This Bugzilla instance is a read-only archive of historic NetBeans bug reports. To report a bug in NetBeans please follow the project's instructions for reporting issues.

Bug 237058 - NetBeans IDE stopped signing my jars
Summary: NetBeans IDE stopped signing my jars
Status: RESOLVED WONTFIX
Alias: None
Product: projects
Classification: Unclassified
Component: Java Webstart (show other bugs)
Version: 7.4
Hardware: PC Windows 7
: P3 normal with 1 vote (vote)
Assignee: Tomas Zezula
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-10-12 11:18 UTC by anilp1
Modified: 2016-07-07 08:38 UTC (History)
1 user (show)

See Also:
Issue Type: DEFECT
Exception Reporter:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description anilp1 2013-10-12 11:18:34 UTC
NB 7.4RC2, Win 7
I am signing my Web Start application with trusted certificates.
However, the 3rd party jars in dist/lib seem to be unsigned.

C:\Program Files (x86)\Java\jdk1.7.0_40\bin\jarsigner" -verify javafx-dialogs-0.0.3.jar
jar is unsigned. (signatures missing or not parsable) 

So when I run my application in the debugger, it refuses to start complaining of unsigned jars
ExitException[ 3]com.sun.deploy.net.JARSigningException: Found unsigned entry in resource: file:/C:/Users/me/Documents/NetBeansProjects/MyApp/dist/lib/RXTXcomm.jar
I get the same error when I run with self signed jars, “Found unsigned entry in resource”. It is as if NetBeans stopped signing the jars.

I deleted all temporary files in the Java cache from Java Control Panel. Now it fails to run clicking both Run and Debug in the IDE, and also copying the dist folder to the desktop and clicking the jnlp file.

ExitException[ 3]com.sun.deploy.net.JARSigningException: Found unsigned entry in resource: file:/C:/Users/me/Desktop/dist/lib/RXTXcomm.jar

while building:

Warning: 
The signer certificate will expire within six months.
Signing JAR: C:\Users\me\Documents\NetBeansProjects\MyApp\dist\lib\RXTXcomm.jar to C:\Users\me\Documents\NetBeansProjects\MyApp\dist\lib\RXTXcomm.jar as my_key54321

while running:

network: Cache entry found [url: file:/C:/Users/me/Documents/NetBeansProjects/MyApp/dist/lib/RXTXcomm.jar, version: null] prevalidated=false/0
cache: Adding MemoryCache entry: file:/C:/Users/me/Documents/NetBeansProjects/MyApp/dist/lib/RXTXcomm.jar
cache: Resource file:/C:/Users/me/Documents/NetBeansProjects/MyApp/dist/lib/RXTXcomm.jar has expired.
network: ResponseCode for file:/C:/Users/me/Documents/NetBeansProjects/MyApp/dist/lib/RXTXcomm.jar : 200
network: Encoding for file:/C:/Users/me/Documents/NetBeansProjects/MyApp/dist/lib/RXTXcomm.jar : null
CacheEntry[file:/C:/Users/me/Documents/NetBeansProjects/MyApp/dist/lib/RXTXcomm.jar]: updateAvailable=false,lastModified=Wed Feb 04 19:07:10 CST 2009,length=60866

........
security: Trust for: file:/C:/Users/me/Documents/NetBeansProjects/MyApp/dist/lib/RXTXcomm.jar has ended: Wed Dec 31 18:00:00 CST 1969
Comment 1 anilp1 2013-10-12 11:34:29 UTC
In Java Control Panel, the "Keep Temporary Internet Files" checkbox is checked.
Comment 2 anilp1 2013-10-12 12:44:08 UTC
Update: In NetBeans, I selected Project Properties and under Run, selected Run As “default configuration”. Earlier, Run As “WebStart” was selected. Now it starts normally. Was it a NetBeans bug or a feature?
Comment 3 Tomas Zezula 2013-10-14 15:20:44 UTC
>However, the 3rd party jars in dist/lib seem to be unsigned.
Only the NetBeans generated archive is signed by a key. The other jar files are kept unmodified (they may be already signed). However we consider to change this as in future the javaws is going to require all jars to be signed and have codebase and permission attribute.

Please can you attach Ant debug output of the running the application in Web Start configuration?

You will need to set Tools/Options/Java/Ant/Verbosity Level set to Debug.
Thans
Comment 4 unai 2013-11-21 18:00:26 UTC
Same problem here: a JavaFX in Swing JWS project, which uses, as libraries, other projects (jars in those projects' dist folders are taken by ant -- and rebuilded if the library project has changes).

I found out that Clean&Build does sign all the jars in lib: if, right after doing Clean&Build you do a jarsigner -verify on your lib jars they actually are verified as signed.
If you manually run your application, by opening the jnlp from your filesystem under dist, everything is OK, JWS sees everything as properly signed (all jar libs have been correctly re-signed with your certificate).

*BUT*, if you try to run it as a JWS application from within NetBeans: Set configuration -> Run as Webstart; and then Run
then all jars in lib are pulled in again, overwritten with unsigned versions!

So,
either Run should leave jars in lib alone, because they already are correctly signed by Clean&Build,
or, if for some reason NB must pull-in fresh copies, it should go through the signing process again (the very same used by Clean&Build, which worked).

I would say that first option is the one that makes more sense: when *Run*ning your application, there is no need to regenerate all the jars in lib (well, unless the source projects get modified maybe?), because you want that to happen only when you Clean&Build.
Comment 5 Martin Balin 2016-07-07 08:38:29 UTC
This old bug may not be relevant anymore. If you can still reproduce it in 8.2 development builds please reopen this issue.

Thanks for your cooperation,
NetBeans IDE 8.2 Release Boss