Frequently asked questions about CAB files

MORE INFORMATION

1. Q: Why do I receive the following error message:
   Microsoft JScript runtime error [Line: 15]
   Object doesn't support this property or method
   in Microsoft Internet Explorer 3.02 when I navigate to a page that contains a CAB file?
   
   A: The Extrac32.exe file is not part of the Internet Explorer 3.02 distribution. This file is required for proper CAB operation in Internet Explorer. Extrac32.exe is installed on your system if you previously installed Internet Explorer 3.01 or earlier. The Extrac32.exe utility is also included with build 1518 or later of the Microsoft virtual machine (Microsoft VM). For more information about the latest build of the Microsoft VM, visit the following Microsoft Web site:

   http://www.microsoft.com/mscorp/java/

2. Q: Where do I get the Code Sign Kit?
   
   A: You can find the Code Sign Kit on the Visual J++ CD or with the Java signing tools in the SDK for Java. For more information about the SDK for Java, visit the following Microsoft Web site:

   http://www.microsoft.com/mscorp/java/

3. Q: When I programmatically create a CAB file from a Java application, can I reserve space in a CAB for signing?
   
   A: The Java CAB API currently does not support the creation of reserved areas. The command line tools, Cabarc.exe and Diamond.exe, support this functionality. The latest versions of the Signcode.exe and Dubuild.exe utilities, which are available in the SDK for Java, do not require you to reserve space for a digital signature in the CAB file; it automatically creates space in the CAB when it is signed.
4. Q: Can I sign a Java class file for use with Internet Explorer?
   
   A: Although it is possible to digitally sign a Java class file and use the ChkTrust utility to verify the signature, Internet Explorer does not recognize the class as signed and does not present a certificate to the user at run time. Furthermore, the Microsoft VM does not consider the class trusted. You must place the classes within a CAB file, which can then be signed.
5. Q: Will the Microsoft virtual machine support the JAR file format?
   
   A: JAR file support is the same as ZIP file support. JAR = ZIP + manifest. The Microsoft VM supports uncompressed and compressed JAR levels 0 and 1, but not signed JAR. If you need Java security beyond sandbox on Internet Explorer 4.0, you must use a signed CAB file. This applies to all fine-grained Java security (including when you use the package manager to run in a sandbox on the local computer).
6. Q: Can my applet, which is inside a CAB file, use class files from outside the CAB, which are not installed in the local computer's CLASSPATH?
   
   A: In build 1517 or earlier of the Microsoft VM, classes in a CAB file cannot use class files from a Web server. In build 2057 or later of the Microsoft VM, which is included with the SDK for Java, you can use classes from outside of a CAB file.
7. Q: Why doesn't Internet Explorer display the test certificate from my signed CAB file?
   
   A: If you are using a test certificate to sign your CAB file, you must enable test certificates for the computer; otherwise, the signature is not considered valid. To do this, run Setreg.exe from the SDK for Java (in the SDK\Bin\Packsign folder) as follows:

   setreg 1 true

   You can also run the Wvtston.reg file that is included with the Code Signing Kit.
8. Q: When I run Signcode.exe on my CAB file, I receive the following error message:
   Unable to sign the program <cabfile>. (80004005)
   A. There are several reasons for this problem:
   • You did not reserve space in your CAB file. Re-create the CAB file using the -s 6144 option for Cabarc.exe. This space must be reserved in the CAB file to allow room for the digital signature. Note that you do not need to use the -s switch with the signing tools that are included with the SDK for Java. The Signcode.exe utility creates the necessary space for the certificate when the CAB is signed.
   • Your CAB file is marked read-only.
   • Your CAB file is corrupt.
9. Q: When do I use the -s option for Cabarc.exe?
   
   A: The -s 6144 option reserves unnecessary space in most situations. With the 'test' certificate, you can typically reserve 1 KB of space in the CAB file. To estimate the space that is required, the space should be slightly larger than the size of the SPC file with which you are signing. It is possible that the certificate will require more than 6,144 bytes.
   
   Note It is not necessary to use the -s switch with the signing tools that are included with the SDK for Java. The Signcode.exe utility creates the necessary space for the certificate when the CAB is signed.
10. Q: How do I install a Java package on the user's computer?
    
    A: In Internet Explorer 4.x, you can use DUBuild from the SDK for Java to create a distribution unit, and add the parameters USESLIBRARY, USESLIBRARYCODEBASE, and USESLIBRARYVERSION to your applet tag. The entire process is described at the following Microsoft Web site:

    http://msdn.microsoft.com

    In Internet Explorer 3.x, you can use a setup information (.inf) file in a signed CAB to install Java libraries and packages on the local computer. The .inf file defines which files to extract from the CAB and where to place them on the user's system.
    
    There is an example .inf file called Master.inf that is included in the SDK for Java. Place all of the Java libraries and packages in a CAB file (the inner CAB file). Place the unsigned "inner" CAB file and the .inf file in a second, signed CAB file. Reference the signed CAB file with an <OBJECT> tag in your HTML page. More information on this process is also available in the SDK for Java documentation.
11. Q: Is there a more elegant solution to distribute trusted applets on my intranet other than using a test certificate?
    
    A: You can use the Microsoft Certificate Server (which is available as part of Microsoft Windows NT 4.0 Option Service Pack 4) to set up an in-house certificate server. Clients must be configured to trust that certificate authority. After they are configured, the clients recognize the in-house certificates as valid certificates. Alternatively, you can relax the security in Internet Explorer by installing the classes on the client computers in the local CLASSPATH or distribute the files in a CAB that is signed by a valid certificate authority. If you choose to use a test certificate to sign, you must enable the test root certificate on the client computers. To do this, run setreg 1 true. Setreg.exe is available from the SDK for Java in the SDK\Bin\Packsign folder.
12. Q: Can I include GIF, JPG, or AU files that my applet uses in a CAB file?
    
    A: Yes, the CAB file serves as a single, compressed repository for all .class, audio and image files that the applet requires. If any of the files in the CAB are in subdirectories, when you create the CAB file, be sure to use the -r and -p options for Cabarc.exe to preserve the directory structure. You can use the Cabarc.exe command L to confirm that the directory structure was preserved.
    
    You can use the applet code, through the java.lang.Applet.getImage and java.lang.applet.getAudioClip methods, to retrieve the image and audio clips that are stored in the CAB. For Internet Explorer to find an image file or audio clip from within the CAB file, the URLs that are passed to these methods must be based on the applet's codebase. For example, if the following code is found within an applet that is loaded from a CAB file, the image file (Picture1.gif) and the audio clip (Sound1.au) are loaded from the CAB file (assuming that they are in the CAB):

       .
       .
       .
    
       Image img = getImage(getCodeBase(),"picture1.gif");
       AudioClip clip = getAudioClip(getCodeBase(),"sound1.au");
       .
       .
       .
    						

    Note If an image or audio clip file is not within the CAB file, Internet Explorer searches for the file on the server.
13. Q: Why doesn't Internet Explorer display the certificate from a signed CAB on some computers?
    
    A: The three most common reasons for this behavior are as follows:
    • If you used a test certificate to sign the CAB file, you must enable test certificates for the local computer; otherwise, the signature is not considered valid. To do this, run the Wvtston.reg file that is included with the Code Signing Kit.
    • You accepted a software publisher as "always trusted". To verify this, in Internet Explorer, go to view.Options.Security.Publishers to ensure that the publisher does not appear in the list box. If so, you can use this dialog box to remove it.
    • If the client computer is running Microsoft Windows NT, the current user must have Administrator privileges or "Full Control" access to the following registry keys (and existing subkeys):

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinTrust
      								

      A user who has Administrator privileges on the computer can use Registry Editor (Regedt32.exe) to grant these privileges.
      
      Note If the certificate does not appear, or if you answer "no" to the certificate, the applet still loads but is not trusted.