Signed jar files

王朝java/jsp·作者佚名 2006-01-09

Signed jar files

The policy file technique does not apply to Web browsers. Before you can execute FileIO in a Web browser, you first store that applet's classfiles in a jar file and digitally sign that jar file.

Signing a jar file

requires a certificate. Although you can purchase a certificate when

you want to distribute an applet commercially, I will show you how to

create a free self-signed certificate (which you only use for testing).

Complete the following steps to create a jar file, to create a

self-signed certificate, and to sign that jar file with the certificate:

Create the jar file: Execute jar cvf FileIO.jar *.class . You end up with a FileIO.jar jar file.

Create a new key in a new keystore: Execute keytool -genkey -keystore myKeyStore -alias me .

Alias "me" is arbitrary. It reminds you that the certificate based on

the keystore is self-signed so you don't accidentally put it into

production.

The keytool

prompts you for information about the new key: It asks you for a

password to protect the keystore. Then it asks you for your name,

department, organization, city, region, and country. This information

will go into the new keystore file— myKeyStore , in this example.

Create a self-signed test certificate based on the keystore: Execute keytool -selfcert -alias me -keystore myKeyStore . Enter the keystore password when prompted.

Sign the jar file with the testing certificate: Execute jarsigner -keystore myKeyStore FileIO.jar me . Enter the keystore password when prompted.

The jarsigner program updates the jar file's META-INF

directory to contain certificate information and digital signatures for

each entry in the archive. If all goes well, you end up with a signed FileIO.jar file.

Note I recommend studying the tools documentation section of the J2SE documentation to learn more about jar , keytool , and jarsigner .

Before executing the applet in a Web browser via the signed jar file, create an appropriate HTML file whose <applet> tag includes an archive attribute identifying the jar file. Listing 4's FileIO2.html should do nicely.

Listing 4. FileIO2.html

</applet>

It's time to execute the applet. Assuming FileIO.jar and FileIO2.html

are located in the c:\temp directory on a Windows machine, start the

Web browser and enter c:\temp\FileIO2.html into that browser's address

bar. After a few moments, a dialog box should appear. That dialog box,

as shown in Figure 2, presents a security warning and asks you to grant

permission to run the applet.

Figure 2. The Java Security Warning dialog box identifies a signed applet. Click on thumbnail to view full-sized image.

Click either the Grant

This Session button or the Grant Always button to proceed. If you're

curious, click the View Certificate button to view the details of the

self-signed certificate that you previously created. Figure 3 shows the

applet embedded in the Firefox browser.

Figure 3. The Web browser alternative to running FileIO in appletviewer

Review

Get ready for a journey into my world of Java-based entertainment. Each installment of Java Fun and Games

focuses on a specific topic that I've found to be entertaining, and

presents one or more Java programs I created while exploring that

topic. Those programs take the form of applets. Some of the applets

will need to access the filesystem (to read/save game stats, for

example). Because filesystem access is forbidden by the JVM's security

manager, policy files and signed jar files are required to circumvent

security concerns. Use policy files to run file-access applets with

appletviewer. But to run them in a Web browser, used signed jar files.