create an unsigned jar file from a signed jar file

Unzip the signed jar file into an empty directory. Delete signing information from the META-INF directory. Finally, create a new jar file with the content of the directory.





For example, creating the unsigned version of the signed jmarvin.jar file under Linux:





unzip -d targetdir jmarvin.jar


cd targetdir


rm -f META-INF/CHEMCERT.*


zip jmarvin.jar *





Under Linux and Unix, you can run unsigner.sh to unsign signed jar file in Marvin:





cd marvin


./unsigner -a

hi





What is the method of creating an unsigned jar file on windows?





When I unzip jmarvin.jar I can't locate any chemcert.* files in the meta-inf directory to delete. Yet when i run the jmarvin.jar applet i still get the security dialog popping up. Please advise?





Also I am trying to create a single jar file which contains all necessary classes for marvin applets. However after following the instructions on your faqs pages to create a single jmarvin.jar file the applet does not seem to work correctly. Is there a single jmarvin.jar file already zipped with all the neceassary classes available for download?





Also does marvin sketch and all marvin applets require a license to use?I am using it for academic purposes. But some dialogue boxes pop up requiring a license key but still seem to work without one? How do i apply for the free web package offered by chemaxon?

Since Marvin 4.0.6, the unsigning method a bit modified because the new release are already signed with a new signing key.


Because of it, META-INF/CHEMAXON.SF and META-INF/CHEMAXON.RSA files have to be deleted (instead of META-INF/CHEMCERT.*) to remove signing info from jars.


I attach the updated unsigner.sh (it will be also available in the next release).





If you want to resign jar files, deleting signing checksums from manifest files are also required. It means, each "Name" and "SHA1-Digest" fields should be deleted from META-INF/MANIFEST.MF. Actually, you have to preserve only the header of the manfiest file (till the first line that starts with "Name:". In the following example the line "Ant-Version: Apache Ant 1.6.2" would be the last line in the new manifest file.

Code:

Manifest-Version: 1.0 Class-Path:  sjars/Plugin.jar sjars/PluginGUI.jar sjars/abbrevgroupexp  ort.jar sjars/atomlabellers.jar sjars/atommapper.jar sjars/base64expo  rt.jar sjars/base64import.jar sjars/batik-core.jar sjars/chart.jar sj  ars/clean2d.jar sjars/clean3d.jar sjars/cmlexport.jar sjars/cmlimport  .jar sjars/common/swing/aboutjvm.jar sjars/common/swing/editmolfilefr  ame.jar sjars/common/swing/exceptionframe.jar sjars/common/swing/help  .jar sjars/common/swing/imageselection.jar sjars/common/swing/loadsav  e.jar sjars/common/swing/molselection.jar sjars/common/swing/molselec  tionsmi.jar sjars/common/swing/multimoleculesave.jar sjars/common/swi  ng/preferences.jar sjars/common/swing/print.jar sjars/common/swing/re  genbonds.jar sjars/dearomata.jar sjars/elemanal.jar sjars/gzipexport.  jar sjars/gzipimport.jar sjars/hydrogenize.jar sjars/imageexport.jar  sjars/inchiexport.jar sjars/inchiimport.jar sjars/jpegexport.jar sjar  s/mchart.jar sjars/molexport.jar sjars/molimport.jar sjars/mpolylinem  odule.jar sjars/mrvexport.jar sjars/mrvimport.jar sjars/msbmpexport.j  ar sjars/mtextboxmodule.jar sjars/myformatexport.jar sjars/myformatim  port.jar sjars/parity.jar sjars/pdbexport.jar sjars/pdbimport.jar sja  rs/periodicsystem.jar sjars/plugin/CalcModules.jar sjars/plugin/Calcu  lations.jar sjars/plugin/ChargePlugin.jar sjars/plugin/ElementalAnaly  serPlugin.jar sjars/plugin/HBDAPlugin.jar sjars/plugin/HuckelAnalysis  Plugin.jar sjars/plugin/IonChargePlugin.jar sjars/plugin/IsoelectricP  ointPlugin.jar sjars/plugin/MajorMicrospeciesAccessorPlugin.jar sjars  /plugin/MajorMicrospeciesPlugin.jar sjars/plugin/MultiformPlugin.jar  sjars/plugin/PolarizabilityPlugin.jar sjars/plugin/RefractivityPlugin  .jar sjars/plugin/ResultView.jar sjars/plugin/SyNGModules.jar sjars/p  lugin/SyNGPlugin.jar sjars/plugin/TPSAPlugin.jar sjars/plugin/Topolog  yAnalyserPlugin.jar sjars/plugin/logDPlugin.jar sjars/plugin/logPPlug  in.jar sjars/plugin/pKaPlugin.jar sjars/pngexport.jar sjars/povexport  .jar sjars/ppmexport.jar sjars/sketch/boxsm.jar sjars/sketch/edit.jar   sjars/sketch/linesm.jar sjars/sketch/swing/attachdatadialog.jar sjar  s/sketch/swing/mobjectpropertiesdialog.jar sjars/sketch/swing/periodi  cframe.jar sjars/sketch/swing/rlogicdialog.jar sjars/sketch/swing/sgr  oupcreationdialog.jar sjars/sketch/swing/sketchdnd.jar sjars/sketch/s  wing/templatebuttondnd.jar sjars/sketch/swing/templateframe.jar sjars  /sketch/swing/templatepropertiesdialog.jar sjars/smarts.jar sjars/smi  lesimport.jar sjars/spacefill.jar sjars/superatomsgroupcoords.jar sja  rs/svgexport.jar sjars/sybylexport.jar sjars/sybylimport.jar sjars/th  reedim.jar sjars/view/scripter.jar sjars/view/swing/cleantable.jar sj  ars/view/swing/gridbagview.jar sjars/view/swing/imageviewframe.jar sj  ars/view/swing/molsframe.jar sjars/view/swing/mviewanimator.jar sjars  /view/swing/mviewframe.jar sjars/view/swing/mviewsketch.jar sjars/vie  w/swing/printview.jar sjars/view/swing/tableview.jar sjars/view/swing  /viewdnd.jar sjars/xyzexport.jar sjars/xyzimport.jar Created-By: 1.4.2_08-b03 (Sun Microsystems Inc.) Ant-Version: Apache Ant 1.6.2 Name: chemaxon/marvin/sketch/swing/ReactionButton.class SHA1-Digest: QNd4b2CKQUoaYbyDK0rKeRy0YWg= Name: chemaxon/marvin/sketch/swing/SketchPanel$2.class SHA1-Digest: F09/Ag/8/nB8R4aovKRdkDhowws=

By the way, wrapping the content of all jars in one is not recommended because some important info that are stored in the manifest file of the different jars will be lost.





To tell the truth, I don't understand why you want to unsign Marvin. If you really disturb sign key certificate dialog, unsigning only the jmarvin.jar would be enough.


If an non signed jar loads in signed jar files, the signing info of signed jars will be ignored.


It means, the sign key certificate dialog will not be displayed if the "jmarvin.jar" is unsigned.





Unsigning jmarvin.jar in Linux:

Code:

cd marvin ./unsigner.sh jmarvin.jar

If you have got Marvin 4.0.6, overwrite your "unsigner.sh" with the attached one.





Unsigning jmarvin.jar in Windows:


1. Unzip "jmarvin.jar".


2. Remove META-INF/CHEMAXON.SF and META-INF/CHEMAXON.RSA.


3. If you want to resign the jar files later, delete signing checksums from MANIFEST file (see above what should be delete from it).


4. Rewrap "jmarvin.jar".

Hi





I have used the windows method of unsigning jmarvin.jar by deleteing





META-INF/CHEMAXON.SF and META-INF/CHEMAXON.RSA.





Now when I try to load the applet i keep getting dialogue box popping up with the following error message:

Code:

molfile cannot be loaded because an error occured: sun.misc.invalidJarIndexException:Invalid index #10000

the java console has the following error message:

Code:

java.lang.SecurityException: class "chemaxon.marvin.modules.MolExport"'s signer information does not match signer information of other classes in the same package    at java.lang.ClassLoader.checkCerts(Unknown Source)    at java.lang.ClassLoader.preDefineClass(Unknown Source)    at java.lang.ClassLoader.defineClass(Unknown Source)    at java.security.SecureClassLoader.defineClass(Unknown Source)    at java.net.URLClassLoader.defineClass(Unknown Source)    at java.net.URLClassLoader.access$100(Unknown Source)    at java.net.URLClassLoader$1.run(Unknown Source)    at java.security.AccessController.doPrivileged(Native Method)    at java.net.URLClassLoader.findClass(Unknown Source)    at sun.applet.AppletClassLoader.findClass(Unknown Source)    at java.lang.ClassLoader.loadClass(Unknown Source)    at sun.applet.AppletClassLoader.loadClass(Unknown Source)    at java.lang.ClassLoader.loadClass(Unknown Source)    at java.lang.ClassLoader.loadClassInternal(Unknown Source)    at java.lang.Class.forName0(Native Method)    at java.lang.Class.forName(Unknown Source)    at chemaxon.marvin.util.MarvinModule.loadClass(Unknown Source)    at chemaxon.marvin.util.MarvinModule.load(Unknown Source)    at chemaxon.marvin.util.MarvinModule.load(Unknown Source)    at chemaxon.marvin.common.swing.MolPanel.s(Unknown Source)    at chemaxon.marvin.sketch.swing.SketchPanel.s(Unknown Source)    at chemaxon.marvin.common.swing.MolPanel.init(Unknown Source)    at chemaxon.marvin.common.swing.MolPanel.init(Unknown Source)    at JMSketch.init(Unknown Source)    at sun.applet.AppletPanel.run(Unknown Source)    at java.lang.Thread.run(Unknown Source)

Whilst the applet loads there are no molecule templates visible on the toolbar neither am I able to set any other templates from insert>template option on the menu bar. All I get is the above dialogue box popping up each time.





The reason why i want an unsigned swing version of the marvin sketch applet is because in many networked environments administrator settings prevent users from loading applets even signed applets. Whilst the AWT version works fine it is some what ugly in appearance. Why not make the Swing version as an unsigned applet as it would be more compatible in large networked environments administrator browser settings?

Clear JRE's and browser's caches. Probably, the old jar is loaded from the cache, instead of the updated version from the server.


See the following topic:How I can clear JRE cache?


If it is not help, try to delete also the certification info from the manifest file.

hi





I've tried deleting the signing information from the manifest file as described above. Now i get the following error message:








and the molecule templates still do not load into the tool bar.

Code:

Molfile cannot be loaded becuase an error occured: java.lang.SecurityException:class "chemaxon.marvin.modules.Molimport"s signer information does not match signer information of other classes in the same package #10000

and the molecule templates still do not load into the tool bar?

Can you show me the html example where you have got this error? Probably, something is wrong by jar files loading in your html.


Would you tell me in detail what you have modified in the marvin directory and in the jar files?


By the way, which Marvin version do you use?

Hi,





I've been trying to use a piece of your sample code as a base for testing your system. I'm trying to run it locally.


I get the error below. I have two initial questions.





1. Why would it list JVA 1.5.0_06? I stripped out all versions but


1.4 and 1.5.0_08 from my machine. Does this indicate a caching problem? I've tried Firefox (1.5.0.7) and IE (6.0.2900) and the View stack trace is the same on both. When I check the Java console from within IE it says Java Plug-in 1.5.0_08


Using JRE version 1.5.0_08 Java HotSpot(TM) Client VM. I would have thought that the trace should show the version that is running it.





2. What can I do to resolve the error? I've tried cache clearing for the browser and java but the results do not change. I checked marvin.jar and it was unsigned. Is there a different jar that I should be checking?





Thanks for any assistance.





Darcy














JChem version : 3.1.7.1


JVM : Sun Microsystems Inc. 1.5.0_06


OS : x86 Windows XP 5.1








Stack trace:


------------











java.lang.SecurityException: class "chemaxon.marvin.modules.SmilesImport"'s signer information does not match signer information of other classes in the same package


at java.lang.ClassLoader.checkCerts(ClassLoader.java:775)


at java.lang.ClassLoader.preDefineClass(ClassLoader.java:487)


at java.lang.ClassLoader.defineClass(ClassLoader.java:614)


at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:124)


at org.apache.catalina.loader.WebappClassLoader.findClassInternal(WebappClassLoader.java:1955)


at org.apache.catalina.loader.WebappClassLoader.findClass(WebappClassLoader.java:945)


at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1411)


at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1275)


at java.lang.ClassLoader.loadClassInternal(ClassLoader.java:319)


at java.lang.ClassLoader.defineClass1(Native Method)


at java.lang.ClassLoader.defineClass(ClassLoader.java:620)


at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:124)


at org.apache.catalina.loader.WebappClassLoader.findClassInternal(WebappClassLoader.java:1955)


at org.apache.catalina.loader.WebappClassLoader.findClass(WebappClassLoader.java:945)


at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1411)


at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1275)


at java.lang.ClassLoader.loadClassInternal(ClassLoader.java:319)


at chemaxon.jchem.db.JChemSearch.init(JChemSearch.java:2628)


at chemaxon.jchem.db.JChemSearch.search1(JChemSearch.java:2016)


at chemaxon.jchem.db.JChemSearch.search(JChemSearch.java:1916)


at chemaxon.jchem.db.JChemSearch.access$1200(JChemSearch.java:75)


at chemaxon.jchem.db.JChemSearch$SearchThread.run(JChemSearch.java:384)

Dear Darcy,


Can you describe in details what did you do exactly? Probably, you have unsigned wrong jars.


JChem package can devide to two parts: JChem API (jchem.jar with a few external jars) with JSP examples and a bundled Marvin Applets package to draw queries and display its results in browsers.





On your (web) server, probably, there are JSP examples that uses the "jchem.jar". JSP provides a web content (e.g. query results). In these web contents may be Marvin applets.


When these applets displays in your browser, they will run on the local machine (incontrary of jchem.jar that runs on the server).





The posted stack trace is dropped by your web server. If you would like to update web server's Java (Java 1.5.0_06), read the manual of your web server how to do it.





"marvin.jar" is the core jar for the AWT version of Marvin Applets.


Probably, you have added Marvin Applets jar files (jars from the "jchem/marvin" directory) to the web servers' CLASSPATH.


If yes, please remove them from the CLASSPATH. "jchem.jar" and Marvin Applets' jars ("marvin.jar", "jmarvin.jar", "sjars/*.jar") are not compabitle with each other.


Marvin Applets is designed to embed MarvinView or MarvinSketch into web pages, not for server side running (like jchem.jar).





This topic is dedicated to unsigning of jar files in Marvin Applets package. If you have got more questions about JChem, please post them into the JChem forum.





In Marvin Applets package the following jars are signed:


jextexp.jar (since Marvin 4.1)


jmarvin.jar


jogl.jar


jogl_*/*.jar (since Marvin 4.1)


mspace.jar


sjars/**.jar


See also my earlier comment in the topic for more information about unsigning.





By the way, there are no sence to unsign "jchem.jar" because signing issue is relevant only at applets.

Removing signing certificate from any jar file of Marvin Applets has no sence anymore unless you would like to resign them again.

Marvin Applets does not support unsigned jars anymore. Its initalization process does certain operations that requires trusted context (signed jars).

When you unsign applet, remove *.jar.pack.gz files too.

If these jar.pack.gz extended files present, Marvin applets prefers them by downloading instead of normal jars. These files are the pack200 optimized, signed and gz compressed version of normal jars.

In the marvin.js generated applet code, the following parameter sets this precedence.

<param name="java_arguments" value="-Djnlp.packEnabled=true"/>

Generic way to remove signing information from a jar file. (This description can be apply to any jar, not only for Marvin).

Signing information are stored in the META-INF folder inside the jar.

1. Remove files with .SF or .RSA extension from the META-INF folder inside the jar.
2. Delete signing checksums from META-INF/MANIFEST.MF: each "Name" and "SHA1-Digest" fields should be deleted from META-INF/MANIFEST.MF.