All --
Is it at all possible to have an unsigned applet download a signed jar that does execution on the client's machine? In other words, I don't want to sign the applet, just the jar that does all the work. I'm having a bit of trouble signing a jar and getting all these things to play nice together.
Thanks -
Short answer: Maybe
Long answer:
If java code runs in a securety manager and a piece of code has extra privilegtes than
those privileges are only granted if the entire stack has that privilege (like writing to the
local filesystem)
Example
You have an unsigned jar containing class1 and a signed jar containing class2
The html file looks like this:
<object ...>
<param name=archive value="1.jar,2.jar" />
<param name="code" value="class1.class" />
</object>
Now when class1 calls methods of class2 (wich should work just fine because both
jars are downloaded) a security exception will be thrown if class2 trys to (for example)
write to the local filesystem. This is because the call came from an unsigned applet.
You might try the following sollution:
http://forum.java.sun.com/thread.jsp?forum=63&thread=524815
second post
Calls came from the plugin.jar directly, that didn't work. But if the plugin changed
variables in my class and my class had a looping thread (started in my applet) that
checks for those variables and does something when they change. It did work.
Thanks for responding.
Interesting. The only difference is that class1 won't call methods of class2. What I'd like to do is for the applet to download a jar that has a main method, and have that application launched and take over. In other words, use the applet in a similar fashion to the way Java Web Start works (though it has to be an applet).
So, you go to the page, the applet makes a call back to the server, downloads the jar into memory, and then executes the main method in that jar. Is that possible?
Thanks for the other link... I'm going to check that out now. And thanks for the response, it is much appreciated.