How to correctly sign jar in Java FX 2?

Question

Basically Oracle states that the self-contained applications ( which I want to use ) will run in a sandbox environment and will not have access to OS file system, clipboard, etc unless you sign the jar. The code from their samples is:

<fx:signjar keyStore="${basedir}/sample.jks" destdir="dist"
alias="javafx" storePass="****" keyPass="****">
    <fileset dir='dist/*.jar'/>
</fx:signjar>

But this does signing only for main jar I think. I also have some libraries in dist/lib folderso I'm using this code to add them to my main jar:

<fx:resources>
    <fx:fileset dir="dist" includes="lib/*.jar"/>
</fx:resources>

Do I have to add another fileset to the fx:signjar, in order to sign them too or it is enough to sign the main jar only?

Regards, Aurelian

Answer 1

The deployment guide is incorrect. From an engineer on the Oracle Java deployment team: "Self-contained applications are the same as any standalone java application (e.g java -jar helloworld.jar) - it runs with no security manager by default and has all permission to do anything, just like any other native application." I have filed a Jira ticket against the deployment guide at http://javafx-jira.kenai.com/browse/RT-27483 so you can track it, and thanks to John Smith for alerting us to this error. I apologize for the time this has cost you. Nancy Hildebrandt, Technical Writer, Oracle