10

Recently I applied a fix to a Java desktop application. I did this by changing the code in one of my classes, compiled it and sent the new jar to the production environment.

I'm now asked if it is possible to just patch the jar in production by just copying the compiled class that I fixed, or even create a patching program/script that will be able to update just the modified files.

Additional info:

  1. The patch does not have to be applied in run time. Meaning the patch can be done as a separate program or activity. My old program does not need to auto update itself.
  2. Can this be done with web applications (WAR file) too?

The best answer I came up is this, but it's 2 years old. Patching Java software

Is my requirement rare? I have never seen a tutorial to patch a Java application.

Community
  • 1
  • 1
Jefrey Valencia
  • 713
  • 3
  • 13
  • 30
  • This question appears to be off-topic because it is about infrastructure - better suited to programmers or maybe serverfault – Bohemian Jul 10 '13 at 00:55

4 Answers4

8

I'm now asked if it is possible to just patch the jar in production by just copying the compiled class that I fixed, or even create a patching program/script that will be able to update just the modified files.

Yes. It is possible to patch a JAR file using jar -u. It is also possible to patch a WAR file the same way.

But I would NOT recommend it. The JAR or WAR file should be the unit of deployment / management. If you start patching JAR / WAR files on production servers, it is hard to track what is actually being used where. If you are not careful, chaos and confusion will reign.

The only situation where patching is unavoidable is where you have a 3rd-party library or something that you can't build from source, but you need to modify nevertheless. But even in that case it is best to modify the JAR / WAR on your build platform and deploy the modified JAR / WAR. Trying to patch JARs, WARs or deployed webapps on the production platform is a bad idea.

Is my requirement rare?

Yes. There's a better way ...

I have never seen a tutorial to patch a Java application.

Not surprising, given that there's a better way ...

Stephen C
  • 698,415
  • 94
  • 811
  • 1,216
  • Thanks for your answer. As I said in redeploying the tested Jar/War is what I normally do. This was a mandate from our security and standard department and I am glad I was not the only one to find this requirement as strange. – Jefrey Valencia Jul 10 '13 at 06:02
  • @JefreyValencia - I'd be tempted to push back with "provide us with patched and properly tested JARs". I'd also be curious to know what they are requiring you to patch. It all sounds a bit bizarre ..,. – Stephen C Jul 10 '13 at 08:14
  • Hi again Stephen, more or less the security and standard team are just trying to monitor the changes we do to the application already in production. One of their given example (Simplified/Rephrased) is that if a bug exist in the Windows OS is you just patch it rather than reinstalling the application. This argument makes sense but in my limited experience I did not know if it was possible or even good practice for a java application. – Jefrey Valencia Jul 10 '13 at 09:11
  • I see. So what do they do when you deploy a new release to your production system? And what do they do with these (binary) patches they want you to provide? Decompile them? It sounds to me like some management type in the S&S team has created a "process" without considering whether it actually achieves anything. – Stephen C Jul 11 '13 at 03:43
4

You can update the old jar by doing jar uf jarfile classfile(s)

This will replace old class files with same name with new ones, making an auto patcher using that should not be hard

Epicblood
  • 1,167
  • 2
  • 10
  • 29
2

For deploying Java desktop apps., the best option is usually to install the app. using Java Web Start. JWS works on Windows, OS X & *nix. It includes auto-update.

Can this be done with web applications (WAR file) too?

No. JWS is for desktop apps. only.

Community
  • 1
  • 1
Andrew Thompson
  • 168,117
  • 40
  • 217
  • 433
0

Take a look to Getdown — which aims to provide a system for downloading and installing a collection of files on a user's machine and upgrading those files as needed.

Rage Steel
  • 606
  • 5
  • 4