How do I fix "missing Codebase, Permissions, and Application-Name manifest attribute" in my JNLP app?

Question 1

(1) First, you need to create a text file with all of the attributes you want to add. My text file looks like this:

Permissions: all-permissions
Codebase: http://www.codebase.com/myApp/dist
Application-Name: My Application

I named it addToManifest.txt. Obviously, you'll need to change the parameters to match your application's needs.

(2) Next, you need to add this to the main .jar and all of the libraries as well. The command to do this is:

jar ufm dist\myApp.jar addToManifest.txt

of course dist\myApp.jar will need to point to whatever your main .jar is. You'll also need to do this for all of the libraries as well.

jar ufm dist\lib\jcommon-1.0.16.jar addToManifest.txt
jar ufm dist\lib\jfreechart-1.0.13.jar addToManifest.txt
jar ufm dist\lib\joda-time-2.2.jar addToManifest.txt
...

(Note: on Windows, I wrote a .bat file for this.)

Once you do this, the attributes should be written to the .jars. You can open the .jars in a zip manager (like 7-Zip), extract the MANIFEST.MF file, open it in a text editor, and you should see the attributes listed.

(3) After adding the attributes, you need to resign your app. The command to do that is:

jarsigner dist\myApp.jar -keystore "C:\myApp\KEYSTORE.ks" alias -storepass password

You'll also need to do this for all of your libraries as well:

jarsigner dist\lib\jcommon-1.0.16.jar -keystore "C:\myApp\KEYSTORE.ks" alias -storepass password
jarsigner dist\lib\jfreechart-1.0.13.jar -keystore "C:\myApp\KEYSTORE.ks" alias -storepass password
jarsigner dist\lib\joda-time-2.2.jar -keystore "C:\myApp\KEYSTORE.ks" alias -storepass password

After that, your attributes should be added and your .jars should be signed!

NOTE: You only need to sign/deploy your libraries once unless you are changing the library structure. i.e., if you are updating your app but the libraries have already had their manifests altered, signed properly, and deployed, you won't need to resign/deploy the libraries unless you are adding/removing libraries from your app.

NOTE #2: The current version of Netbeans will add Codebase and Permissions manifest attributes to your primary .jar only, but not to your libraries. If you use Netbeans, you will receive a warning from the jar utility when you try to add a duplicate manifest attribute. There is a bug report in the queue to have this fixed https://netbeans.org/bugzilla/show_bug.cgi?id=234231.

EDIT: The latest version of Netbeans (8.0) now adds all three (Codebase, Permissions, and Application-Name) to the manifest for you.

Question 2

Another way could be to handle it in your build script itself.

Step 1: Define a target to update

<target name="updateManifest">
    <manifest file="${file}" mode="update">         
        <attribute name="Trusted-Only" value="true"/>
        <attribute name="Permissions" value="all-permissions"/>
        <attribute name="Codebase" value="*"/>          
    </manifest>
</target>

Step 2: Call the update target and use the new manifest in jar

    <ant target="updateManifest">
        <property name="file" location="manifest.use" />
    </ant>

    <jar jarfile="${jar_name}.jar" manifest="manifest.use">
        <fileset dir="${dest}">
            <include name="File1" />                
        </fileset>
    </jar>

Question 3

If the error message looks like this:

Missing Application-Name manifest attribute for: server root/filename.jar

You can solve it this way:

Start control panel
Choose Java Control Panel
Select Security tab
At Exception Site list click on Edit Site List button
Click on Add button.
Type the server root (eg.:https://ibank.cib.hu), and press OK
Restart your browser/application.

Resource here.

Question 4

If you use Netbeans, set those attributes in your file nbproject/project.properties:

manifest.custom.codebase
manifest.custom.permissions
manifest.application.name.attribute

The very last one is supported only by Netbeans >= 8.0 (see here). The others should work even in Netbeans 7.2. I set jnlp.mixed.code to trusted_only too but maybe it isn't appropriate in your case. You can modify your file jnlp-impl.xml at your own risk if you can't switch to a more recent version of Netbeans.

atulsm's suggestion is better if you don't use Netbeans.

Question 5

Sample for adding manifest to jar and signing jars..

<target name="-post-compile">
        <jar destfile="${build.web.dir}/jars/app.jar" >
            <fileset dir="${build.classes.dir}">
                <include name="com/sample/test/client/**/*.*"/>
                <include name="com/sample/test/share/**/*.*"/>
            </fileset>
            <manifest>
                <attribute name="Author" value="${user.name}"/>
                <attribute name="Permissions" value="all-permissions"/>
                <attribute name="Codebase" value="http://localhost:8080/app/"/>
                <attribute name="Application-Name" value="App"/>
            </manifest>
        </jar>
        <signjar keystore="app.keystore"  storepass="test"  jar="${build.web.dir}/jars/app.jar" alias="tomcat" />


        <copyfiles files="${file.reference.javadatepicker.jar}" todir="${build.web.dir}/jars"/>


        <delete dir="${build.web.dir}/WEB-INF/classes/com/sample/app/client"/>
        <!--keytool -genkey -alias tomcat -keystore app.keystore -keypass test -storepass test -validity 1960-->
        <signjar keystore="app.keystore"  storepass="test"  jar="${build.web.dir}/jars/javadatepicker.jar" alias="tomcat" />

    </target>