As of Java 6 update 19 all beans, plugins and additional plugin/bean libraries in a Servoy installation need to be signed, due to tighter security restrictions in Java WebStart.
Without signing, Java WebStart will present the user with a warning dialog upon starting a Servoy Smart Client. Due to bugs in Java 6 update 19, this dialog cannot be dismissed, effectively stopping the user from using the Servoy Smart Client.
As of Servoy versions 5.1.2, 4.1.6 and 3.5.11, a default Servoy installation will only contain properly signed libraries and thus works out-of-the-box.
However, when additional beans and/or plugins (with or without additional libraries) are added to the Servoy installation, they need to be properly signed as well. Most 3rd party plugin and bean developers have released new versions of their plugins and/or beans with proper signing (or will do so shortly). However, if those are not (yet) available, the existing libraries need to be signed "manually".
This tutorial explains the process of signing unsigned libraries in Servoy installations.
This tutorial should only be followed when running a Servoy Application Server that contains 3rd party plugins and/or beans that are not signed. This tutorial is not applicable for default installations. |
"Signing" a library (.jar file) means the manifest.mf file (which is contained in the .jar file) will contain MD5 hashes for the contained classes. This way, when the library is used in a Java program, the Java program can verify the signatures and thus the integrity of signed JAR files.
The signing of a library is done using a certificate. There are two types of certificates:
See Creating a keystore with a self signed certificate for instructions how to create a self signed certificate
See Authorize a self signed certificate by a trusted 3rd party Certificate Authority for instructions how to create a certificate signed by a trusted 3rd party.
Once a certificate is available for signing, proceed to the next paragraph for more information on how to sign all unsigned beans and plugins.
Servoy has donated a tool to quickly validate the entire Servoy Application Server for the existence of unsigned libraries and optionally sign the unsigned libraries as well. For further support please go to ServoyForge
Download
The Validation & Sign tool can be downloaded here.
Installation
Unzip the downloaded file into the ../application_server directory of the Servoy Application Server
Installation validation
To validate the Servoy Application Server installation, execute the following command from the command line in the ../application_server directory
java -jar signtester.jar |
If the tool finds unsigned libraries, it will report them.
Signing unsigned libraries
If the installation contains unsigned libraries for which no signed version is available, the Validation & Sign tool can be used to sign all the unsigned libraries. In order to sign the libraries a certificate is required, see #Library signing for more information on obtaining a certificate.
Make sure the Servoy Application Server has been shut down, then run the Validation & Sign tool again with the following arguments:
java -jar signtester.jar mykeystore.ks yourpassword MyPlugins |
Before running the Validation & Sign tool to sign libraries, shut down the Servoy Application Server. It the Servoy Application Server is running, the libraries will not be properly signed. |
This will effectively sign all previously unsigned libraries with the provided certificate. After completing this step, proceed to the next paragraph.
When the Servoy installation utilized third party plugins that have dependencies on additional libraries which are managed through a plugin specific .jnlp file, the jnlp files also needs to be modified. The following needs to be added to the JNLP:
<security> <all-permissions/> </security> |
All plugins in a Servoy installation are located in the ../application_server/plugins folder. The folder contains all the plugins that ship with Servoy by default plus any additional plugins that might have been added. When done properly, all .jar files in the directory are plugins and required additional libraries are located in sub directories. Plugin specific .jnlp files have the same name as the plugin they belong to, but with the extension.jar.jnlp instead of just .jar |
When the libraries are signed and the plugin jnlp files are updated, the Servoy Application Server can be started again and Servoy Smart Client should be able to connect again.
When still experiencing problems, first clear the Java WebStart cache on the client machine and see if the problem persists. If it persists, please post your findings on the Servoy Forum in this topic.