Java Web Start does not work after updating Java 8u141 - java.lang.SecurityException: missing digest for org / apache / commons / httpclient

Question

After updating Java 8u141, my java web launcher application launched by jnlp stopped working. Do not download the application. And throws these exceptions below. Can anybody help me?

com.sun.deploy.net.JARSigningException: Could not verify resource signature: http://www.example.com/myjar.jar at com.sun.deploy.security.JarVerifier.authenticateJarEntry(Unknown Source) at com.sun.deploy.security.EnhancedJarVerifier.validate(Unknown Source) at com.sun.deploy.cache.CacheEntry.processJar(Unknown Source) at com.sun.deploy.cache.CacheEntry.access$2700(Unknown Source) at com.sun.deploy.cache.CacheEntry$7.run(Unknown Source) at java.security.AccessController.doPrivileged(Native Method) at com.sun.deploy.cache.CacheEntry.writeFileToDisk(Unknown Source) at com.sun.deploy.cache.CacheEntry.writeFileToDisk(Unknown Source) at com.sun.deploy.cache.Cache.downloadResourceToTempFile(Unknown Source) at com.sun.deploy.cache.Cache.downloadResourceToCache(Unknown Source) at com.sun.deploy.net.DownloadEngine.actionDownload(Unknown Source) at com.sun.deploy.net.DownloadEngine.downloadResource(Unknown Source) at com.sun.deploy.cache.ResourceProviderImpl.getResource(Unknown Source) at com.sun.deploy.cache.ResourceProviderImpl.getResource(Unknown Source) at com.sun.javaws.LaunchDownload$DownloadTask.call(Unknown Source) at java.util.concurrent.FutureTask.run(Unknown Source) at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) at java.lang.Thread.run(Unknown Source) 

Other:

 java.lang.SecurityException: digest missing for org/apache/commons/httpclient at sun.security.util.ManifestEntryVerifier.verify(Unknown Source) at java.util.jar.JarVerifier.processEntry(Unknown Source) at java.util.jar.JarVerifier.update(Unknown Source) at java.util.jar.JarVerifier$VerifierStream.<init>(Unknown Source) at java.util.jar.JarFile.getInputStream(Unknown Source) at com.sun.deploy.security.JarVerifier.authenticateJarEntry(Unknown Source) at com.sun.deploy.security.EnhancedJarVerifier.validate(Unknown Source) at com.sun.deploy.cache.CacheEntry.processJar(Unknown Source) at com.sun.deploy.cache.CacheEntry.access$2700(Unknown Source) at com.sun.deploy.cache.CacheEntry$7.run(Unknown Source) at java.security.AccessController.doPrivileged(Native Method) at com.sun.deploy.cache.CacheEntry.writeFileToDisk(Unknown Source) at com.sun.deploy.cache.CacheEntry.writeFileToDisk(Unknown Source) at com.sun.deploy.cache.Cache.downloadResourceToTempFile(Unknown Source) at com.sun.deploy.cache.Cache.downloadResourceToCache(Unknown Source) at com.sun.deploy.net.DownloadEngine.actionDownload(Unknown Source) at com.sun.deploy.net.DownloadEngine.downloadResource(Unknown Source) at com.sun.deploy.cache.ResourceProviderImpl.getResource(Unknown Source) at com.sun.deploy.cache.ResourceProviderImpl.getResource(Unknown Source) at com.sun.javaws.LaunchDownload$DownloadTask.call(Unknown Source) at java.util.concurrent.FutureTask.run(Unknown Source) at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) at java.lang.Thread.run(Unknown Source) 

Answer 1

I managed to resolve the same issue yesterday. This is what worked for me:

• Use 7-Zip to open an original, unsigned jar that throws a JARSigningException. It is probably a good idea to make a copy of the jar first in case something goes wrong.
• Open the META-INF folder and copy the MANIFEST.MF file somewhere to your computer.
• Open a copy of MANIFEST.MF in a text editor. Find the line that says "Name: org / apache / commons / httpclient". There may be several lines depending on the flask. Below this line, there will probably be other lines, such as "Implementation-provider: ...", "Specification-Name: ...", etc. In any case, delete all lines of "Name: ..." and all subsequent lines in each block.
• Save the file and replace the existing MANIFEST.MF file in the bank with the edited version. 7-Zip allows you to replace files inside in-situ containers.
• Re-sign the jar and deploy it.

It seems that when jars are signed, the "Name:" lines in the manifest may end in the middle of the signed classes, which only now seems to be a problem with the release of Java 8u141, but it was obviously good.

Answer 2

The problem has already been fixed in 8u144, please upgrade it to 8u144 to avoid this problem. http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html

Answer 3

I had the same problem with commons-httpclient-3.1.jar library. In fact, I believe this is a web startup error, as it worked before that, and it works with 8u152 early access. The solution I described here !

Answer 4

The problem is observed in signed JAR files, whose manifest contains information about the package version [1] and does not have a final "/" package name (for example: Name: org / apache / xml / resolver). Although we are working on a solution to this problem, users can solve this problem as follows:

NOTE. We recommend that you use this workaround only if the JAR file distributor can "overwrite" the JAR files.

• Extract the contents of a signed JAR file (e.g. jar xf jar-file).
• Modify the META-INF / MANIFEST.MF file and add the final "/" to the package name (for example: Name: org / apache / xml / resolver /).
• Delete current signature files (for example: rm -f META-INF / .SF META-INF / .RSA META-INF / *. DSA).
• Recover JAR file (e, g .: jar cfm jar-file META-INF / MANIFEST.MF input-file (s)).

NOTE. You must use the jar utility. Other jar creation tools may re-enter the problem.

5. Overwrite the JAR file.

[1] https://docs.oracle.com/javase/8/docs/technotes/guides/versioning/spec/versioning2.html#wp91706

Source: http://www.oracle.com/technetwork/java/javase/8u141-relnotes-3720385.html#KnownIssues

Answer 5

This bug is considered part of the JDK-8184993 bug , and the fix will be available in a release outside the JDK 8u144 cycle, which is scheduled to be released in the later hours of July 26th.