Web Development

Ask something
Discussion Locked

Sign a JAR

0 helpful
10 replies

by Mark W. Kaelin

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Do you sign your JARs? After reading this tip, will you sign them now?

10 replies

by shepps

Hi,

I did not know about this. What I found interesting is that an applet, for instance, has more power than it did before. This has always been a problem.

What exactly can I do and not do once i have a signed JAR? Is there a link to a useful page where this is documented?

Thanks

Philip

by bayard-generationjava

While there may be others, the big reason for signing a
jar is to gain extra permission on the client side for
applets and JNLP.

A signed JNLP [commercially signed that is] can gain
access to the hard drive etc without requesting
permission from the user [I think, I've not had the
chance to sign one commercially and test]. An
unsigned one still has to request permission, but it
contains some minor authentication of who is
requesting the access. Nothing secure, but it can often
make the user feel happier to know the name on the jar
is one they trust from the website etc.

Ditto with applets, though as with everything with
applets they have complications due to versions etc.

For JNLP: http://java.sun.com/products/javawebstart/
1.2/docs/developersguide.html

For Applets, see the Security Tutorial at:

http://java.sun.com/docs/books/tutorial/security1.2/
index.html

most especially, the quick tour of controlling Applets
and the section on Signing code and Controlling
permissions.

I apologise that there's no way this kind of information
can cram into a tip, but hopefully it was enough to show
that signing a jar isn't a magical thing, and to whet
everyone's appetites.

by avia

Excellent! Very good indeed! Clear and concise and certainly enables me to make my own signed JARs (if I ever need to -- currently, I don't).

My congratulations to the author.

Thankyou very much,
Avi.

by patol

I did like the example but while signing the jar i've got this error (I cheched the passwords and JDK version several times)

C:\java\jdk140\bin\keytool -genkey -alias csv -keypass 'test'
Immettere la password del keystore: test33
Specificare nome e cognome
[Unknown]: Lorenzo Patocchi
Specificare il nome dell'unitα aziendale
[Unknown]: dev
Specificare il nome dell'azienda
[Unknown]: Net 4 Business - Switzerland
Specificare la localitα
[Unknown]: Manno
Specificare la provincia
[Unknown]: TI
Specificare il codice a due lettere del paese in cui si trova l'unitα
[Unknown]: CH
Il dato CN=Lorenzo Patocchi, OU=dev, O=Net 4 Business - Switzerland, L=Manno, ST=TI, C=CH Φ corretto?
[no]: si

C:\java\jdk140\bin\jarsigner -verbose iffel.jar csv
Enter Passphrase for keystore: test33
Enter key password for csv: test
jarsigner: unable to recover key from keystore

by bayard-generationjava

Looking at the source to JarSigner.java, [google for
JarSigner.java], you can see that this happens when an
UnrecoverableKeyException is thrown by a large lump
of code. By the looks of things, it is an attempt to get the
key using the password you entered [the last few lines
of code before the error output].

Does 'keytool -list' give you the output you expected?

by levenyu

Hi!
I've checked my "keytool -list" output and it was correct (well according to the e-mail example). So, what is this error message is about? What are we doing wrong?
Any suggestion here will be appreciated.
Thanks!

by levenyu

Hello "bayard" and others who post here!
Please disregard my previous post dated 9/26/02.
First, I thought that jarsigner could not find a
.keystore file for some reason.
Second, my guess was that it might have been a jarsigner glitch or a bug (well, it happens with
a Sun's "Open Source" from time to time).
However, the reality was that my computer (work station) just played a trick on me, some memory garbage was not collected and caused that error,
because when I restarted the work station it worked fine as it was explained.
That's all, folks!
Thanks!

by vitalichka

It's mentioned in the article that certificate actually asks browser's JVM for permissions to do something, like to open file on local drive. How to specify those permissions? And where can I find full list of resrictions for applet?

by bayard-generationjava

The Java Security Tutorial is the best place to delve into
using the signed jar along with policies. It's at:

http://java.sun.com/docs/books/tutorial/security1.2/
index.html

javap java.lang.SecurityManager gives a good list of
the core permissions which I've found controlled when
trying to run Java programs in Java programs [JPE, an
IDE for PDAs]. Running the policytool gives a more
comprehensive list and is described in the security
chapter mentioned above.

by bayard-generationjava

Thanks for the reply Levenyu, especially to let us know
that you'd figured the problem out. It helps people
picking pages up through google in the future :)

Bay

This discussion is closed to new replies.