Question

How can i fix this error? I have my deploy dist with all jar files included in my webserver. But once i press icon.jnlp it says that error.

icon.jnlp:

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<jnlp codebase="http://localhost:007/dist" href="icon.jnlp" spec="1.0+">
  <information>
    <title>Sample</title>
    <vendor>Sample</vendor>
    <homepage href=""/>
    <description>Sample</description>
    <description kind="short">Sample</description>

    <icon href="load.png" kind="splash"/>
    <icon href="logo.png" kind="default"/>

    <shortcut online="false">
      <desktop/>
        <menu submenu="Sample">
          <menu submenu="Sample Managing System"/>
        </menu>
    </shortcut>
    <offline-allowed/>
  </information>

  <security>
    <all-permissions/>
  </security>

  <resources>
    <j2se version="1.5+"/>
    <jar eager="true" href="http://localhost:007/dist/a.jar" main="true"/>
  </resources>

  <application-desc main-class="main.main">
  </application-desc>

</jnlp>

Follow up:

1) Download JAR Maker (works in Linux, Windows)

• Sing all third party jars

• your deploy jars

• Output directory: /var/tmp/project/dist

• go to JAR Signer tab

  • input jar file: a.jar
    • jarsigner location: /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0/bin/jarsigner
    • keystore file
    • if no key was created > click generate keystore
      – keytool location: /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0/bin/keytool
      – output keystore file: /var/tmp/keystore
      – keystore alias: rememberthisname
      – public key: 123456
      – private key: 123456
      – validity days: 0 means 6 month
      – keystore identities
      – valid info…
      – press generate keystore
      – it will create /var/tmp/keystore and java.key.public and java.key

  • keystore authentication

    • keystore alias: rememberthisname
    • public key: 123456
    • private key: 123456

  • click sign JAR! > will tell if failed or success

Repeat this process for all other JAR files to sign!!

2) Deploy to the landing space

3) Make sure you have all your third party is referenced

Before:

  <resources>
    <j2se version="1.5+"/>
    <jar eager="true" href="http://localhost:007/dist/a.jar" main="true"/>
  </resources>

After:

  <resources>
    <j2se version="1.5+"/>
    <jar eager="true" href="a.jar" main="true"/>
    <jar eager="true" href="lib/b.jar" main="flas"/>
    <jar eager="true" href="lib/c.jar" main="flas"/>
    <jar eager="true" href="lib/d.jar" main="flas"/>
    <jar eager="true" href="lib/e.jar" main="flas"/>
    <jar eager="true" href="lib/f.jar" main="flas"/>
    <jar eager="true" href="lib/g.jar" main="flas"/>
    <jar eager="true" href="lib/h.jar" main="flas"/>
    <jar eager="true" href="lib/i.jar" main="flas"/>
  </resources>

Answer 1

Be sure to check the JNLP using JaNeLA.

Do i have to sign now all my other third party jars also?

It depends how they are deployed. If they are in extensions, the extension can have a different security level. If the security level is sand-boxed, the Jars do no need to be signed.

But then you might face ‘mixing signed & unsigned resources’ warnings. I’m not sure if it applies between extensions. There are ways around those warnings, but I think it is simpler to deploy all Jars signed, irrespective of the security level of the extension they are used in.