javaappletsigned-appletsigner

Why access denied (java.lang.RuntimePermission setSecurityManager) in my java Applet?


I had an existing very very old java applet which use :

<dependency>
    <groupId>com.al6</groupId>
    <artifactId>rxtx</artifactId>
    <version>2.1.7</version>
</dependency>
<dependency>
    <groupId>java</groupId>
    <artifactId>plugin</artifactId>
    <version>1.6.12</version>
</dependency>

In the lib directory of the project there is :

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-jar-plugin</artifactId>
    <executions>
        <execution>
            <goals>
                <goal>sign</goal>
            </goals>
        </execution>
    </executions>
    <configuration>
        <keystore>.keyticket</keystore>
        <alias>ticket</alias>
        <storepass>ticket</storepass>
        <keypass>katana</keypass>
        <!--
            signedjar>${project.build.directory}/signed/${project.build.finalName}.jar</signedjar
        -->
        <verify>false</verify>
    </configuration>
</plugin>

The project runs well on a java 1.6 environment, builded by a java 1.6 server.

But if I build it on a new java 1.8 server, and runs with java 1.8, I have a lots of major.minor errors because some old sub-librairies are used by this project.

So to avoid problems, I keep this in the pom.xml :

<configuration>
    <source>1.6</source>
    <target>1.6</target>
    <encoding>UTF-8</encoding>
</configuration>

The project compile and runs, but I had a :

access denied java.lang.RuntimePermission setSecurityManager)

enter image description here

I supposed my jar is not signed. I see that the existing ".keyticket" used to sign seems to not use a valid level of sign for java 1.8. So I modify java.security on the build machine to accept the old sign process. The jar seems signed :

enter image description here


Solution

  • Finally, I generate a new certificate for my jar using :

    /opt/jdk/bin/keytool -genkey -keyalg RSA -alias myFirstKey -keystore myKeystore -validity 360
    

    And I add the new file in the maven task to sign it :

    <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-jar-plugin</artifactId>
                    <executions>
                        <execution>
                            <goals>
                                <goal>sign</goal>
                            </goals>
                        </execution>
                    </executions>
                    <configuration>
                        <keystore>myKeystore</keystore>
                        <alias>myFirstKey</alias>
                        <storepass>keypass</storepass>
                        <keypass>keypass</keypass>
                        <!--
                            signedjar>${project.build.directory}/signed/${project.build.finalName}.jar</signedjar
                        -->
                        <verify>false</verify>
                    </configuration>
                </plugin>
    

    And it works perfectly now.