signed by duke is stored in the bytecode ??
It is using the <object tag by the way.
<OBJECT classid="clsid:CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA"
     WIDTH = "100%" HEIGHT = "50" border="0"
     codebase="http://www.homework911.com/java/j2re-1_3_1_02-win.exe#Version=1,3,1,2">
     <PARAM NAME = "CODE" VALUE = "com.s.SApplet"/>
     <PARAM NAME = "CODEBASE" VALUE = "/_phone"/>
     <PARAM NAME = "type" VALUE="application/x-java-applet;version=1.3"/>
stev

great suggestion - there are no other signed jar files on the browser for it to access. There is a winzip file but it has no rsa/dsa and signature file in it.
perhaps it is accessing something else that was signed by duke ?
Would it be possible for it to connect to a server program that was signed by duke and therefore present the prompt. ?
I'm trying to get the original unsigned classes and see if i can recompile and sign it just in case then name duke is in byte code.
any other thoughts as to what this code be ?
stephen

How to handle 2 or more .jar files with an applet

Hey out there
I have created an ftpClient application that uses "jakarta ftpClient". It works fine as an JFrame application � But when I converted the Application into an JApplet I get the following Exception:
java.lang.NoClassDefFoundError: org/apache/commons/net/ftp/FTPClient
I have bundled the main application into a .jar file (Application,jar). But I don't know how to handle the 2 jakarta .jar files with my JApplet??
I Tried to append the 2 jakarta .jar files to the Application,jar with the following code:
jar cvf Application.jar 1.class 2.class�. commons-net-1.4.1.jar jakarta-oro-2.0.8.jar
But with the same result / Exception (I have signed the Jar file!)
Can anyone help me

Hi i have a question with your application can you down- or upload more files at the same time? Because i'm having problems with my ftp application.
Here is the link with my problem maybe you can help me. I will be very pleased when you can help me.
http://forum.java.sun.com/thread.jspa?threadID=5162042&tstart=0
Thx
Satanduvel

Signing a jar file

Guys, I've googled the crap out of this one. I need some help signing a jar file.
Here is what I'm doing:
1. Generating a key:
keytool -genkey -keystore myKeyStore -alias myName2. Trying to sign the jar file:
jarsigner -keystore myKeyStore -storepass myPassword -keypass myNamePassword myJar.jar myNameHere is the error I'm getting:
jarsigner error: java.lang.RuntimeException: keystore load: Invalid keystore formatI'm using Ubuntu Linux.
I wrote and built my project with Netbeans.
Any ideas?

Here is what the latest process looks like. What am I doing wrong?
thomasaaron@ubuntu:~/Desktop$ keytool -genkey -alias thomasaaron -keystore myKeyStore
Enter key store password: password1
Enter key password for <thomasaaron>: password2
You are about to enter information that will be incorporated into
your certificate request. This information is what is called a
Distinguished Name or DN. There are quite a few fields but you
can use supplied default values, displayed between brackets, by just
hitting <Enter>, or blank the field by entering the <.> character
before hitting <Enter>.
Common Name (hostname, IP, or your name): Thomas Aaron
Organization Name (company) [The Sample Company]: Tom's Company
Organizational Unit Name (department, division): Tom's Department
Locality Name (city, district) [Sydney]: TommyLand
State or Province Name (full name) [NSW]: Colorado
Country Name (2 letter code) [AU]: US
thomasaaron@ubuntu:~/Desktop$
thomasaaron@ubuntu:~/Desktop$
thomasaaron@ubuntu:~/Desktop$ jarsigner -storepass password1 -keystore myKeyStore SupportManager.jar thomasaaron
jarsigner error: java.lang.RuntimeException: keystore load: Invalid keystore format

Packaging jar file with classes

Hi experts,
I want to clarify a problem in relation with packaging .class files in jar file making
it jar executable.I was able to achieve this when number of classes are limited and confined to only a single program.However recently i developed a software
which is very much like SQL*Plus and retriee my company database using screen buffer management and i have handled almost all the issues.
But so long to execute this program i am typing
java <Program name>.It is using Oracle as backend.
I tried to package Oracle driver files in jar using
jar -cmf manifest.mf sqlpad.jar *.class Oracle\
where Oracle directory contains all the class files in separate folders like
Oracle\javax etc
I get a jar file with hefty MBs size.It is executable too.But when i try to connect to
database, i get message Oracle driver class is not found.
In what way should i package it as jar file ?

I wouldn't add the drivers to the JAR itself. Instead, I'd suggest one of the following:
1.) Add classpath entries into your manifest file pointing to the drivers' JARs
2.) Create a batch file for starting that contains a call to "java -classpath ..."
3.) Add some way to your app to configure additional classpaths at runtime and use a URLClasssLoader (and a wrapper class for the driver for registering with the DriverManager) that loads the driver's class

Webstart : sign a jar file

I have a desktop app that has to access local data files as well as network database server. At the moment, I have a executable jar file now when I try to run it with Webstart it complains about unsigned jar file asking for full access on a file. what do i need to sign a jar file. the jar file as is will work when someone double clicks the file icon but if the computer is not set up for java to open jar files, most likely if you have winzip , it will open the jar file. So other than the sdk what else do i need
Thanks in advance

thanks that was helpfull , but, I found a page on the suns web page which i found using another serch engine . I couldnt find it by searching this website.
I apprectiat you taking the time, thanks

Simply signing a *.jar file make applet able to read Client PC?

If I simply sign my jar file, which is supposed to open a JFileChooser, and make a default web page that loads the jar as an applet supposed to grant all permisions? I tried this, and the applet pops up the "grant permisions". However the JFileChooser won't pop up?
what if I put a .policy file online in the same directory, could this help or be modified to?

Fractalz wrote:
. . . Now that's the part I have been facing difficulties, cuz I have to include all the classes that the applet is using from other jar
files. And I can not come up with a way to find out all those classes.See the Class-Path: parameter (of a Manifest file) documentation here:
http://java.sun.com/javase/6/docs/technotes/guides/jar/jar.html#Manifest-Overview

Signing a jar file with a java program

Similar Messages

Maybe you are looking for