Servoy Forum

See http://wiki.servoy.com/x/SpV7 for a comprehensive overview of running Servoy i.c.w. Java 6 update 19

Paul

Hi. I followed all steps in the referenced wiki.

Everything went smoothly, until I went to have the client connect.

I got this error:

Code: Select all

JAR resources in JNLP file are not signed by same certificate

JNLPException[category: Launch File Error : Exception: null : LaunchDesc:
<jnlp spec="1.0+" codebase="http://192.168.1.115:8080/" href="http://192.168.1.115:8080/servoy-client/plugins/pdf_output.jar.jnlp">
  <information>
    <title>Servoy Client Plugins</title>
    <vendor>Servoy and Others</vendor>
    <homepage href="null"/>
    <offline-allowed/>
  </information>
  <security>
    <all-permissions/>
  </security>
  <update check="timeout" policy="always"/>
  <resources>
    <jar href="http://192.168.1.115:8080/plugins/pdf_output.jar" version="1271907936370" part="pdfoutput" download="eager" main="false"/>
    <jar href="http://192.168.1.115:8080/plugins/pdf_output/itext.jar" version="2.0.3" part="itext" download="eager" main="false"/>
    <jar href="http://192.168.1.115:8080/plugins/pdf_output/bcmail-jdk14-135.jar" version="1.35.0" part="bouncycastle" download="eager" main="false"/>
    <jar href="http://192.168.1.115:8080/plugins/pdf_output/bcprov-jdk14-135.jar" version="1.35.0" part="bouncycastle" download="eager" main="false"/>
    <package name="com.lowagie." part="itext" recursive="true"/>
    <package name="org.bouncycastle." part="bouncycastle" recursive="true"/>
  </resources>
  <component-desc/>
</jnlp> ]
   at com.sun.javaws.LaunchDownload.checkSignedResourcesHelper(Unknown Source)
   at com.sun.javaws.LaunchDownload.checkSignedResources(Unknown Source)
   at com.sun.javaws.Launcher.prepareLaunchFile(Unknown Source)
   at com.sun.javaws.Launcher.prepareToLaunch(Unknown Source)
   at com.sun.javaws.Launcher.launch(Unknown Source)
   at com.sun.javaws.Main.launchApp(Unknown Source)
   at com.sun.javaws.Main.continueInSecureThread(Unknown Source)
   at com.sun.javaws.Main$1.run(Unknown Source)
   at java.lang.Thread.run(Unknown Source



I cleared the cache on the client, still same error.

Any ideas on this one?

Client is on Windows XP - Java 1.6.0
Server is Windows 7 running Servoy 4.1.6

Apparently the jars described in the jnlp are not all signed using the same keystore.
Are you sure all these jar are signed with the same keystore:

• pdf_output.jar
• itext.jar
• bcmail-jdk14-135.jar
• bcprov-jdk14-135.jar

When you run signtester.jar to detect the ones which are not signed, does it detects all of them or just a few?

the problem here is again the version attributes in these:

<jar href="http://192.168.1.115:8080/plugins/pdf_output/itext.jar" version="2.0.3" part="itext" download="eager" main="false"/>
<jar href="http://192.168.1.115:8080/plugins/pdf_output/bcmail-jdk14-135.jar" version="1.35.0" part="bouncycastle" download="eager" main="false"/>
<jar href="http://192.168.1.115:8080/plugins/pdf_output/bcprov-jdk14-135.jar" version="1.35.0" part="bouncycastle" download="eager" main="false"/>

instead of version="1.35.0" make it version="%%version%%"

Hi,
Ive just used the signing tool following the instructions on the wiki, i managed to sign everything. Now after this i installed one of the newely signed jars on the server (where i couldnt install it before because it was unsigned and my app wouldnt work) and the app is downloaded and verified correctly(i dont get any error for unsigned jars), but my client freezes while loading. I tryied it on another pc and it works, i erased the java webstart cache and its still no good.
Im getting this error on the server log:

2010-07-19 17:18 ClientExportNotifyListner[6] ERROR com.servoy.j2db.util.Debug Signalling channel lost when reading pings or client export notifies, removing ports: []
I/O exception, see log for full details: Connection reset

Any idea what could it be? Im using servoy 5.1.2 and JRE 6.20
Thanks.

Do enable the java webstart console for that specific pc.
And do wait at least a few minutes (to see if it really doesnt report a time out error)

This looks more of a connection problem with that specific pc. Is it behind a firewall? or are there virus scannners on that pc that maybe could interfere?

Do enable the java webstart console for that specific pc.

How do i do that?

The thing is that the client worked just fine before i started the procces of signing the jars, i didnt changed any configuration or anything else. Once i finished signing and intalled the plugin on the server it stopped working on this pc

singing the jars shouldnt matter at all on the execution (when the client does start up and you see the main window)
If there where stuff related to signing it should have reported it a bit earlier.

In the java preferences (in the control panel of windows) you can enable the java console.

i enabled the console and the only difference is that now i see a security popout saying that java detected application components that may denote security problems, and it asks if i want to prevent their execution but i get no chance to answer since it all freezes, the client, the console and the popout.

The dialog has a bug in it that prevents the user from allowing some jars to execute.
What you could do on this client - as a workaround until the next update correct this bug - is to disable the mix-code verification.

Go to the java panel, in the advanced tab, under the security node / mix code, and choose to disable the verification.
Then restart your app, the dialog should not appear again.

the error sounds also a lot that you dont have signed everything..
You have to sign everything also 3th party plugins.

I disabled the verification and it works now, thanks a lot patrick.
Is there any idea of when will this be fixed?

regarding to what u said johan isnt the signtester supposed to check every plugin? (even 3rd party ones?) If i run it, every plugin passes, no one fails to validate. So i dont know what could be the problem

Hum, there's one case where the signtester tool would not operate: if you use the overwrite option to resign ALL the jars, one jar that will never be resigned is the /beans/swingbeans.jar - I have added an explicit test about it in the JarUnsigner class.

FYI, the overwrite options does this:
foreach jar (except swingbeans.jar)
unsign = { unjar, remove all signature files, jar again }
sign using the keystore provided
end

This is because the sign tool was not capable of signing the swingbeans.jar which is empty (apart from the manifest), so I avoid unsigning it because re-signing it will fail. Now what can happen is that if you resign all your jars and you have the swingbeans.jar in the /beans subfolder, you might still have an alert about mix-code because the signature will not be the same (and I believe that Servoy is loading all the beans using one jnlp extension)

Johan, maybe this particular jar could be loaded apart from all the others?
Or do you have a suggestion to sign this one using the signtester tool?

that jar isnt loaded to the client.
Just look at the generated jnlp file, in the later version (released after 6.19) swing beans is not included
That one is only really needed in the developer.

But that mixed mode checking should only happen if there is signed and none signed code, so with a default install and the default java settings do you have the same problem?

I have the same problem, this is a way to unsigning jars

jar xf name.jar -- extract the jar
remove the META DATA.
remove the jar
jar cf name.jar org/ License/ README.TXT

jar xf extract jar
jar cf create jar

after that sign the jar

jarsigner -keystore name.ks -storepass password -keypass password name.jar alias
jarsigner -verify name.jar