如何将权限和代码库属性放入第三方jar的清单？

Question

As stated in Java™ SE Development Kit 7, Update 25 (JDK 7u25) , a warning is printed in the console if the manifest file of an application deployed using Java Web Start doesn't have the Permissions an Codebase attributes described in Preventing RIAs from Being Repurposed .

For my JARs, it is trivial to add the properties; it is even trivial for third-party jars not digitally signed: modify the manifest and sign (same as my JARs). What if I have third-party digitally signed jars? It seems that a hash of the entire manifest file is used in the verification process, so it may not be possible to modify the manifest without invalidating the signature applied using jarsigner—JAR Signing and Verification Tool .

Is this right? Is there any solution?

Answer 1

i made a little ant script for this purpose. the idea is simple:

• for each jar

  • extract content in a temp directory
  • re-jar excluding *.RSA and *.SF files (adding permissions too)
  • sign with my own certificate

   <property name="keystore" value="../keystores/store/keystore.jks" /> <property name="storetype" value="jks" /> <property name="storepass" value="password" /> <property name="keypass" value="${storepass}" /> <target name="unsign-all"> <foreach target="_re-jar" param="currentFile" parallel="false"> <path> <fileset dir="WebContent/dir_contains_jars" casesensitive="yes"> <include name="**/*.jar" /> </fileset> </path> </foreach> <move todir="WebContent/dir_contains_jars" overwrite="true"> <fileset dir="WebContent/dir_contains_jars.tmp" casesensitive="yes"> <include name="**/*.jar" /> </fileset> </move> <delete dir="WebContent/dir_contains_jars.tmp" /> </target> <target name="sign-all"> <apply executable="C:\\Program Files\\Java\\jdk1.7.0_45\\bin\\jarsigner"> <arg line="-keystore ${keystore} -storetype ${storetype} -storepass ${storepass} -keypass ${keypass}" /> <srcfile /> <arg line="alias_name" /> <fileset dir="WebContent/dir_contains_jars" casesensitive="yes"> <include name="**/*.jar" /> </fileset> </apply> </target> <target name="_re-jar"> <basename property="filename" file="${currentFile}" /> <jar destfile="WebContent/dir_contains_jars.tmp/${filename}"> <zipfileset src="${currentFile}"> <exclude name="META-INF/**.RSA" /> <exclude name="META-INF/**.SF" /> </zipfileset> <manifest> <attribute name="Permissions" value="all-permissions" /> <attribute name="Codebase" value="*" /> <attribute name="Application-Name" value="jnlpApplicationName" /> </manifest> </jar> </target>