Why access denied (java.lang.RuntimePermission setSecurityManager) in my java Applet?

Question

I had an existing very very old java applet which use :

<dependency>
    <groupId>com.al6</groupId>
    <artifactId>rxtx</artifactId>
    <version>2.1.7</version>
</dependency>
<dependency>
    <groupId>java</groupId>
    <artifactId>plugin</artifactId>
    <version>1.6.12</version>
</dependency>

In the lib directory of the project there is :

• RXTXcomm.jar

• RXTXcomm.jar.sig

• rxtxParallel.dll

• rxtxSerial.dll

  org.apache.maven.plugins maven-jar-plugin sign .keyticket ticket ticket katana ${project.build.directory}/signed/${project.build.finalName}.jar false

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-jar-plugin</artifactId>
    <executions>
        <execution>
            <goals>
                <goal>sign</goal>
            </goals>
        </execution>
    </executions>
    <configuration>
        <keystore>.keyticket</keystore>
        <alias>ticket</alias>
        <storepass>ticket</storepass>
        <keypass>katana</keypass>
        <!--
            signedjar>${project.build.directory}/signed/${project.build.finalName}.jar</signedjar
        -->
        <verify>false</verify>
    </configuration>
</plugin>

The project runs well on a java 1.6 environment, builded by a java 1.6 server.

But if I build it on a new java 1.8 server, and runs with java 1.8, I have a lots of major.minor errors because some old sub-librairies are used by this project.

So to avoid problems, I keep this in the pom.xml :

<configuration>
    <source>1.6</source>
    <target>1.6</target>
    <encoding>UTF-8</encoding>
</configuration>

The project compile and runs, but I had a :

access denied java.lang.RuntimePermission setSecurityManager)

I supposed my jar is not signed. I see that the existing ".keyticket" used to sign seems to not use a valid level of sign for java 1.8. So I modify java.security on the build machine to accept the old sign process. The jar seems signed :

Answer 1

Finally, I generate a new certificate for my jar using :

/opt/jdk/bin/keytool -genkey -keyalg RSA -alias myFirstKey -keystore myKeystore -validity 360

And I add the new file in the maven task to sign it :

<plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-jar-plugin</artifactId>
                <executions>
                    <execution>
                        <goals>
                            <goal>sign</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <keystore>myKeystore</keystore>
                    <alias>myFirstKey</alias>
                    <storepass>keypass</storepass>
                    <keypass>keypass</keypass>
                    <!--
                        signedjar>${project.build.directory}/signed/${project.build.finalName}.jar</signedjar
                    -->
                    <verify>false</verify>
                </configuration>
            </plugin>

And it works perfectly now.