RE: Gbean within a signed jar
I am working on an example to highlight the issue, and will create a JIRA issue. I am having trouble figuring out how to attach a file to a JIRA issue. Where should I be looking? Thanks, Yoel -Original Message- From: [EMAIL PROTECTED] on behalf of Aaron Mulder Sent: Fri 2/16/2007 2:24 PM To: user@geronimo.apache.org Cc: Subject: Re: Gbean within a signed jar Can you create a Jira issue to investigate that approach? I'm not sure whether it would work but it sounds like it's worth following up on. If you can attach a small example that demonstrates the problem, that would be great too. (If nothing else, maybe we could just try the repackaging approach if we notice that the original JAR was signed.) Thanks, Aaron On 2/16/07, Spotts, Joel (ISS Atlanta) [EMAIL PROTECTED] wrote: Is it possible the geronimo code creates the proxy in the same package as the target class? If the proxy was created in a different package (like proxy.targetclass proxy), IIRC, no SecurityException would be thrown. Thanks, Yoel -Original Message- From: Dain Sundstrom [mailto:[EMAIL PROTECTED] Sent: Mon 2/12/2007 10:23 PM To: user@geronimo.apache.org Cc: Subject: Re: Gbean within a signed jar Alternatively, just change the code that complains about the signature. We could add a flag to the Geronimo class loader to hide all signing data. -dain winmail.dat
Re: Gbean within a signed jar
On Feb 20, 2007, at 11:08 AM, Spotts, Joel ((ISS Atlanta)) wrote: I am working on an example to highlight the issue, and will create a JIRA issue. I am having trouble figuring out how to attach a file to a JIRA issue. Where should I be looking? Sounds great. Thanks Yoel. For an existing Jira, there's an Attach file to this issue operation (in left hand column). So, you'll need to create the issue first, then attach... --kevan
RE: Gbean within a signed jar
Is it possible the geronimo code creates the proxy in the same package as the target class? If the proxy was created in a different package (like proxy.targetclass proxy), IIRC, no SecurityException would be thrown. Thanks, Yoel -Original Message- From: Dain Sundstrom [mailto:[EMAIL PROTECTED] Sent: Mon 2/12/2007 10:23 PM To: user@geronimo.apache.org Cc: Subject: Re: Gbean within a signed jar Alternatively, just change the code that complains about the signature. We could add a flag to the Geronimo class loader to hide all signing data. -dain winmail.dat
Re: Gbean within a signed jar
Can you create a Jira issue to investigate that approach? I'm not sure whether it would work but it sounds like it's worth following up on. If you can attach a small example that demonstrates the problem, that would be great too. (If nothing else, maybe we could just try the repackaging approach if we notice that the original JAR was signed.) Thanks, Aaron On 2/16/07, Spotts, Joel (ISS Atlanta) [EMAIL PROTECTED] wrote: Is it possible the geronimo code creates the proxy in the same package as the target class? If the proxy was created in a different package (like proxy.targetclass proxy), IIRC, no SecurityException would be thrown. Thanks, Yoel -Original Message- From: Dain Sundstrom [mailto:[EMAIL PROTECTED] Sent: Mon 2/12/2007 10:23 PM To: user@geronimo.apache.org Cc: Subject: Re: Gbean within a signed jar Alternatively, just change the code that complains about the signature. We could add a flag to the Geronimo class loader to hide all signing data. -dain
RE: Gbean within a signed jar
Kevan, How do I turn off proxy generation? What do you mean by breaking admin console? I wont be able to control that app from the admin console? Are there other side effects? Thanks, Yoel _ From: Kevan Miller [mailto:[EMAIL PROTECTED] Sent: Saturday, February 10, 2007 12:56 PM To: user@geronimo.apache.org Subject: Re: Gbean within a signed jar On Feb 6, 2007, at 2:54 PM, Spotts, Joel ((ISS Atlanta)) wrote: I have a gbean packaged within a signed jar that is placed in my EAR. Trouble is it seems that geronimo uses proxy classes on the gbean class files, which results in the dreaded: java.lang.SecurityException: class ...'s signer information does not match signer information of other classes in the same package when geronimo attempts to start the gbean. Anyone have a solution to this problem other than not signing the jar? Hi Yoel, Interesting. First I've heard of this problem, but it makes sense. I don't really have a solution for you. 1) As you suggest, don't sign your jar... :-P 2) Turn off proxy generation in the server. This, however, has the unfortunate side-effect of breaking the admin console. So, this really isn't much of an option. Perhaps somebody else can chime in... --kevan
Re: Gbean within a signed jar
On Feb 12, 2007, at 11:27 AM, Spotts, Joel ((ISS Atlanta)) wrote: Kevan, How do I turn off proxy generation? What do you mean by breaking admin console? I wont be able to control that app from the admin console? Are there other side effects? Hi Yoel, Disable proxy generation like this: export JAVA_OPTS=-DXorg.apache.geronimo.gbean.NoProxy=true ./geronimo.sh run Server startup will be a few seconds faster. You should see a log entry like this: 14:28:05,885 WARN [AbstractGBeanReference] GBean reference proxies has been disabled: This is an experimental and untested operating mode Starting Geronimo Application Server v1.1.1 It's my understanding that there are some admin console functions that won't work, with NoProxy. I must confess that I don't know what specific features they are... Generated GBean proxies give the admin console a common management GBean interface to work with. Without proxies some GBean inspection/ management functions won't work. I ran a quick test with NoProxy -- starting stopping web apps, etc -- and didn't run into any errors. Perhaps someone better versed in our console implementation can explain what exactly won't work... --kevan Thanks, Yoel From: Kevan Miller [mailto:[EMAIL PROTECTED] Sent: Saturday, February 10, 2007 12:56 PM To: user@geronimo.apache.org Subject: Re: Gbean within a signed jar On Feb 6, 2007, at 2:54 PM, Spotts, Joel ((ISS Atlanta)) wrote: I have a gbean packaged within a signed jar that is placed in my EAR. Trouble is it seems that geronimo uses proxy classes on the gbean class files, which results in the dreaded: java.lang.SecurityException: class ...'s signer information does not match signer information of other classes in the same package when geronimo attempts to start the gbean. Anyone have a solution to this problem other than not signing the jar? Hi Yoel, Interesting. First I've heard of this problem, but it makes sense. I don't really have a solution for you. 1) As you suggest, don't sign your jar... :-P 2) Turn off proxy generation in the server. This, however, has the unfortunate side-effect of breaking the admin console. So, this really isn't much of an option. Perhaps somebody else can chime in... --kevan
Re: Gbean within a signed jar
Alternatively, just change the code that complains about the signature. We could add a flag to the Geronimo class loader to hide all signing data. -dain On Feb 6, 2007, at 11:54 AM, Spotts, Joel (ISS Atlanta) wrote: I have a gbean packaged within a signed jar that is placed in my EAR. Trouble is it seems that geronimo uses proxy classes on the gbean class files, which results in the dreaded: java.lang.SecurityException: class ...'s signer information does not match signer information of other classes in the same package when geronimo attempts to start the gbean. Anyone have a solution to this problem other than not signing the jar? Thanks, Yoel Spotts
Re: Gbean within a signed jar
On Feb 6, 2007, at 2:54 PM, Spotts, Joel ((ISS Atlanta)) wrote: I have a gbean packaged within a signed jar that is placed in my EAR. Trouble is it seems that geronimo uses proxy classes on the gbean class files, which results in the dreaded: java.lang.SecurityException: class ...'s signer information does not match signer information of other classes in the same package when geronimo attempts to start the gbean. Anyone have a solution to this problem other than not signing the jar? Hi Yoel, Interesting. First I've heard of this problem, but it makes sense. I don't really have a solution for you. 1) As you suggest, don't sign your jar... :-P 2) Turn off proxy generation in the server. This, however, has the unfortunate side-effect of breaking the admin console. So, this really isn't much of an option. Perhaps somebody else can chime in... --kevan
