How to include dependencies jar using JNLP file?

Question

Okay this is my first time to try Java web start, so I have jar that built with Maven as dependencies repository, and put it into Apache root folder including all dependencies jars inside folder lib, then I created key store, HTML, and JNLP file.

I started the Apache services, and tried to access localhost and it's ran smoothly until I ran jnlp file with my browser's java plugin, and NoClassDefFoundError showed, I knew that my dependencies jars aren't included. So I found How to include jar dependencies in java webstart project the accepted answer doesn't work for me, and I don't know what am I doing wrong?

Here's my JNLP file:

<?xml version="1.0" encoding="UTF-8"?>
<jnlp spec="1.0+"    codebase="http://localhost/transactionSimulator2"    href="launch.jnlp">

<information>
    <title> Transaction Simulator</title>
    <vendor> Daksa </vendor>
    <homepage href=""></homepage>
    <description>Transaction Simulator </description>
    <description kind="short">Transaction Simulator</description>
    <offline-allowed/>
</information>
<security>
    <all-permissions/>
</security>
<resources>
    <j2se version="1.6+"/>
    <jar href="TransactionSimulator-1.0-SNAPSHOT.jar" main="true" download="eager"/>
    <target name="signLibs">
        <signjar destDir="lib"  alias="yusufNugraha" keystore="testKeys"
        storepass="yusufnugraha" force="true" >
            <path>
                <fileset dir="lib" includes="*.jar" />
            </path>
        </signjar>   
        <echo message="Library files were signed."/>
    </target>
</resources>
<application-desc main-class="com.daksa.transactionsimulator.ui.MainFrame">
</application-desc>
</jnlp>

Answer 1

The correct way of including jar libraries is this:

<?xml version="1.0" encoding="UTF-8"?>
<jnlp spec="1.0+"    codebase="http://localhost/transactionSimulator2"    href="launch.jnlp">

<information>
    <title> Transaction Simulator</title>
    <vendor> Daksa </vendor>
    <homepage href=""></homepage>
    <description>Transaction Simulator </description>
    <description kind="short">Transaction Simulator</description>
    <offline-allowed/>
</information>
<security>
    <all-permissions/>
</security>
<resources>
    <j2se version="1.6+"/>
    <jar href="TransactionSimulator-1.0-SNAPSHOT.jar" main="true" download="eager"/>
    <jar href="lib/file1.jar"/>
    <jar href="lib/file2.jar"/>
    <jar href="lib/file3.jar"/>
    <jar href="lib/file4.jar"/>
    <jar href="lib/file5.jar"/>
</resources>
<application-desc main-class="com.daksa.transactionsimulator.ui.MainFrame">
</application-desc>

Answer 2

You can use an uberjar, where all libs are extracted into a larger jar file. In this case there is only file to deal with. The maven-dependency-plugin in Maven can do this for you. It fetched automatically all dependencies, so it's a great deal. I'm using this assembly file with the plugin:

    <assembly xmlns="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.3"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.3 http://maven.apache.org/xsd/assembly-1.1.3.xsd">
    <id>jar-with-dependencies</id>
    <formats>
        <format>jar</format>
    </formats>
    <includeBaseDirectory>false</includeBaseDirectory>
    <dependencySets>
        <dependencySet>
            <outputDirectory>/</outputDirectory>
            <useProjectArtifact>true</useProjectArtifact>
            <unpack>true</unpack>
            <scope>runtime</scope>
        </dependencySet>
    </dependencySets>
</assembly>

You also have to sign the jar to be able to execute the application (in the browser).

Note : if you are using a crypto provider like Bouncy Castle, the signature of the crypto provider is broken when you are including this jar in the uberjar. In this case you have to add it as an additional jar as an extension in the resources element.

In the assembly file you have to exclude this then within the dependencySet element, eg:

<excludes>
    <exclude>org.bouncycastle:bcprov-jdk15on</exclude>
</excludes>

The extension JNLP would look like this:

<jnlp spec="1.0" href="bouncyCastle.jnlp">
    <information>
        <title>Bouncy Castle</title>
        <description>Bouncy Castle Crypto Provider</description>
    </information>
    <security>
        <all-permissions/>
    </security>
    <resources>
        <jar href="https://www.bouncycastle.org/download/bcprov-jdk15on-152.jar"/>
    </resources>
    <component-desc />
</jnlp>

You have to counter sign the jar in this case with the same key used for the main jar. Otherwise the extension is rejected. For some reason you have to use the same digest algorithm to get no verification error.