Try to remove those from the servoy-admin page (replace by a space, or else you will auto get the vmarg: -XX:SoftRefLRUPolicyMSPerMB=3600000
Those vmargs are been listed as unsecure!
Unsecure? Harjo, are you sure about that? I need those args to control memory usage for a client that is running all the smart clients in Citrix, without those args the memory is never released to the operating system and they would need to add more servers to support all their users.
It’s weird that I don’t get any warning in the java console about that.
Yes I believe so, the only way to set & accept insecure system properties, is to sign the jnlp
http://docs.oracle.com/javase/7/docs/te … dJNLP.html
There are several advantages to signing a JNLP file. It will:
Ensure that others cannot change the content in your JNLP file. For example, by adding a random library, or changing application information.
Allow the use of arbitrary Java Virtual Machine (JVM) options and Java system properties in your application.
Prevent others from referencing your JAR file directly in their HTML browser applets.
But that is the whole problem of Servoy, because you can’t sign the jnlp launching file, because the jnlp is totally dynamically created when you download it.
This is a big problem for me, when a client generate a big Jasper report the memory usage raises up to more than 700MB and without those arguments it’s never released to the system.
Johan do you have any suggestion?
I just re-signed my server again and made sure I was using the latest signtester version (1.3) and now it works indeed.
So it looks like I didn’t sign my server using the latest version of Signtester.
But in any case I believe if you don’t use the latest Servoy versions (that have the proper signing already done) OR don’t re-sign your server with a valid certificate and the latest sign tester version (i.e. version 1.3 and up) you can’t use Java 7 Update 51 since that now requires the permissions to be set.
Or am I wrong here?
robert is right, it looks like that update51 with high security settings (i think medium still works) will not let any thing through that doesn’t have:
1> signed with a valid certificate (not self signed)
2> all the manifest attributes (codebase,permissions) have to be set on all the jars
Then it should work i think (as far as i have tested)
If you want to use self signed then the slider must be on the bottom (medium security)
So if you have a valid certificate using the latest signtester then you should be able to resign any servoy version and that one should work then in the default java security settings.
You still seem to be getting that yellow balloon because of unsigned jnlp (which is because of what they have marked as unsecure vm args, or better said i think, what they didn’t mark as secure vm args)
This can be fixed i guess IF your jnlp file is stable (you don’t need arguments send to the solution or use profiles)
Because if you just always hit the default jnlp file, what you can do is save that jnlp file to disk, then add it to the jar (https://blogs.oracle.com/thejavatutoria … _jnlp_file)
then resign that jar.
then the “jnlp” is signed.
Because if you just always hit the default jnlp file, what you can do is save that jnlp file to disk, then add it to the jar (https://blogs.oracle.com/thejavatutoria … _jnlp_file) then resign that jar.
From what I read (http://docs.oracle.com/javase/7/docs/te … dJNLP.html) adding the jnlp to the jar is possible Johan but only with the use of a template file with the name JNLP-INF/APPLICATION_TEMPLATE.JNLP.
The docs say: When a web start application is started, the JNLP file used must be identical to the JNLP file in the signed JAR in order for the application to run.
But most resources have these attributes: download=“%%loadmethod%%” version=“%%version%%”
Because they can change the template should include them as : download=“" version="”
Or do I misinterpret this information?
The jar? Which jar?
I guess the main jar, in console I only see this warning:
Missing Permissions manifest attribute in main jar: http://servoy.xxxxxxxxxxx.it:8080/lib/j2db.jar
Nicola, my guess your problem still lies in the fact that you did’nt use the latest sign-tester!
if you use version 1.3 you won’t get that error!!
you can easily check this, by downloading this jar, rename it to .zip, open it, en look if this attribute is there!
I’m using the latest version, this evening I will try to resign with the official certificate which fortunately arrived 10 mins ago from globalsign.
Hi Guys, Our server is on version 7.3.1 and I have resigned all the jar files with the latest signtester tool (version 1.3) as I still can’t open the application with the java security set on high. We use the browsersuite plugin but we don’t set any arguments for the plugin in the admin page. I don’t know what am i missing that I can’t seem to get to work!
ps, all the jar files seem to have the all-permission set to all-permissions.I don’t set any codebase in the command I run to resign the jar files. Is it mandatory?
Can anyone tell me what can be the issue as it seems others are able to run the app with security set to high when resigned with the latest signtester tool and servoy 7.3.1.
Cheers,
Siavash
You can set a Java System property ‘codebase’ on the command line:
java -Dcodebase=* -jar signtester.jar …
IT2Be:
From what I read (http://docs.oracle.com/javase/7/docs/te … dJNLP.html) adding the jnlp to the jar is possible Johan but only with the use of a template file with the name JNLP-INF/APPLICATION_TEMPLATE.JNLP.The docs say: When a web start application is started, the JNLP file used must be identical to the JNLP file in the signed JAR in order for the application to run.
But most resources have these attributes: download=“%%loadmethod%%” version=“%%version%%”
Because they can change the template should include them as : download=“" version="”Or do I misinterpret this information?
yes you have to name it like they say (it must be a standard name) inside that dir in the main jar file which is j2db.jar
to get the actual jnlp file you need to get the jnlp file that is downloaded from the browser (you don’t even have the main jnlp file on disk on the server like the plugins, its completely generated)
to get that file you can do:
https://yourhost:8080/servoy-client/MyS … p?raw=true
that raw=true will let you see the jnlp file as is in the browser (view source and you see it even better)
save that file to disk.
The url you use to save it to disk, must be exactly the same as the url that you use to start the application. So that the contents of the jnlp file is exactly the same.
ptalbot:
You can set a Java System property ‘codebase’ on the command line:
java -Dcodebase=* -jar signtester.jar …
Ok, I resigned all the jar files again with codebase parameter added to the command and I still can’t open the application with security setting set to high. Anyone has any suggestion on how can I get it to work or what can be wrong?
Thanks,
Siavash
Ok, I think it doesn’t matter how I sign the jar files, I will still get the error as we are using self signed certificates. Do we have to but an official certificate from somewhere like global sign? if yes, can someone please advice me what type of certificate should we buy, maybe the name or the link to where can I find it.
Thanks in advance,
Siavash
I’ve ordered from globalsign.com, look for “Code signing certificate” and be careful to select “For Sun Java” when placing the order. It costs €170/year and they take 1 week usually to issue it. Watch out your snail mail post box for their address verification letter. There are many other CA to choose from: Tawthe, Komodo, etc. Just google for “code sign certificate”.
ngervasi:
I’ve ordered from globalsign.com, look for “Code signing certificate” and be careful to select “For Sun Java” when placing the order. It costs €170/year and they take 1 week usually to issue it. Watch out your snail mail post box for their address verification letter. There are many other CA to choose from: Tawthe, Komodo, etc. Just google for “code sign certificate”.
Thanks Nicola for the suggestions.
Hello all- we’re hitting the same problem and following all of the recommendations here (we have Thawte code-signing cert, disabled servoy.vmClientArgs in appserver) and still getting missing manifest error for j2db.jar.
- resign all jarfiles with signtester.jar 1.3 using our Thawte code-signing cert
- tried with 'Dcodebase=*" didn’t work
- tried with 'Dcodebase=“hostname.domain.com” - didn’t work
- tried with 'Dcodebase=“hostname.domain.com:443” - didn’t work
I then tried to take Johan’s suggestion below and open jd2b.jar, insert ‘JNLP-INF’/APPLICATION_TEMPLATE.JNLP’ with the contents being the “raw” output as viewed in source. Resign code with all above options- still didn’t work.
I then created the file as ‘JNLP-INF/MySolutionName.jnlp’. Rezipped the jarfile, signed it, and ran.
Now I get the following:
“Failed to validate signing of launch file. The signed version does not match the downloaded version.”
I compared the jnlp source from the raw and the qtix.jnlp I included in the j2db.jar file- they match 100%.
Any suggestions on what I could be missing here? Thanks in advance for any and all suggestions.
Regards, Tony
jcompagner:
IT2Be:
From what I read (http://docs.oracle.com/javase/7/docs/te … dJNLP.html) adding the jnlp to the jar is possible Johan but only with the use of a template file with the name JNLP-INF/APPLICATION_TEMPLATE.JNLP.The docs say: When a web start application is started, the JNLP file used must be identical to the JNLP file in the signed JAR in order for the application to run.
But most resources have these attributes: download=“%%loadmethod%%” version=“%%version%%”
Because they can change the template should include them as : download=“" version="”Or do I misinterpret this information?
yes you have to name it like they say (it must be a standard name) inside that dir in the main jar file which is j2db.jar
to get the actual jnlp file you need to get the jnlp file that is downloaded from the browser (you don’t even have the main jnlp file on disk on the server like the plugins, its completely generated)
to get that file you can do:
https://yourhost:8080/servoy-client/MyS … p?raw=true
that raw=true will let you see the jnlp file as is in the browser (view source and you see it even better)
save that file to disk.The url you use to save it to disk, must be exactly the same as the url that you use to start the application. So that the contents of the jnlp file is exactly the same.
the client starts right?
that you still get that missing manifest attributes is i think just a problem/bug of the java jre itself.
i personally never have really played with that signed certificate stuff so i can’t say much more about it then what the docs say on the internet…
but from what i read it really has to be this name JNLP-INF/APPLICATION_TEMPLATE.JNLP (all capitals)