How to add Permissions and Codebase attributes to third-party jar manifest?

Question

As stated in the Java ™ SE Development Kit 7, Update 25 (JDK 7u25) , a warning is displayed in the console if the manifest file of the application deployed using Java Web Start does not have the permissions of the Codebase attributes described in Preventing RIAs from Being Cleared .

For my JARs, it is trivial to add properties; this is even trivial for third-party jars that are not digitally signed: modify the manifest and sign (the same as my JARs). What should I do if I have third-party digitally signed banks? The verification process seems to use the hash of the entire manifest file, so it may not be possible to change the manifest without invalidating the signature using the jarsigner-JAR Signing and Verification Tool .

Is it correct? Is there any solution?

Answer 1

I made a little ant script for this. the idea is simple:

• for each can

  • extract contents to temp directory
  • re-jar excluding * .RSA and * .SF files (adding permissions too)
  • with my own certificate

  <property name="keystore" value="../keystores/store/keystore.jks" /> <property name="storetype" value="jks" /> <property name="storepass" value="password" /> <property name="keypass" value="${storepass}" /> <target name="unsign-all"> <foreach target="_re-jar" param="currentFile" parallel="false"> <path> <fileset dir="WebContent/dir_contains_jars" casesensitive="yes"> <include name="**/*.jar" /> </fileset> </path> </foreach> <move todir="WebContent/dir_contains_jars" overwrite="true"> <fileset dir="WebContent/dir_contains_jars.tmp" casesensitive="yes"> <include name="**/*.jar" /> </fileset> </move> <delete dir="WebContent/dir_contains_jars.tmp" /> </target> <target name="sign-all"> <apply executable="C:\Program Files\Java\jdk1.7.0_45\bin\jarsigner"> <arg line="-keystore ${keystore} -storetype ${storetype} -storepass ${storepass} -keypass ${keypass}" /> <srcfile /> <arg line="alias_name" /> <fileset dir="WebContent/dir_contains_jars" casesensitive="yes"> <include name="**/*.jar" /> </fileset> </apply> </target> <target name="_re-jar"> <basename property="filename" file="${currentFile}" /> <jar destfile="WebContent/dir_contains_jars.tmp/${filename}"> <zipfileset src="${currentFile}"> <exclude name="META-INF/**.RSA" /> <exclude name="META-INF/**.SF" /> </zipfileset> <manifest> <attribute name="Permissions" value="all-permissions" /> <attribute name="Codebase" value="*" /> <attribute name="Application-Name" value="jnlpApplicationName" /> </manifest> </jar> </target>