且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

如何在没有安全警告的情况下发布 Java Web Start jnlp 应用程序?

更新时间:2022-11-06 18:08:46

是的,你必须更新所有的 jars
您可以将这些属性直接添加到文件中的 jar 文件(所有 jar )的清单中 -

在你的插件目录中:

jar ufm 附加属性.txt

这个 additionalAttribute.txt 将包含您的附加清单属性,如 -

权限:所有权限代码库:*应用程序名称:我的应用程序调用者允许的代码库:*可信库:true应用程序库允许代码库:*

I have a Java application that is launched from a jnlp file off of a website. I'm trying to get it to run without flashing up a bunch of security warnings before it runs.

The program is broken up into about 10 different jar files, 30 or so jar libraries, and a couple native libraries also contained in jar files.

I've signed all of the jar files with an official code signing cert (from Verisign), included the jnlp file inside of the jar file that holds the main class, and added permissions and codebase attributes to the main 10 jars that I'm compiling.

When I launch the program I get the message stating:

This application will be blocked in a future Java security update because the JAR file manifest does not contain the Permissions attribute. Please contact the Publisher for more information.

I can click "Run" to get past this message, but then I get:

Block potentially unsafe components from being run? The application contains both signed and unsigned code.

I've added the permissions attribute to all of the jar files that I'm compiling. Do I have to update the jar manifest for the third-party libraries that I'm using as well? If so, is there an easy way to do this? I'm using Apache Ant to build the application.

Yes , you have to update all jars
You can add these properties directly into manifest of the jar files (all jars) from a file -

In your plugins directory :

jar ufm <jar_file> additionalAttribute.txt

This additionalAttribute.txt will contain your additional manifest attribute like -

Permissions: all-permissions  
Codebase: *  
Application-Name: My App  
Caller-Allowable-Codebase: *  
Trusted-Library: true
Application-Library-Allowable-Codebase: *