Do runnable jars (via Eclipse) contain tracking information?

Question

Lets say I'm writing Java code in Eclipse and then save it as a runnable .jar file. The code is 100% self-written, so no imports from other sources.

Does anything in the .jar file (file headers, ..) hold private data about my PC or my Eclipse version?

Why not open it and see? You need not concern yourself about .class files. You'll find that the answer is "no", unless you hard wire absolute paths in your Class-Path. — duffymo, Jul 26 '12 at 12:19
Check the manifest in your jar file. it's the only place that should contain such information if at all. — G-Man, Jul 26 '12 at 12:21

Andrey Borisov · Accepted Answer · 2012-07-26T12:41:05.560

yep, potentially there is an auto-generate manifest file (jar:META-INF/MANIFEST.MF)

Here is default output of plugin

Manifest-Version: 1.0
Built-By: borisov andrey
Build-Jdk: 1.7.0_05
Created-By: Apache Maven
Archiver-Version: Plexus Archiver

As you can see at least username added to the manifest file

UPDATE: if you are using maven, you may want to configure maven jar plugin

    <plugin>
      <groupId>org.apache.maven.plugins</groupId>
      <artifactId>maven-jar-plugin</artifactId>
      <version>${maven-jar-plugin-version}</version>
      <inherited>true</inherited>
      <executions>
        <execution>
          <goals>
            <goal>test-jar</goal>
          </goals>
        </execution>
      </executions>
      <configuration>
        <archive>
          <manifestEntries>
            <Created-By>${java.version} (${java.vendor})</Created-By>
            <Built-By>ME</Built-By>
            <Implementation-Title>${project.name}</Implementation-Title>
            <Implementation-URL>SOME URL if you want</Implementation-URL>
            <Implementation-Version>${project.version}</Implementation-Version>
            <Implementation-Vendor>your company</Implementation-Vendor>
            <Implementation-Vendor-Id>your vendore id</Implementation-Vendor-Id>
          </manifestEntries>
        </archive>
      </configuration>
    </plugin>

The `built-by` stuff is added by Maven. It is not "standard" or required by Java itself. — A.H., Jul 26 '12 at 12:22
good point btw - thanks. but still it worth to check META-INF/MANIFEST.MF — Andrey Borisov, Jul 26 '12 at 12:26
Thank you very much, if only the username is added by default then Java programing is as privacy safe as it should be. — Tom, Jul 26 '12 at 12:48

score 0 · Answer 2 · answered Jul 26 '12 at 12:19

0

I would be surprised if any of those things are set as metadata when creating a runnable jar.

answered Jul 26 '12 at 12:19

Kurt Du Bois

7,550
4
25
33

score 0 · Answer 3 · answered Jul 26 '12 at 12:22

0

Your runnable jar will only have the resources, the dependent libraries and the manifest.xml file in it.....

answered Jul 26 '12 at 12:22

Kumar Vivek Mitra

33,294
6
48
75

Do runnable jars (via Eclipse) contain tracking information?

3 Answers3