代码之家 › 专栏 › 技术社区 › Steve Emmerson

为什么javawebstart说一个已签名的jar文件是未签名的?

jar-signing java-web-start code-signing jar java

Steve Emmerson · 技术社区 · 15 年前

Error: Unsigned application requesting unrestricted access to system
       Unsigned resource: .../dynaccn.jar

但是jar文件签署:

$ jarsigner -keystore ... dynaccn.jar idv
$ jar tf dynaccn.jar
META-INF/MANIFEST.MF
META-INF/IDV.SF
META-INF/IDV.RSA
META-INF/
edu/
edu/ucar/
edu/ucar/unidata/
edu/ucar/unidata/dynaccn/
App$1.class
...
$ jarsigner -verbose -certs -verify dynaccn.jar
       28325 Tue Aug 17 09:41:58 MDT 2010 META-INF/MANIFEST.MF
       28404 Tue Aug 17 09:41:58 MDT 2010 META-INF/IDV.SF
        2880 Tue Aug 17 09:41:58 MDT 2010 META-INF/IDV.RSA
           0 Tue Aug 17 09:41:58 MDT 2010 META-INF/
           0 Mon Aug 16 10:10:34 MDT 2010 edu/
           0 Mon Aug 16 10:10:34 MDT 2010 edu/ucar/
           0 Mon Aug 16 10:10:34 MDT 2010 edu/ucar/unidata/
           0 Mon Aug 16 10:10:34 MDT 2010 edu/ucar/unidata/dynaccn/
...
sm       486 Mon Aug 16 10:10:34 MDT 2010 App$1.class

      X.509, CN=University Corporation for Atmospheric Research, OU=UNIDATA, O=University Corporation for Atmospheric Research, L=Boulder, ST=Colorado, C=US
      [certificate will expire on 2/6/11 4:59 PM]
      X.509, CN=Thawte Code Signing CA, O=Thawte Consulting (Pty) Ltd., C=ZA
      [certificate is valid from 8/5/03 6:00 PM to 8/5/13 5:59 PM]
      [KeyUsage extension does not support code signing]
      X.509, EMAILADDRESS=premium-server@thawte.com, CN=Thawte Premium Server CA, OU=Certification Services Division, O=Thawte Consulting cc, L=Cape Town, ST=Western Cape, C=ZA
      [certificate is valid from 7/31/96 6:00 PM to 12/31/20 4:59 PM]
      [CertPath not validated: null]
...
jar verified.

Warning: 
This jar contains entries whose signer certificate's KeyUsage extension doesn't allow code signing.
This jar contains entries whose signer certificate will expire within six months. 
This jar contains entries whose certificate chain is not validated.
This jar contains signed entries that's not signed by alias in this keystore.

即使JWS缓存和浏览器下载区域为空,也会出现问题。

我的环境是Linux 2.6.27.41-170.2.117.fc10.x86_、Firefox 3.6.8(i686)和Java 1.7.0-ea。

为什么这个应用程序不能启动?

3 回复 | 直到 15 年前

Radtoo 15 年前

我在gentoolinux上运行openjdk7,我想我也遇到了同样的问题。

仅仅切换到官方的jdk6而不重建只会使与“jarsigner-verify-verbose-certs”不同的“[CertPath not validated:null]”警告消失,但在我最终使用的应用程序中似乎不起作用。

Bozho 15 年前

确保您没有使用jar的缓存(未签名)版本。清理临时文件夹 JWS downloads jars
确保jar中需要特殊权限的所有依赖项(jar)都已签名

Nikola Yovchev 15 年前

确保在applet中使用doPrivileged块包装调用。我不知道为什么它这样工作,但似乎像一个魅力。