1 Reply Latest reply on Jul 26, 2010 5:47 PM by 843802

    signed entry "org.apache.log4j" missing from jar

      I am trying to understand why my applet jars aren't cached at all. I am using firefox 3.6.6 and java 1.6u20 (same result on Debian "lenny" GNU/Linux and on Windows XP Professional SP3) connecting to a tomcat server.

      My applet tag, when running on GNU/Linux, is as follows:

      <applet width="850" height="500" name="NeosScannerApplet" id="NeosScannerApplet">
      <param name="code" value="it.lixper.neos.web.applets.scan.Scanner"/><param name="java_arguments" value="-Xmx512m -Xms64m"/>
      <param name="cache_archive" value="lib/NeosScannerApplet.jar,lib/morena.jar,lib/morena_license.jar,lib/1.1.3/linux-i586/jai_core.jar,lib/1.1.3/linux-i586/jai_codec.jar,lib/1.1/linux-i586/jai_imageio.jar,lib/JSane-net-0.8-netbeans.jar,lib/1.1.3/linux-i586/mlibwrapper_jai.jar,lib/1.1.3/linux-i586/libmlib_jai.so.jar,lib/1.1/linux-i586/clibwrapper_jiio.jar,lib/1.1/linux-i586/libclib_jiio.so.jar,lib/log4j-1.2.15.jar"/>
      <param name="mayscript" value="true"/>
      <param name="separate_jvm" value="true"/>
      <param name="classloader_cache" value="true"/>
      <param name="codebase_lookup" value="false"/>
      <param name="cache_version" value=",,,,,,,,,,,"/>

      Using the applet tag shown above everything work correctly. but it I shift log4j jar on top of the jar list in cache_archive parameter (and also update cache_version parameter), then no jars (beside log4j) is cached, i.e., all jars are downloaded every time. All my jars are temporary stored in /tmp/cache_jar files instead of using the directory I specificed in java control panel. Whenever I move log4j jar in the list of archive_cache, all jars before log4j and log4j itself are cached, while all remaining jars are not cached.

      After pressing "5" key on the java console window while loading the applet, I found this message for log4j jar (this is when log4j jar is not yet cached):

      network: Voce cache non trovata [url: http://localhost:8080/NeosGWT/lib/log4j-1.2.15.jar, versione:]
      network: Connessione a http://localhost:8080/NeosGWT/lib/log4j-1.2.15.jar?version-id= con proxy=DIRECT
      network: Connessione a http://localhost:8080/ con proxy=DIRECT
      network: Connessione http://localhost:8080/NeosGWT/lib/log4j-1.2.15.jar?version-id= con cookie "JSESSIONID=2D168D733DAF8A45528BB08742FEAD2E"
      network: CleanupThread used 6836 us
      network: Download risorsa: http://localhost:8080/NeosGWT/lib/log4j-1.2.15.jar?version-id=
           Content-Length: 414.854
           Content-Encoding: null
      network: URL http://localhost:8080/NeosGWT/lib/log4j-1.2.15.jar?version-id= scritto su file /home/giuseppe/.java/deployment/cache/6.0/57/15e35b9-4d63509b-
      cache: signed entry "org.apache.log4j" missing from jar http://localhost:8080/NeosGWT/lib/log4j-1.2.15.jar
      network: CleanupThread used 4 us
      basic: Plugin2ClassLoader.isTrustedByPolicy called
      basic: Plugin2ClassLoader.isTrustedByPolicy returns false

      so, the strange message is the one starting with "cache". I do believe this message is a sign about the cache being unusable anymore.

      Anyway, looking at the MANIFEST.MF file inside log4j jar, I can only find signature about classes, while the message is pointing to signature of a package: org.apache.lo4j is a package name.

      So, my questions are: what does this messages means? Is there anything wrong with my signed jar? Is it a java plug-in 2 bug?

      A copy of this jar file is available at http://eppesuigoccas.homedns.org/~giuseppe/log4j-1.2.15.jar

      Giuseppe Sacco

      UPDATE: after my applet is started, while putting lo4j last in the list, any other request to classloader i resolved reloading jars via http. This is quite strange since these jar are already in the cache and checked before loading lo4j. I really think that loading lo4j jar make the internal cache messy.

      Edited by: eppesuig on Jul 10, 2010 3:13 PM
        • 1. Re: signed entry "org.apache.log4j" missing from jar
          So, it seems I understood why I get this message: the log4j MANIFEST.MF file contain these lines:
          Name: org.apache.log4j
          Implementation-Vendor: "Apache Software Foundation"
          Implementation-Title: log4j
          Implementation-Version: 1.2.15
          signing the jar the MANIFEST.MF file is changed and a couple of lines are added for each signed file. These lines are of this kind:
          Name: org/apache/log4j/xml/DOMConfigurator$2.class
          SHA1-Digest: LxzBa+Ze1FhmRoLDigDVblt9+q8=
          So, probably, while java plug-in 2 is checking all signature, it scan MANIFEST.MF, looking for all Name: lines, get the file path and look for the corresponding digest line. Of course, when it comes to "Name: org.apache.log4j" it does not find neither the file nor the signature. The message is now clear: the file is really missing.

          jarsigner keep confirming the file is correctly signed. I think that jarsigner looks for all files inside jar and then search for the corresponding signature in MANIFEST.MF. Probably java plug-in 2 does it the other way around: scan MANIFEST.MF looking for lines starting with "Name:" and then look for the file named in these lines and for their signature.

          So, my new questions: is log4j MANIFEST.MF correct at all? What behaviour (jarsigner or java plug-in) is correct?