Question

I am using a third party library in my applet, packaged in a JAR, that is requesting for full permissions on the user’s computer and presenting a security certificate. I am not using it for any purpose that would require permissions. Is there any way to modify the JAR so it no longer requests such permissions when accessed? If I remove the security certificate from the JAR and re-compress it, will it function?

Answer 1

There are a number of ways to strip the digital signatures.

1. Use the Jar tool to extract the Jar, then make a new Jar of the classes & resources.
2. Use Ant to do the same.
3. Change the file extension to .zip and open it in a Zip tool that will allow you to delete the META-INF directory. Then rename it back to .jar. Ugly hack, might have side effects.

If I remove the security certificate from the JAR and re-compress it, will it function?

There may be things it is doing that require trust but are not immediately apparent. If so, the Java Console should be helpful. On Oracle JREs, you can refuse the security prompt to check this, the code will be loaded sand-boxed. That won’t work on an Iced Tea JRE, which will not load the applet at all if the user refuses the trust dialog.