Question

我尝试this famous libGDX applet tutorial来创建游戏的applet版本;我得到一个巨大的堆栈跟踪（下面）。我做错了什么？

java.lang.SecurityException: invalid SHA1 signature file digest for org/lwjgl/util/applet/AppletLoader$2.class
at sun.security.util.SignatureFileVerifier.verifySection(Unknown Source)
at sun.security.util.SignatureFileVerifier.processImpl(Unknown Source)
at sun.security.util.SignatureFileVerifier.process(Unknown Source)
at java.util.jar.JarVerifier.processEntry(Unknown Source)
at java.util.jar.JarVerifier.update(Unknown Source)
at java.util.jar.JarFile.initializeVerifier(Unknown Source)
at java.util.jar.JarFile.ensureInitialization(Unknown Source)
at java.util.jar.JarFile.getCodeSources(Unknown Source)
at java.util.jar.JavaUtilJarAccessImpl.getCodeSources(Unknown Source)
at com.sun.deploy.cache.DeployCacheJarAccessImpl.getCodeSources(Unknown Source)
at com.sun.deploy.security.CPCallbackHandler$ParentCallback.openClassPathElement(Unknown Source)
at com.sun.deploy.security.DeployURLClassPath$JarLoader.getJarFile(Unknown Source)
at com.sun.deploy.security.DeployURLClassPath$JarLoader.access$800(Unknown Source)
at com.sun.deploy.security.DeployURLClassPath$JarLoader$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at com.sun.deploy.security.DeployURLClassPath$JarLoader.ensureOpen(Unknown Source)
at com.sun.deploy.security.DeployURLClassPath$JarLoader.(Unknown Source)
at com.sun.deploy.security.DeployURLClassPath$3.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at com.sun.deploy.security.DeployURLClassPath.getLoader(Unknown Source)
at com.sun.deploy.security.DeployURLClassPath.getLoader(Unknown Source)
at com.sun.deploy.security.DeployURLClassPath.getResource(Unknown Source)
at sun.plugin2.applet.Plugin2ClassLoader$2.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at sun.plugin2.applet.Plugin2ClassLoader.findClassHelper(Unknown Source)
at sun.plugin2.applet.Applet2ClassLoader.findClass(Unknown Source)
at sun.plugin2.applet.Plugin2ClassLoader.loadClass0(Unknown Source)
at sun.plugin2.applet.Plugin2ClassLoader.loadClass(Unknown Source)
at sun.plugin2.applet.Plugin2ClassLoader.loadClass0(Unknown Source)
at sun.plugin2.applet.Plugin2ClassLoader.loadClass(Unknown Source)
at sun.plugin2.applet.Plugin2ClassLoader.loadClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
at sun.plugin2.applet.Plugin2ClassLoader.loadCode(Unknown Source)
at sun.plugin2.applet.Plugin2Manager.createApplet(Unknown Source)
at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
Exception: java.lang.SecurityException: invalid SHA1 signature file digest for org/lwjgl/util/applet/AppletLoader$2.class

Answer 1

我遇到了同样的问题。该教程可让您以与最初签名不同的方式签署lwjgl_util_applet.jar。如果您将META-INF/MANIFEST.MF个JAR文件与lwjgl_util_applet.jar进行比较，则会看到它使用SHA-1，而默认值为SHA-256。

要解决此问题，只需从META-INF删除lwjgl_util_applet.jar文件夹，然后再重新签名即可。在此之后你不应该再犯任何错误。

您还可以使用jarsigner -verify验证您的JAR文件而不上传它们。

Answer 2

自签名以来，包含org.lwjgl.util.applet.AppletLoader的JAR文件似乎已被篡改。这可能是恶意的（有人可能已经取代了AppletLoader），或者有人手动更新了文件而忘记重新签署JAR。或者这可能是本教程的一个步骤？我只是瞥了一眼。在任何情况下，通过抛出此异常而不仅仅执行篡改代码，Java是安全的。

无论哪个JAR文件包含org.lwjgl.util.applet.AppletLoader，请从LWJGL主页再次获取该JAR。

为什么我的libGDX applet产生了这个SecurityException？

2 个答案: