Search code examples
javaeclipseanonymity

Do runnable jars (via Eclipse) contain tracking information?


Lets say I'm writing Java code in Eclipse and then save it as a runnable .jar file. The code is 100% self-written, so no imports from other sources.

Does anything in the .jar file (file headers, ..) hold private data about my PC or my Eclipse version?


Solution

  • yep, potentially there is an auto-generate manifest file (jar:META-INF/MANIFEST.MF)

    Here is default output of plugin

    Manifest-Version: 1.0
    Built-By: borisov andrey
    Build-Jdk: 1.7.0_05
    Created-By: Apache Maven
    Archiver-Version: Plexus Archiver
    

    As you can see at least username added to the manifest file

    UPDATE: if you are using maven, you may want to configure maven jar plugin

        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-jar-plugin</artifactId>
          <version>${maven-jar-plugin-version}</version>
          <inherited>true</inherited>
          <executions>
            <execution>
              <goals>
                <goal>test-jar</goal>
              </goals>
            </execution>
          </executions>
          <configuration>
            <archive>
              <manifestEntries>
                <Created-By>${java.version} (${java.vendor})</Created-By>
                <Built-By>ME</Built-By>
                <Implementation-Title>${project.name}</Implementation-Title>
                <Implementation-URL>SOME URL if you want</Implementation-URL>
                <Implementation-Version>${project.version}</Implementation-Version>
                <Implementation-Vendor>your company</Implementation-Vendor>
                <Implementation-Vendor-Id>your vendore id</Implementation-Vendor-Id>
              </manifestEntries>
            </archive>
          </configuration>
        </plugin>