Java2 applet signing
Oleg Konovalov
We used to have JDK1.1.7A applet which we sign with signtool (using
JDK1.1.6 on Solaris 2.6).
We have converted the applet to JDK1.2.2 and try to sign it with
signtool 1.3(using JDK1.1.6).
It simply doesn't sign it, creates a tiny jar and quits.
Few questions:
1) Do we have to use JDK1.2.2 to create 1.2.2 JAR ?
2) Can 1.2.2 JAR handle both sealed and unsealed JARs ?
3) If I try to run an unsigned applet, Netscape loads Java Plug-in and
stops.
Is that because of Java2 security ?
4) Can I sign 1.2.2 JARs with signtool 1.3 to run under Netscape 4.7 ?
Thank you in advance,
Oleg.
P.S.: Please reply also via e-mail.
Kate Wintjen
Oleg Konovalov wrote:
> Hi,
>
> We used to have JDK1.1.7A applet which we sign with signtool (using
> JDK1.1.6 on Solaris 2.6).
>
> We have converted the applet to JDK1.2.2 and try to sign it with
> signtool 1.3(using JDK1.1.6).
> It simply doesn't sign it, creates a tiny jar and quits.
>
> Few questions:
> 1) Do we have to use JDK1.2.2 to create 1.2.2 JAR ?
Yes. jar cvf MyApplet.jar *.class works. (whatever you plan on calling
your applet; if you have class files you want to use that are in packages,
you'd add to that line packageDir\*.class) Signing your applet won't
create the jar for you, if I understand things correctly.
>
>
> 2) Can 1.2.2 JAR handle both sealed and unsealed JARs ?
Not sure what you mean by sealed/unsealed.
>
>
> 3) If I try to run an unsigned applet, Netscape loads Java Plug-in and
> stops.
> Is that because of Java2 security ?
Depends on whether the applet needs permissions or not. If it needs
permissions, such as read/write access to anything on the client computer,
it won't load. Set the plugin to load the Java Console, so you can see
what error is being output (double-click on the Java Plugin icon, wherever
it is, and that'll be one of the options). You can't open Netscape or
IE's Java Console because that's the console for their JVM, not the plugin
JVM.
>
>
> 4) Can I sign 1.2.2 JARs with signtool 1.3 to run under Netscape 4.7 ?
DON'T USE SIGNTOOL!! Use jarsigner instead. I'm not at work, where I
have various links for the documentation on how to do this, so I'll have
to get back to you with those. I should be able to do that some time
tomorrow morning (it's 10:30 pm at the moment; I usually get to work at 8
am).
Quoc Nguyen
Why can one use netscape signtool to sign his/her applets? The reason I am
asking is because I was/am doing research on what tool should I use to sign my
applets. I've purchased an object-signing certificate from VeriSign. I used
this certificate to sign my applets using signtool. I expected that the
security warning dialog would appear when I went to the URL that contained the
<APPLET> tag points the signed applets. My signed applets were in the jar
file. Would anyone help me what tool to use in order to sign my applets.
Signtool seems to be very simple to use, but I didn't know what I did wrong.
The security warning dialog box didn't show up to allow the user to grant/deny
the permission. The funny thing was that the applets actually worked even I
signed them. Jarsigner is very hard to use, I think. Its instruction is not
simple. If anyone suggests me to use Jarsigner, do I have to purchase a
different certificate?
Thank you all in advance.
-Quoc
Quoc Nguyen
Quoc Nguyen
Quoc Nguyen
Quoc Nguyen
Quoc Nguyen
Quoc Nguyen
Quoc Nguyen
Kate Wintjen
From experience, jarsigner itself isn't that hard; it's the documentation that
sucks! Thing is, I'm not totally sure about applets when not using the Java
Plugin 1.3 and just using the browser's JVM (in this case, Netscape). I don't
think you'd have to buy a different certificate though. Here's a URL that
might help w/ using jarsigner; it also gives instructions for using
Netscape-specific signtool (don't know that the certificate will work when
using IE though, when using signtool):
http://personal.vsnl.com/sureshms/javasign1.html#JP
Here's something that also is somewhat explanatory of keytool, etc. Don't know
if it'll help though (it's a lot to wade through):
http://java.sun.com/products/jdk/1.2/docs/tooldocs/win32/keytool.html
I think it'll help a lot when Tony Swain gets back to viewing this group. He
mentions in an earlier post that he's gonna be gone for a while (although I
think it's been that long at least...), and he's pretty much the resident
expert on signing applets, at least as far as this newsgroup is concerned.
Maybe he'll be able to offer better information.
P.S.: Sorry to Oleg for not posting these links sooner like I said I would; I
got really busy with work and didn't get the chance! Hope this'll help now.
Lisa Tang
execute up to the code with
e.g. PrivilegeManager.enablePrivilege("UniversalFileAccess");
and the priviledge had not yet to granted. Therefore even after you signed
the jar, it doesn't mean that it will always prompt the dialog box.
Hope this can help a bit.
LT
Quoc Nguyen <qng...@kofax.com> wrote in message
news:3A25616C...@kofax.com...