.jar Signing

[kwpsd]

Servoy 6.1.4
Smart Client

I have been using the jPedal bean (for processing PDF documents) in Developer, and it has been working fine. However, when I uploaded the bean to a customer's Servoy production server, the server emitted the following exception message:

com.sun.deploy.net.JARSigningException: Found unsigned entry in resource: (http://255.255.255.255:8080/beans/jpedal.jar, 1374268843709)
at com.sun.javaws.security.SigningInfo.getCommonCodeSignersForJar(Unknown Source)
at com.sun.javaws.security.SigningInfo.check(Unknown Source)
at com.sun.javaws.security.JNLPSignedResourcesHelper.checkSignedResourcesHelper(Unknown Source)
at com.sun.javaws.security.JNLPSignedResourcesHelper.checkSignedResources(Unknown Source)
at com.sun.javaws.Launcher.prepareResources(Unknown Source)
at com.sun.javaws.Launcher.prepareAllResources(Unknown Source)
at com.sun.javaws.Launcher.prepareToLaunch(Unknown Source)
at com.sun.javaws.Launcher.prepareToLaunch(Unknown Source)
at com.sun.javaws.Launcher.launch(Unknown Source)
at com.sun.javaws.Main.launchApp(Unknown Source)
at com.sun.javaws.Main.continueInSecureThread(Unknown Source)
at com.sun.javaws.Main.access$000(Unknown Source)
at com.sun.javaws.Main$1.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)

From the message, I suspect the bean's .jar file needs to be signed. Is this something I have to do, or does this need to be done by the bean's creators? If I have to sign the bean, do I use the Sign Tester tool on Servoy Forge for this?

Also, why does the bean work in Developer but not on the Server? Is it because Developer does not check for signed .jar files? (Just wondering why the exception did not pop up in Developer)

My apologies for the questions, but the .jar signing is new to me. The customer is anxious to get things running, so I could use some immediate guidance. Thanks!

[Kaptan]

Indeed it is not checked in developer, but in production you need to sign the (3rd party) jar's, the ones that are already deployed with Servoy are already signed.
As stated in the Wiki, this is a security measure since java 6 upd 19. The tutorial in the wiki has all the details:

http://wiki.servoy.com/display/public/tutorials/JAR+signing

[kwpsd]

Thanks for the direction, Sem. The wiki instructions appear straight forward, and I will give it a try.

[kwpsd]

The wiki states that all .jar files from Servoy will be signed, yet, when I run 'signtester' on my 6.1.4 development system, the following was flagged as not signed:

C:\Servoy6_1\application_server\.\lib\wicket-extentions.jar didnt verify

Who is responsible for signing the 'wicket-extentions.jar' file, Servoy or the developer?