In a blog entry Oracle recently explained the changes that are planned with the next Java update which is scheduled for January 14th 2014. Unfortunately two changes for Java Web Start and Applets are especially harmful and can cause problems in Ivy installations. The two points are:

  • Missing permission entry in jar manifest: Oracle introduced the two new properties codebase and permission for the manifest files of jars with Java 1.7.25. Up from the January release the latter property is required and Java Web Start will stop if jars do not have a permission entry in the jar manifest.
  • All RIAs (Applets and Web Start applications) must be signed: All jars used in a Java Web Start application or in an Applet must be signed. Otherwise they will not be executed.

So, basic question: Will our Rich Dialogs in Ivy still work after the update to Java 1.7.51?

asked 03.12.2013 at 12:03

MichaelD%C3%A4nzer's gravatar image

MichaelDänzer ♦
accept rate: 86%

Update (15th January 2014):

Oracle has released Java 7 Update 51. We have tested our rich application client with it and with our latest avaialable update releases of 4.2, 4.3, 5.0. The application starts without any problem or warning.

Older update releases will no longer work with Java 7 Update 51 if you use Security Level Very High or High (default). The following error will be displayed: alt text The Details looks as follows: alt text However, you can set the Security Level to Medium to run rich application clients with older update releases.

ivyTeam recommends to update to the latest Xpert.ivy update release instead of using the Security Level *Medium*

The Security Level can be changed in the Java Control Panel: alt text


The simple answer: If you use Ivy, 4.3.19 or 5.0.7 and higher, than your on the safe side. If you use older versions but at least 5.0.3 or 4.3.16 you are safe but you will see warnings for the expired certificate. Read on if you want to know more.

The permission entry was added already in the 5.0.3, 4.3.16 and releases. If you already use on of theses releases (or higher), then you are safe. If not, please consider updating. If you cannot update, please see the advices at the end of the answer.

We sign our jars since ever, just recently we delivered updates with a new certificate (see the corresponding question). So, unless you (un-)signed your installation yourself you have not to fear anything. If you signed your installation with your own certificate which was issued by a trusted Certificate Authority (CA), then you are on the safe side too. But:

  • if you unsigned your installation, then please sign it again with your certificate or update to a signed version again.
  • if you signed your installation with a self-signed certificate then it is not clear what will happen. Oracle writes at one point "RIAs must contain (...) Code signatures from a trusted authority". Which indicates that self-signed jars will not work any longer. On the other hand, Oracle wrote a blog entry with explanations how to self-sign jars. Why should they if this will no more work. So, here unfortunately we cannot give you an answer. If you use a self-signed certificate and you want to be on the safe side, either use a certificate issued by a trusted CA or switch to the standard release of ivyTeam.

If you - after reading this - find yourself in a situation where you cannot update or change your installation and you fear that Ivy Rich Dialogs will no more run in future, we can give you the following advices:

  • Use the new Deployment Rule Set of the JRE. This is a new feature intended for system administrators to define rules which Java RIAs can do what or what not.
  • Use the even newer Exception Site List that will come too with Java 1.7.51. As this feature is new we cannot tell you more than what is written in the link.
  • Do not update to Java 1.7.51. Turn off automatic updates and prevent users to install updates themselves. Unfortunately this will solve the problem only for a short time as JRE's have an expiration date since Java 1.7.10 (see in the release notes or here). Sooner or later the Dialog “Java Update needed” will be shown with the options “Update”, “Block” and “Later”)

answered 03.12.2013 at 12:34

MichaelD%C3%A4nzer's gravatar image

MichaelDänzer ♦
accept rate: 86%

edited 26.05.2014 at 14:51

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported



Asked: 03.12.2013 at 12:03

Seen: 21,717 times

Last updated: 26.05.2014 at 14:51