Signing class files

Dears,
Is there any possiblity to sign the class files instead of jar files.
Esakki

Hi,
why do you want to sign the class file?
Using a jar file you'll have all the classes into one single file and you'll have all the classes signed, and then you won't need to sign every single class, you'll do once and no more.
Moreover, using the JAR type file, your classes will have smaller size and so they load up faster.
See you

Similar Messages

How to sign a java class file!

My applet program performs file i/o,loadlibrary operations.so i create a jar file which contains the all java class files of my appln and signed this jar file.My applet prgm works fine.
But now my plm is, i should not create a jar file.how to sign class files? if anybody knows,plz help me.....

Why can't you create jar files?

Unable to run a .class file w/ javaw

I created a simple application which uses swing gui.
This application works just fine when I click the "run" button in eclipse.
But as soon as i copy the .class file from the eclipse project folder to somewhere else and try to run it with "javaw myclass" (the filename is myclass.class) nothing happens.
No command not found error, no nothing.
Its like javaw finds and executes the .class and then returns to the command prompt... But I dont see any windows or any sign of my program running.
Thx in advance

When run with just java I get this:
C:\>java myclass
Exception in thread "main" java.lang.NoClassDefFoundError: myclass$1
at myclass.<init>(myclass.java:38)
at myclass.<init>(myclass.java:28)
But I Eclipse it works just fine...
What does Eclipse do that I dont?

URLClassLoader + dynamically loading signed jar files

I have an applet that does not know all of the jar files it will need to load at startup.
I would like to dynamically load these signed jar files using the URLClassLoader, however it does not recognize these jar files as being signed and I get java.security.AccessControlException: access denied errors.
Any suggestions?
Thanks!

Try this classloader for loading the jars, it should to the trick:
import java.net.URL;
import java.net.URLClassLoader;
import java.net.URLStreamHandlerFactory;
import java.security.AllPermission;
import java.security.CodeSource;
import java.security.PermissionCollection;
import java.security.Permissions;
public class AllPermissionsClassLoader extends URLClassLoader {
    public AllPermissionsClassLoader (URL[] urls) {
        super(urls);
    public AllPermissionsClassLoader (URL[] urls, ClassLoader parent) {
        super(urls, parent);
        System.out.println(parent);
    public AllPermissionsClassLoader (URL[] urls, ClassLoader parent, URLStreamHandlerFactory factory) {
        super(urls, parent, factory);
    protected PermissionCollection getPermissions (CodeSource codesource) {
        Permissions permissions = new Permissions();
        permissions.add(new AllPermission());
        return permissions;
}

How to 'deploy' an Applet when class files are on client machine?

Hi all,
I've searched through these forums and I can't find where my specific question has been asked before, so please accept my apologies for any duplication.
I am trying to develop an applet for use on an intranet. (The specific requirement is that the applet must operate a scanner, and upload the scanned images to the database - we want it to be an applet so that it seamlessly integrates with the rest of the web application from the user's POV).
Therefore the applet needs to run outside of the sandbox, but I don't want to go to all the hassle of getting a certificate from Verisign and signing the applet - that doesn't seem like it should be necessary, since there is no problem getting access to the client PC to install the class files by hand!
I have read on this tutorial page that applets "that are loaded from the local file system (from a directory in the user's CLASSPATH) have none of the restrictions that applets loaded over the network do," so I don't think I am barking up the wrong tree:
http://java.sun.com/docs/books/tutorial/deployment/applet/security.html
That is exactly what I want to do! But whenever I try to run the applet, I get a no class definition found exception. However, if I run the applet as a standalone application (using its static main method) then the JRE has no trouble locating the class file - so I know that my CLASSPATH environment variable is set ok.
Therefore I think the problem must be in my JNLP file. This is what mine looks like at present:
<?xml version="1.0" encoding="UTF-8"?>
<jnlp spec="1.0+" codebase="http://localhost:8080/JGNS008" href="http://localhost:8080/JGNS008/scanner-applet.jnlp">
    <information>
        <title>Scanner Applet Prototype</title>
        <vendor>Fooware</vendor>
    </information>
    <resources>
        
        <j2se version="1.6+" href="http://java.sun.com/products/autodl/j2se" />
        <jar href="ScannerApplet.jar" main="false" />
    </resources>
    <applet-desc
         name="Scanner Applet Prototype"
         main-class="uk.co.fooware.ScannerApplet"
         width="72"
         height="20">
     </applet-desc>
     <update check="background"/>
</jnlp>How do I rewrite this so that it doesn't try to download the class files from the network?
Many thanks,
Richard.

richardwild wrote:
..I am trying to develop an applet for use on an intranet. (The specific requirement is that the applet must operate a scanner, and upload the scanned images to the database - we want it to be an applet so that it seamlessly integrates with the rest of the web application from the user's POV).
Therefore the applet needs to run outside of the sandbox, but I don't want to go to all the hassle of getting a certificate from Verisign and signing the applet - that doesn't seem like it should be necessary,.. Code can be digitally signed without a 'verified' certificate from Versign.
..since there is no problem getting access to the client PC to install the class files by hand!
I have read on this tutorial page that applets "that are loaded from the local file system (from a directory in the user's CLASSPATH) have none of the restrictions that applets loaded over the network do," so I don't think I am barking up the wrong tree:
http://java.sun.com/docs/books/tutorial/deployment/applet/security.html
Huh. I had never heard of that, but since I do not have access to my end user's classpath it is not that important to me.
BTW - I am guessing they mean the path indicated by [http://pscode.org/prop/all.html?prop=java.class.path].
And putting classes into JRE folders seems very hackish to me.
That is exactly what I want to do! But whenever I try to run the applet, I get a no class definition found exception. However, if I run the applet as a standalone application (using its static main method) then the JRE has no trouble locating the class file - so I know that my CLASSPATH environment variable is set ok.Huh?
Therefore I think the problem must be in my JNLP file. Huh?!? Why not deploy the applet using a standard applet element? The only way to configure an applet using a JNLP is ..
a) If the applet is intended to be free floating.
b) If the applet is intended to be embedded in a plug-in2 architecture JRE. Why impose that restriction, when it seems unnecessary and unproductive?
Note that the second option is very new, and I would not expect all the things mentioned in the document you linked, to apply equally to JNLP embedded applets. If you want this applet embedded, I suggest you drop the entire JNLP approach and use a standard applet element.

Problem in accessing class file for applet code

I am developing a package in struts frame work.
I place all the java files in action folder and jsp files in jsp folder.In one of the jsp I write code to invoke applet .But I am getting error as "class not found exception".Can any one help me? Below I am giving the code?
<embed
type="application/x-java-applet;version=1.4"
pluginspage="http://java.sun.com/products/plugin/index.html#download"
code="DigitalSignerApplet"
archive="DigitalSignerApplet.jar"
width="130"
height="25"
mayscript="true"
scriptable="true"
fileNameField="uploadFile"
certificationChainField="certChain"
signatureField="signature"
signButtonCaption="Sign selected file">
<embed>

Excuse me with out files in webserver how can I get
error, I am asking how to point to that specific classHuh? You can't. It's an HTML page with an applet. All normal rules apply.

How can i add update signed jar file

I am developing an applet which requires signing to run in a browser.
I am developing supporting classes. But these class files have to be added
to the jar. Isnt it??
But to test the applet i need to load it in the browser each time i modify the class files. So the jar file need to be updated every time. But an
IOError
is being displayed when i try to update the signed jar file.
How can i update signed jar file?? Or is there any othe way to test the signed applet during development??

How can i update signed jar file?You can't, the signature is there to make sure the content of the jare hasn't been messed
with.
Either recreate the jar and re sign it or set up a policy during testing.

How to protect the class files inside jar file.

Hi Group,
pls help me.
my need is i created a executable jar file with certain classes.
and i'm supposed to send it to my client.
but if the client needs he can extract the class files from the jar and with the
help of some decompilers he can convert class file to .java source code and read the whole
stuff.
how can i protect my jar file from these.
is there any security mechanism for that
pls help me.
Regards,
Ranjith.M

In order to protect my jar file I tried the jar signer technology but it only protects the jar from modification so I need to know how to protect jar file from decoding of the contents inside.

Signed cab file using j++, IE, XERCES

HI:
i am using j++ and adding class files from XERCES.jar
for parsing. I add the class files manually using J++
and they are definetly in the .cab file. And i am sure it downloads the cab w/ the files. But,
IE 5.5 gives me a classNotFound Exception when it tries to load in the classes. Any idea why they would not show up???
THANKS

1. make sure you first unjar XERCES.jar in the same directory where your classes are
2. make the cab file using all the classes, yours and the ones from the jar file.
Here is an example:
cd <directory_with_all_classes>
cabarc -s 6144 -r -p n mycab.cab *.class *.gif *.ini *.propertiesIf you want, you can then sign the cab file using signcode.
I hope this will help you.
Iulian

Turning off jar cache causes classnotfound with signed jar files

Hi,
I have a problem with applet signed jars when the java cache is turned off.
With the cache turned off, I get a class not found for the first class it attempts to use from the signed jar file from an applet.
If I turn the jar caching on, all works perfectly with no other changes.
Anyone have any ideas? This is java 6u16.
Thanks

jkc532 wrote:
.. Is the fact that the CachedJarFile class doesn't attempt to reload the resource when it can't retrieve it from MemoryCache a bug? From your comprehensive investigation and report, it seems so to me.
..I've dug as deep as I can on this and I'm at wits end, does anybody have any ideas?Just after read the summary I was tired, so I have some understanding of the effort you have already invested in this (the 'wits' you have already spent). I think you should raise a bug report and seek Oracle's response.

Three questions about signed jar file and applet

I use three signed jar file. Each of them signed by different certificate. First of JARs contain applet class. When I start applet from html page I see message “This applet was signed by…… but Java cannot verify it… Do you trust…?”. All times I press “Yes I trust” and after this questions applet stop to work end exit. If I use only one certificate for signing of three JARs then applet continue to work after question. 1) What should I do to fix this bug? 2) Is it any method to check from applet that user press Trust button? Is it any method to emulate work of SecurityManager to check that Certificate object is trusted (I want do call some method check(Certificate) and if certificate is not trusted I want to see message with question: “Do you want to trust this certificate” and so on)?

Hello Jarman,
1. If I have a signed jar file, then as long as the
certificate is recognised as trusted that applet can
run as a fully trusted application on the client
machine. So I should not have to add lines such as
permission java.lang.RuntimePermission
"readFileDescriptor", "read" ;
permission java.lang.RuntimePermission
"writeFileDescriptor", "write" ;
to my java.policy file. true/false ?true
2. If I am running a signed jar file in the Java
plugin then I do not need to have a verisign or thawte
certificate (however to allow my certificate to be
accepted I do have to import it into the cacerts file
on the client machine). True/false?true
3. Following on from question 2, if I want to be able
to run an applet on a client machine, without messing
around with ANY files on those machines, I need a
verisign or thawte certificate. True/false?true
4. (And finally) Apart from a security exception
saying that I need to add one of the lines like those
of question 1, is there any way I can get other debug
information as to why the signed jar file is not being
recognised as signed?No. This could be a problem of importing your certifcate into the wrong place.
The information on the following link is a little bit dated but it helped me to successfully install a testcertificate and sign an applet with it.
http://www.suitable.com/Doc_CodeSigning.shtml

Help with signing jar files

hi,
Iam trying to let a applet do file acces on a client. Therefore I must sign a applet so it may access the filesystem. This works, but the code keeps screaming about security violations.
Now ive vopied the code from a example from Oracle and I found one difference.
next to the fileUploader class that I also have in my jar file there is a
FileUploader$1.class with the following code:
import oracle.ewt.thread.Task;
import oracle.ewt.thread.TaskEvent;
final synchronized class FileUploader$1 implements Task
    private final FileUploader this$0 = fileUploader;
    private final boolean val$nf = flag;
    private final Object val$val = object;
    public void runTask(TaskEvent taskEvent)
        FileUploader.access$0(this$0, val$val, val$nf);
    FileUploader$1(boolean flag, FileUploader fileUploader, Object object)
}but if I try to compile this code then I get all sorts of error telling me Iam missing vars and methods.
Can anyone tell me why this class is there and what it does and if its nessesary for the fileaccess then how can I create it

hi,
Iam trying to let a applet do file acces on a client.
Therefore I must sign a applet so it may access the
filesystem. This works, but the code keeps screaming
about security violations.
Now ive vopied the code from a example from Oracle and
I found one difference.
next to the fileUploader class that I also have in my
jar file there is a
FileUploader$1.class with the following code:
import oracle.ewt.thread.Task;
import oracle.ewt.thread.TaskEvent;
final synchronized class FileUploader$1 implements
Task
private final FileUploader this$0 = fileUploader;
private final boolean val$nf = flag;
private final Object val$val = object;
public void runTask(TaskEvent taskEvent)
FileUploader.access$0(this$0, val$val,
al$val, val$nf);
FileUploader$1(boolean flag, FileUploader
der fileUploader, Object object)
}but if I try to compile this code then I get all sorts
of error telling me Iam missing vars and methods.
Can anyone tell me why this class is there and what it
does and if its nessesary for the fileaccess then how
can I create it
a Name1$Name2.class file is generated from an inner class Name2 in a class Name1.
in your case you want to look at and compile FileUploader.java. This will then generate any inner class FileUploader$innerclass.class files necessary

What is the best way to protect .class files on server?

I've been working on my website project for quite some time, years in fact. Now I'm at the point where I'm looking into signing up with a web host provider and testing the site live.
I have some questions and concerns though. My site is made up of Java Servlets and JSP pages.
My foremost concern is protecting my code. Many suggest obfuscating. If I understand the process correctly, it involves making the code harder to decompile. I also understand that obfuscating isn't a guarantee in protecting code. If someone really wants to use the code, they'll figure out a way to.
So are there any other options available to protect my code?? I would like to consider as many options as possible.
Once it is on the web host server, anyone can have access to it. Hope this doesn't sound like a stupid question - Microsoft Word comes with the option to password protect files from being opened, is there not by now some way to implement the same sort of feature with files uploaded to a server?
Your input is appreciated.

ejp wrote:
Once it is on the web host server, anyone can have access to it.That's not true. You're off on the wrong track before you even start. You need to acquire a proper understanding of a web server and its configuration. Your problem can be solved via correct configuration of the server. Nothing to do with obfuscation.So your telling me that once I've uploaded all my .class files and everything else to my host provider, that the people running the server do not have access to it? I find this hard to believe....
What exactly would I be looking to configure on the server??? Please explain.

Why is U51 blocking individual class files not in jars but U45 accepted them?

Let me answer the "why do you need individual class files?" question first. We have a rather large applet based application with a current client-side minimum jar download size of 1.8 MB. If we put ALL of our class files into jars, that size will probably double. Most users only use a small portion of the class files for their particular tasks. Which of the class files they use depends upon the tasks they perform. Having ALL users download ALL the classes, albeit compressed in jars, is extremely time consuming and a major problem after application updates due to the large number of users and the network load it would cause.
Jar file manifest:
Permissions: all-permissions
Codebase: *
Application-Name: MyApplication
Application-Library-Allowable-Codebase: *
Caller-Allowable-Codebase: *
Trusted-Library: true
We have 11 directories with one containing the applet and main client application code. The other 10 directories contain class files relating to the various sub-applications in the system. The system has a third-party runtime jar file, too.
We have a private network and servers for our business so the exposure is small. This is a screen-scraping, reformattring application that does no real data processing so doesn't need the same security as a true data processing application. Since we are not open to the Internet and of limited security risk, we chose to keep a more simplified structure.
This all worked under 1.7.0_45. I read the security guide and it was my understanding that these attributes in the manifest would also work for U51. Apparently not. Looking at the guides, now, it appears they have been changed sometime last year regarding mixed-code to mean jars with certificates and jars without certificates. The support for individual class files appears to have been removed. If this is true, then there should have been a beta of the U51 code because the rules seem to have been changed since the last release or there is a new bug.

This is exactly my same problem. My app (and applet) is about 5 MB if I consider all the classes and libraries used by the app. (I mean 5MB is the size of the jar file). I can't ask customers to download 5 MB every time they want to access the program.
We need java ask code signing for the principal applet but then we must have the possibility to run single class files as needed.
Help us all please.
Thanks Paolo

Class file javafx.lang.Builtins not found

I just installed Netbeans 6.5 with jdk1.6.0_11 and javaFX 1.0 and latest updates on windows XPSP3. If i create a new JavaFX class all javaFX components are marked with a warning sign "cannot access javafx.lang.Builtins class file for javafx.lang.Builtins not found".
with netbeans 6.1 and javaFXpre1.0 i didn't have these problems but there were no Swingcomnponent class available.
Has anyone an idea how to get rid of this problem
Thanks Marco

The Feb 2009 update gives a slightly more helpful additional message for the package error when hovering over the package's name: "File looks to be in non-JavaFX project"
Create a new project of type JavaFX and put your source code in that and all the errors go away. (Couldn't find a way to change existing project type in Netbeans).
Despite the IDE warnings it does seem to compile OK (assuming you have no other errors).

Signing class files

Similar Messages

Maybe you are looking for