boxen/puppet-java — pull request #22 by zk (2013-06-28 06:28:03+00:00)
Title: Install unlimited key strength policy files for JDK 7

I was getting the following stacktrace when trying to generate 'large' crypto keys:

java.security.InvalidKeyException: Illegal key size
at javax.crypto.Cipher.checkCryptoPerm(Cipher.java:1024)
at javax.crypto.Cipher.init(Cipher.java:1345)
at javax.crypto.Cipher.init(Cipher.java:1282)
at ring.middleware.session.cookie$encrypt.invoke(cookie.clj:49)
at ring.middleware.session.cookie$seal.invoke(cookie.clj:77)
at ring.middleware.session.cookie.CookieStore.write_session(cookie.clj:99)

The background on this is that due to US export laws, the JDK (by default) dosen't allow you to use key sizes greater than some specified limit: http://docs.oracle.com/javase/1.4.2/docs/guide/security/jce/JCERefGuide.html#AppE

You can remove this limitation by installing certain jar files at certain JDK-aware paths, like so: http://www.ngs.ac.uk/tools/jcepolicyfiles

Essentially, this PR adds the following steps to the puppet-java module:

1. Download file http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html
2. Create directory /Library/Java/JavaVirtualMachines/jdk1.7.0_21.jdk/Contents/Home/lib/security with owner root
3. Put localpolicy.jar in /Library/Java/JavaVirtualMachines/jdk1.7.0_21.jdk/Contents/Home/lib/security

I've included the two required jar files in the source tree, due to Puppet not allowing remote files to be specified as `File` sources (i.e. the following fails):

file { '/some/path':
source => 'https://some/remote/file',
mode => 0664
}

I had also considered using [this workaround](https://groups.google.com/d/msg/puppet-users/8HRt3PQ2I-w/1FE6a4ZLCr4J), but decided to start here as the jar files are ~5k combined. Let me know if you think the workaround is more appropriate and I'll switch.

Also, the path at which these files are installed is hardcoded, I had tried using `/usr/libexec/java_home` to establish the install path *after* jdk7 was installed using something like

inline_template("<%= `/usr/libexec/java_home`.strip %>")

but I wasn't able to figure out how to affect when that gets evaluated. Ultimately, I didn't think it was a huge deal since the JRE / JDK versions are hardcoded as well.

Thanks, and lmk if you have any questions.