Question

I am integrating security to my web MVC application and couldn’t get idea what I have to do (What JARS required for it), so after some googling i found this link

Now I have download spring security 2.0.4 from spring security web site. In spring-security-2.0.4\dist folder there is some JAR files. There is some file with minimum changes e.g

spring-security-xxx-2.0.4.jar
spring-security-xxx-2.0.4-sources.jar

Please some body explain to me what is the difference between them. And which one is better from two of them to choose.

Note My existing MVC application is on spring 2.5.

I know its a very newbie question but I am learning security. Thanks

Answer 1

Just to clarify, this isn’t really a security related question but rather a general code packaging question.

Jar files are actually just zip files and therefore can contain anything.

By convention a jar name that ends with -sources contains source code i.e. the actual .java files.

Jar files without the -sources contain the compiled java byte-code i.e. all the .class files. Essentially the files that you get when you run the .java files from the corresponding -sources jar through javac.

You only need the compiled .class files at runtime. That is why the two are split.

The -sources jar is useful at development time so that you can inspect the code that you are calling. This is especially useful if you are using 3rd party code that isn’t well documented.