Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.java.programmer > #39025 > unrolled thread

jar signing

Back to article view | Back to comp.lang.java.programmer

Contents

  jar signing Eric Douglas <e.d.programmer@gmail.com> - 2019-07-30 05:24 -0700
    Re: jar signing Knute Johnson <groups@585ranch.com> - 2019-07-30 12:51 -0500
      Re: jar signing Eric Douglas <e.d.programmer@gmail.com> - 2019-07-30 12:26 -0700
        Re: jar signing Knute Johnson <nospam@rabbitbrush.frazmtn.com> - 2019-07-30 16:47 -0500
          Re: jar signing Eric Douglas <e.d.programmer@gmail.com> - 2019-07-31 05:51 -0700

#39025 — jar signing

My jdk 8 didn't seem to care but when I sign a jar now with OpenJDK 11 it says "Warning: The signer's certificate is self-signed".  Is this acceptable for making jars for an application that only runs on the local domain, or is there a better way to sign jars without paying for a certificate?  Like afaik you have to pay someone to get a certificate to make an https web site.

[toc] | [next] | [standalone]

#39031

On 7/30/2019 7:24 AM, Eric Douglas wrote:
> My jdk 8 didn't seem to care but when I sign a jar now with OpenJDK 11 it says "Warning: The signer's certificate is self-signed".  Is this acceptable for making jars for an application that only runs on the local domain, or is there a better way to sign jars without paying for a certificate?  Like afaik you have to pay someone to get a certificate to make an https web site.
> 

I don't know a lot about this but I did have at one point a code signing 
certificate that I purchased from GoDaddy.  I was using it for applets 
and webstart programs to be distributed on the internet.  I think I only 
paid about $200 for it but I can't remember for sure now.  What that 
gives you is some credibility that your code is in fact from you but 
mostly I think it gives the certificate provider some of your money :-).

As to self signing your code, I'm not sure what that gives you if it 
doesn't get out to un-trusted spaces.  And I am curious if you are 
signing applications or webstart programs or maybe your library jars?

knute...

[toc] | [prev] | [next] | [standalone]

#39033

On Tuesday, July 30, 2019 at 1:52:08 PM UTC-4, Knute Johnson wrote:
> On 7/30/2019 7:24 AM, Eric Douglas wrote:
> > My jdk 8 didn't seem to care but when I sign a jar now with OpenJDK 11 it says "Warning: The signer's certificate is self-signed".  Is this acceptable for making jars for an application that only runs on the local domain, or is there a better way to sign jars without paying for a certificate?  Like afaik you have to pay someone to get a certificate to make an https web site.
> > 
> 
> I don't know a lot about this but I did have at one point a code signing 
> certificate that I purchased from GoDaddy.  I was using it for applets 
> and webstart programs to be distributed on the internet.  I think I only 
> paid about $200 for it but I can't remember for sure now.  What that 
> gives you is some credibility that your code is in fact from you but 
> mostly I think it gives the certificate provider some of your money :-).
> 
> As to self signing your code, I'm not sure what that gives you if it 
> doesn't get out to un-trusted spaces.  And I am curious if you are 
> signing applications or webstart programs or maybe your library jars?
> 
> knute...

I sign all the jars used by our application on our internal domain.
We currently start the application by running a jnlp through Java 8 SE javaws.
I am now testing the jump to OpenJDK 11 hotspot, wondering if I can and should continue using this javaws (the last free publish under Java 8 update 202?) or how I can start the application using IcedTea or Openwebstart.

[toc] | [prev] | [next] | [standalone]

#39035

On 7/30/2019 14:26, Eric Douglas wrote:
> 
> I sign all the jars used by our application on our internal domain.
> We currently start the application by running a jnlp through Java 8 SE javaws.
> I am now testing the jump to OpenJDK 11 hotspot, wondering if I can and should continue using this javaws (the last free publish under Java 8 update 202?) or how I can start the application using IcedTea or Openwebstart.
> 

I thought Java web start was done in by unsolvable security issues.  I 
liked it however.  I haven't tried IcedTea or Openwebstart.  I don't 
think there is any javaws in 11 or 12.

I have used the recent OpenJDK versions on both Linux and Windows and 
have been quite happy with them, especially with the performance since 8.

I've got some Java application programs running in the field on Linux 
boxes and I just update those with sftp and a remote reboot.  They all 
report in periodically so I can check their status and one of those 
items is version so I know if somebody isn't up to date.  Web start was 
simpler.

-- 

Knute Johnson

[toc] | [prev] | [next] | [standalone]

#39044

On Tuesday, July 30, 2019 at 5:47:32 PM UTC-4, Knute Johnson wrote:
> I thought Java web start was done in by unsolvable security issues.  I 
> liked it however.  I haven't tried IcedTea or Openwebstart.  I don't 
> think there is any javaws in 11 or 12.
> 
> I have used the recent OpenJDK versions on both Linux and Windows and 
> have been quite happy with them, especially with the performance since 8.
> 
> I've got some Java application programs running in the field on Linux 
> boxes and I just update those with sftp and a remote reboot.  They all 
> report in periodically so I can check their status and one of those 
> items is version so I know if somebody isn't up to date.  Web start was 
> simpler.
> 

I thought webstart was supposed to be secure because it won't run your application unless it finds all the jars you specify with valid signatures?  I don't know too much about security issues, shouldn't be a concern for an application as long as it's only run on the local domain.  I just like that it's been easy deployment of client side Java updates, just wish it were easier to keep the clients on the correct JVM.  I saw something about automatically installing the required Java version with Java 11, not sure if it was using one of these webstart technologies or some kind of scripting.

The BBj language we work with (http://www.basis.com/bbj) supports Java 11 and IcedTea.  I'm not sure how IcedTea works, if that still involves a JNLP file, but I expect we still want all client side jars signed.  I can either use that because they've said they support it or look into Openwebstart (https://openwebstart.com/).  I've also seen the javaws from the Java 8 SE can be used to start a JVM session with Java 11.

I'm still trying to get my application running in my test environment on Java 11 but I believe we will see a performance improvement over Java 8.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.java.programmer

csiph-web