title: Signing JAR to allow its classes to have internet access
body: <p>I have a Java application that requires internet access since it embeds a web browser by means of a <a href="http://docs.oracle.com/javafx/2/webview/jfxpub-webview.htm" rel="nofollow">WebView</a> JavaFX component.</p>
  
  <p>If the application is not packaged in a Jar, it executes without problems.
  However, when packaged in a Jar it cannot access internet anymore (e.g., it cannot load the remote Javascript files it requires, such as JQuery).</p>
  
  <p>I tried to fix it signing the jar with:</p>
  
  <pre><code>jarsigner myjar myalias
  </code></pre>
  
  <p>And the command succeeds, although with the following warning:</p>
  
  <blockquote>
    <p>Warning:  The signer certificate will expire within six months. No
    -tsa or -tsacert is provided and this jar is not timestamped. Without a timestamp, users may not be able to validate this jar after the
    signer certificate's expiration date (2014-07-08) or after any future
    revocation date.</p>
  </blockquote>
  
  <p>However, the application still does not have internet access (the embedded browser still cannot load remote script files).
  I am supposed to sign it in other way ? maybe including a certificate from a recognized certificate authority ?</p>
  
  <p>I have also configured permissions in my <code>~/.java.policy</code> file as follows:</p>
  
  <pre><code>keystore "file:&lt;userpath&gt;/.keystore", "jks";
  
  grant signedBy "myalias" {
    permission java.security.AllPermission;
  };
  </code></pre>
  
  <p>I am trying in OSX 10.9.2 and Java 1.8.0-b132</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>It turned out that the embedded browser is executed differently if the application is embedded in a Jar or not, and this goes beyond security permissions.</p>
  
  <p>I do not have idea what is the reason of this, but this can lead you to all sort of wrong conclusions if you do not know it. A nasty bug probably.</p>
  
  <p>For example, one of the things that I observed, is that when no packaged in a Jar, beginning the embedded web page like this worked fine:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"&gt;
  &lt;html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"&gt;
  ...
  </code></pre>
  
  <p>But when packaged in a Jar this gave me problems (probably the xhtml1-strict was enforced) so I had to replace it by a simple <code>&lt;html&gt;</code> tag.</p>
  
  <p>This was not the only different behaviour, but the main thing that was giving me problems. </p>