Currently i am trying to remove the security issues with 7u45 in a java applet, However it has caused huge problems with the applet loading. For some reason all the class files are not loading correctly.
To update you on the situation. I have a working java applet which defines the class files within the manifest of a jar file. Their are multiple jars with the same issue. But the issue is the same for all so if i focus on this one jar i can explain the issue simpler.
note: ALL JARS ARE SIGNED
So the orignal version of the jar which worked included the following in the manifest which allows the application to run perfectly.
Manifest-Version: 1.0
Name: app.class
SHA-256-Digest: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
So to fix the issue with the security warnings and popups in 7u45 i have included the additional parameters (for testing) to see if the warnings are gone and the warnings dissapear but the application is unable to load. Below is the current manifest with the security implementations
Manifest-Version: 1.0
Name: app.class
SHA-256-Digest: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Codebase: *
Permissions: all-permissions
Application-Library-Allowable-Codebase: *
Caller-Allowable-Codebase: *
Application-Name: xxxxxx
I simply opened the jar in winrar and edited the manifest with notepad and added the additional settings.
Loaded the application and to my expectation the applet displayed no security warnings but then came the huge error of the classNotFoundException for app.class.
The jar file contains the follow files:
.classpath
.project
META-INF/MANIFEST.MF
META-INF/LIC.RSA (licence)
META-INF/LIC.SF (licence)
app.class
What i can't understand is the application runs fine before the security attributes are added to the manifest, the app.class file can be found with no problems without it, but as soon as i launch it with the new security changes the application can no longer find the app.class file.
I am really stuck with this one, can anyone see a issue with the setup ????
Thanks in advance!
EDIT NOTE - I have a deployment rule set specifying a certificate hash for the application as well on this client machine.
EDIT NOTE - Questions to investigate
Could it possibly be the * wildcard?
Could it possibly be the security updates cannot be specified with additional content in manifest?
UPDATE NOTE: - Manifest signing - In response to 'Tom Hawtin - tackline' (Resign the Jar files)
After trying to resign the jar files after the manifest file has been updated with the security changes, i noticed when i tried to use the jarsigner tool, i received a "Java.IOException - Invalid Manifest Format" error. Researching on this. This is due to the manifest not being able to read the manifest appropriately. Now to update on the changes i have made. Following the principles from previous research and the tutorial examples. I edited the manifest to look like this.
Manifest-Version: 1.0
Name: app.class
SHA-256-Digest: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Codebase: *
Permissions: all-permissions
Application-Library-Allowable-Codebase: *
Caller-Allowable-Codebase: *
Application-Name: xxxxxx
The changes
- space between the attribute and the value as this is required.
- space at the end of the manifest file.
However, i am still receiving a IO Exception. I have reduced the security code to just "Applicaton-Name: xxxx" but it still won't work. I am wondering if opening the jar file in winrar, opening the manifest file inside, editing the code and then saving and updating the archive is causing the problem ?. Should this be done before its compiled? or is it allowed to open a jar and edit its content?
Update
Inserting the security changes causes a invalid manifest format
