Found unsigned entry in resource

Question

i have the following JNLP file:

<jnlp spec="1.0+" codebase="http://****:****" href="tcm2012.jnlp">
  <information>
    <title>TCM 2012</title>
    <vendor>Drift og Performance, *** Servicecenter</vendor>
    <homepage href="http://******"/>
    <description/>
  </information>
  <security>
    <all-permissions/>
  </security>
  <resources>
    <j2se version="1.6+"/>
    <jar href="tcm2012.jar"/>
  </resources>
  <application-desc main-class="com.****.kundeservice.TCMApplication"/>
</jnlp>

Now when i try to run in from the web i get the following error:

Found unsigned entry in resource

With the following exepction

com.sun.deploy.net.JARSigningException: Found unsigned entry in resource: http://*****:****/tcm2012.jar
at com.sun.javaws.security.SigningInfo.getCommonCodeSignersForJar(Unknown Source)
at com.sun.javaws.security.SigningInfo.check(Unknown Source)
at com.sun.javaws.security.JNLPSignedResourcesHelper.checkSignedResourcesHelper(Unknown Source)
at com.sun.javaws.security.JNLPSignedResourcesHelper.checkSignedResources(Unknown Source)
at com.sun.javaws.Launcher.prepareResources(Unknown Source)
at com.sun.javaws.Launcher.prepareAllResources(Unknown Source)
at com.sun.javaws.Launcher.prepareToLaunch(Unknown Source)
at com.sun.javaws.Launcher.prepareToLaunch(Unknown Source)
at com.sun.javaws.Launcher.launch(Unknown Source)
at com.sun.javaws.Main.launchApp(Unknown Source)
at com.sun.javaws.Main.continueInSecureThread(Unknown Source)
at com.sun.javaws.Main.access$000(Unknown Source)
at com.sun.javaws.Main$1.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)

Does anyone know how to fix this problem?

Prussia

You need your jars to be signed for JNLP. – Meteorograph

@Meteorograph My jar is signed – Prussia

ok ..are they still valid though? – Meteorograph

They should be the program worked a few weeks ago – Prussia

What if their validity was valid until yesterday? – Meteorograph

@Meteorograph wouldnt the rest of my programs that have been signed the same way also stop working? – Prussia

Yes. It would stop working. – Meteorograph

This also check all the depedant jars as well . – Meteorograph

Examine carefully the output of jarsigner -verify tcm2012.jar using a 1.7.0_25+ (ideally) SDK. – Arteritis

See also #19441341 – Sather

Answer 1

This worked for me:

Go the Control Panel/Java.

Then click on “Settings” button and activate the option “Keep temporary files on my computer.”

It’s weird, but it worked!

Gonzalogoo

Also it's worth to examine the MANIFEST.MF of the (unsigned) jar mentioned in the JarSigningException. This phenomenon seems to be related to package version information entries (e.g. Name: com.package.foo) present in the manifest of the unsigned jar. See also: web.archive.org/web/20140301230037/http://blog.atlashost.eu:80/… – Smitty

Actually, there's a fresher link to the above content: nowaker.net/post/… (Looks like the author, Damian Nowak moved his blog to his own domain since 2014.) – Smitty

Answer 2

The problem can also occur with older Java Versions if you sign with a newer Java versions.

• Sign with 1.8u74 and older works with all versions
• Sign with 1.8u101 and newer works with 1.7u80 and newer but not with older versions on the client.

There seems a incompatible change in the sign algorithm.

Phytobiology

I installed "Java SE Runtime Environment 8u74" (jre-8u74-windows-i586.exe) from oracle.com/java/technologies/javase/… just as you directed. It solved the above problem. Many thanks, Horcrux7. – Coal

Answer 3

I had a similar problem with my applications.

I' ve a java swing application deployed with javaws:

• when I run the application using JRE 1.6 I get the exception
• when I run the application using JRE 1.7 and JRE 1.8 it works

I checked all the jar, MANIFEST.MF etc. and all was fine. Finally I discovered that I've used a new TSA endpoint to sign my jars.

• when I use this TSA http://tsa.starfieldtech.com the application run fine with JRE6,8
• when I use this TSA http://services.globaltrustfinder.com/adss/tsa the application runs only with JRE8

From this resource http://docs.oracle.com/javase/7/docs/technotes/tools/windows/jarsigner.html I read To generate the time stamp, jarsigner communicates with the TSA with the Time-Stamp Protocol (TSP) defined in RFC 3161. When successful, the time stamp token returned by the TSA is stored with the signature in the signature block file.

Someone can give more insight about this problem? In particular I don't want to be forced to use a particular TSA. Why there are this differences between TSA? Thanks

Dolly

Answer 4

I my case the applet really had unsigned entry in META-INF folder. ) One way to fix that would be to re-sign it. But in java 8 self-signed applets were demoted to almost the same level as unsigned ones. And the applet didn't required any additional privileges. So it was sufficient to just un-sign it and add to trusted sites list.

Sather

Answer 5

I had the same problem when compiling on my linux maschine (with JDK 6 U45). But I got this error only when I also tried to start the signed application with Java 6 U45.

When I try to start the application with a newer Java-Version (e.g Java 8) it was OK all the time, with no error message.

When I used a windows maschine to compile the project (also with 6 Update 45), it strangely works also when I use Java 6 U45 to start.

Just my 2 cents.... Cheers!

Vansickle