使用 Maven jar 插件和 Bouncy Castle 签名 Applet

Question

我对已签名的 Java 小程序有疑问 - 具体来说，为什么它不使用我的证书进行签名。我在 Eclipse 中使用 Maven。

小程序 (a) 允许用户选择本地文件或目录，(b) 加密文件，以及 (c) 将文件上传到基于 PHP 的网页。该小程序已签名，大概使用我的证书 - 即通过 Maven 代码，使用 maven-jar 插件。例如：

<plugin>                
   <groupId>org.apache.maven.plugins</groupId>
   <artifactId>maven-jar-plugin</artifactId>                
<executions>

符号

/
/图片/ src/main/resources/META-INF/MANIFEST.MF 错误的 [PATH_TO_MY_KEYSTORE] [我的别名] [*****] [*****] [PATH_TO_SIGNED_JAR] 真的 真的

（显然，我已经掩盖了其中的一些内容，因为我为偏执的 git 工作！）一切都很好地打包，并且小程序加载到页面中；然而，有两件事很麻烦：（1）当小程序加载时，它会将 Legion of Bouncy Castle 识别为用于签署小程序的证书；（2）当小程序使用 JFileChooser 可以访问文件系统时，“访问尝试执行上面的 (c) 并将文件发送到网站时，会抛出“拒绝”权限（对文件）。 （我使用 Apache HTTP 组件来执行此操作。）

我的小程序与依赖的 jar 分开打包 - 包括 Bouncy Castle jar。

我的问题是：为什么 BC 是我的小程序的签名者，而不是我自己的证书（如上所述）？这是 Maven 的问题吗？当然，在开发过程中，一切都工作正常，因为 Eclipse 为 Applet Viewer 编写了策略文件。

这是 Eclipse 中的输出片段 - 看起来一切都应该很顺利：

[DEBUG] Configuring mojo 'org.apache.maven.plugins:maven-jar-plugin:2.2:sign' with basic configurator -->
[DEBUG]   (s) alias = myalias
[DEBUG]   (s) basedir = C:\..\target
[DEBUG]   (f) finalName = app-0.0.1-SNAPSHOT
[DEBUG]   (s) jarPath = C:\..\app-0.0.1-SNAPSHOT.jar
[DEBUG]   (s) keypass = 1234
[DEBUG]   (s) keystore = C:\..\my.keystore
[DEBUG]   (s) project = MavenProject: App:app:0.0.1-SNAPSHOT @ C:\..\app\pom.xml
[DEBUG]   (f) signedjar = C:\..\signed.jar
[DEBUG]   (f) skip = false
[DEBUG]   (s) storepass = 1234
[DEBUG]   (s) verbose = true
[DEBUG]   (s) verify = true
[DEBUG]   (f) workingDirectory = C:\..\app
[DEBUG] -- end configuration --
[INFO] [jar:sign]
[DEBUG] Setting context classloader for plugin to: /plugins/org.apache.maven.plugins:maven-jar-plugin:2.2@48/thread:main (instance is: ClassRealm[/plugins/org.apache.maven.plugins:maven-jar-plugin:2.2@48/thread:main, parent: ClassRealm[plexus.core, parent: null]])
[DEBUG] jarsigner executable=[C:\Java\jdk1.6.0_16\jre\..\bin\jarsigner.exe]
[DEBUG] mdkirs: false C:\..\app
[DEBUG] Executing: cmd.exe /X /C '"C:\Java\jdk1.6.0_16\jre\..\bin\jarsigner.exe -verbose -keystore C:\...\my.keystore -storepass ****** -keypass ****** -signedjar C:\...\signed.jar C:\...\target\app-0.0.1-SNAPSHOT.jar myalias"'
[INFO]  updating: META-INF/MANIFEST.MF
[INFO]    adding: META-INF/APP.SF
[INFO]    adding: META-INF/APP.RSA
[INFO]    adding: com/
[INFO]    adding: com/applet/
  ...
[INFO]    adding: images/
[INFO]   signing: com/applet/DemoApplet$1.class
[INFO]   signing: log4j.xml
[INFO]   signing: target.classes
[debug] jarsigner executable=[C:\Java\jdk1.6.0_16\jre\..\bin\jarsigner.exe]
[debug] Executing: cmd.exe /X /C '"C:\Java\jdk1.6.0_16\jre\..\bin\jarsigner.exe -verify -verbose C:\...\signed.jar"'

任何帮助将不胜感激。谢谢。顺便说一句，这是堆栈跟踪：

General exception: access denied (java.io.FilePermission C:\Documents and Settings\Paul\My Documents\text.txt read)
java.security.AccessControlException: access denied (java.io.FilePermission C:\Documents and Settings\Paul\My Documents\text.txt read)
at java.security.AccessControlContext.checkPermission(Unknown Source)
at java.security.AccessController.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkRead(Unknown Source)
at java.io.File.isFile(Unknown Source)
at sun.awt.shell.ShellFolder.isFile(Unknown Source)
at org.apache.commons.httpclient.methods.multipart.FilePartSource.<init>(FilePartSource.java:68)
at com.securustek.applet.DemoApplet.sendFiles(DemoApplet.java:1098)
at com.securustek.applet.DemoApplet.actionPerformed(DemoApplet.java:448)
at javax.swing.AbstractButton.fireActionPerformed(Unknown Source)
at javax.swing.AbstractButton$Handler.actionPerformed(Unknown Source)
at javax.swing.DefaultButtonModel.fireActionPerformed(Unknown Source)
at javax.swing.DefaultButtonModel.setPressed(Unknown Source)
at javax.swing.plaf.basic.BasicButtonListener.mouseReleased(Unknown Source)
at java.awt.AWTEventMulticaster.mouseReleased(Unknown Source)
at java.awt.Component.processMouseEvent(Unknown Source)
at javax.swing.JComponent.processMouseEvent(Unknown Source)
at java.awt.Component.processEvent(Unknown Source)
at java.awt.Container.processEvent(Unknown Source)
at java.awt.Component.dispatchEventImpl(Unknown Source)
at java.awt.Container.dispatchEventImpl(Unknown Source)
at java.awt.Component.dispatchEvent(Unknown Source)
at java.awt.LightweightDispatcher.retargetMouseEvent(Unknown Source)
at java.awt.LightweightDispatcher.processMouseEvent(Unknown Source)
at java.awt.LightweightDispatcher.dispatchEvent(Unknown Source)
at java.awt.Container.dispatchEventImpl(Unknown Source)
at java.awt.Window.dispatchEventImpl(Unknown Source)
at java.awt.Component.dispatchEvent(Unknown Source)
at java.awt.EventQueue.dispatchEvent(Unknown Source)
at java.awt.EventDispatchThread.pumpOneEventForFilters(Unknown Source)
at java.awt.EventDispatchThread.pumpEventsForFilter(Unknown Source)
at java.awt.EventDispatchThread.pumpEventsForHierarchy(Unknown Source)
at java.awt.EventDispatchThread.pumpEvents(Unknown Source)
at java.awt.EventDispatchThread.pumpEvents(Unknown Source)
at java.awt.EventDispatchThread.run(Unknown Source)

再次感谢。

Answer 1

我不确定，但这可能是因为证书本身的安全访问问题......我的意思是它可能会过期。是新创建的吗？
但仍然应该有更多的细节需要分析...

您检查过 MANIFEST 类结构吗？他们都签名了吗？