Java SE Embedded package for Synology NAS

UPDATE 4 – Now supports DS414j!
UPDATE 3 – Now with Java 8, and full support for all versions on Intel CPUs running DSM 5.0!
UPDATE 2 – Now running on PowerPC 2010 Synology models running DSM 5.0 beta!
UPDATE – Now running on Armada 370/XP (ARMv7) and Intel Atom Evansport CPUs, as used in some x14 series Synology models!

There is a lot of good Java software, but it’s difficult to get Java running on a NAS. I decided to do something about that, mainly to pave the way for a Serviio package that didn’t require a huge guide to install. To stay legal, I followed how QNAP packaged Java for their NAS products. The Java binaries cannot be redistributed so this package looks for the downloaded .tar.gz archive in the public shared folder on the NAS. The end user is required to register with Oracle to get the file, as you can see from the description below. I also added locale support to the underlying Linux since Java requires this for UTF-8 support when reading from the filesystem.

Only Marvell Kirkwood, Marvell Armada 370/XP, Intel, and Freescale QorIQ/PowerQUICC PowerPC CPUs are supported, so please check which CPU your NAS has. Java 7 for Intel Atom CPU does not currently work on Synology systems running DSM versions older than 5.0, so those users are limited to Java 6. Though Oracle have published a JRE for PowerPC, it also requires DSM 5.0. PowerQUICC PowerPC synos running older DSM versions do not have a recent enough glibc version (2.3.4, but Oracle’s Java needs 2.4). It is technically possible to run Java on those units, but it requires chroot-ing to a Debian install which can get complicated. Christophe from chreggy.fr has recently released packages to automate this.

Java package for Synology

 

Instructions

  • If you have a multi-bay NAS, use the Shared Folder control panel to create a shared folder called public (it must be all lower case). On single bay models this is created by default. Assign it with Read/Write privileges for everyone.
  • Register with Oracle and download Java SE for Embedded 7 for either ARMv5, ARMv7 Headless Server, or PowerPC e500v2 as appropriate (Intel NAS users will need the end-of-life Java SE for Embedded 6), and save in the public shared folder. If the file isn’t found an error message will display the full expected filename. You cannot use a different version by renaming it, since the folder structure inside the archive will be different.
  • Install the Java package from the DSM Package Center. In Settings -> Package Sources add my package repository URL which is http://packages.pcloadletter.co.uk. My packages will appear in the Community section once the repo URL is added.
  • If you have trouble getting the Java archive recognised, try downloading it with a different web browser. Some browsers try to help by uncompressing the file, or renaming it without warning. I have tried to code around most of these behaviours.
  • The package does not need to start, just installing it is sufficient.
  • If you update DSM later, you will need to re-install this package or else UTF-8 and locale support will be broken by the update.
 

Package scripts

For information, here are the package scripts so you can see what it’s going to do. You can learn more about how Synology packages work by reading the Synology Package wiki.

installer.sh

#!/bin/sh

#--------JAVA installer script
#--------package maintained at pcloadletter.co.uk

COMMENT="# Synology Java Package"
SYNO_CPU_ARCH="`uname -m`"
[ "`echo ${SYNO_CPU_ARCH} | cut -c1-7`" == "armv5te" ] && SYNO_CPU_ARCH="armv5tel"
cat /proc/cpuinfo | grep "Comcerto 2000" > /dev/null && SYNO_CPU_ARCH="armv7l-neon"
[ "${SYNO_CPU_ARCH}" == "x86_64" ] && SYNO_CPU_ARCH="i686"

if [ "${SYNOPKG_PKGNAME}" == "java6" ]; then
  DOWNLOAD_URL="http://tinyurl.com/javaembedarchive"
  EXTRACTED_FOLDER="ejre1.6.0_38"
  if [ "`echo ${SYNO_CPU_ARCH} | cut -c1-7`" == "armv5te" ]; then
    JAVA_BINARY="ejre-1_6_0_38-fcs-b05-linux-arm-sflt-eabi-headless-13_nov_2012.tar.gz"
    JAVA_BUILD="ARMv5 Linux - Headless EABI"
  elif [ "${SYNO_CPU_ARCH}" == "armv7l" ]; then
    JAVA_BINARY="ejre-1_6_0_38-fcs-b05-linux-arm-vfp-eabi-headless-13_nov_2012.tar.gz"
    JAVA_BUILD="ARMv6/7 Linux - Headless EABI, VFP, SoftFP ABI, Little Endian"
  elif [ "${SYNO_CPU_ARCH}" == "i686" ]; then
    JAVA_BINARY="ejre-1_6_0_38-fcs-b05-linux-i586-headless-13_nov_2012.tar.gz"
    JAVA_BUILD="x86 Linux Small Footprint - Headless"
  elif [ "${SYNO_CPU_ARCH}" == "ppc" ]; then
    JAVA_BINARY="ejre-1_6_0_38-fcs-b05-linux-ppc-e500v2-headless-13_nov_2012.tar.gz"
    JAVA_BUILD="Power Architecture Linux - Headless - e500v2 core"
  fi    

elif [ "${SYNOPKG_PKGNAME}" == "java7" ]; then
  DOWNLOAD_URL="http://tinyurl.com/javaembed"
  EXTRACTED_FOLDER="ejre1.7.0_71"
  if [ "${SYNO_CPU_ARCH}" == "armv5tel" ]; then
    JAVA_BINARY="ejre-7u71-fcs-b14-linux-arm-sflt-headless-26_sep_2014.tar.gz"
    JAVA_BUILD="ARMv5 Linux - Headless EABI, SoftFP ABI, Little Endian"
  elif [ "${SYNO_CPU_ARCH}" == "armv7l" ]; then
    JAVA_BINARY="ejre-7u71-fcs-b14-linux-arm-vfp-sflt-client_headless-26_sep_2014.tar.gz"
    JAVA_BUILD="ARMv6/7 Linux - Headless - Client Compiler EABI, VFP, SoftFP ABI, Little Endian"
  elif [ "${SYNO_CPU_ARCH}" == "armv7l-neon" ]; then
    JAVA_BINARY="ejre-7u71-fcs-b14-linux-arm-vfp-hflt-client_headless-26_sep_2014.tar.gz"
    JAVA_BUILD="ARMv6/7 Linux - Headless - Client Compiler EABI, VFP, HardFP ABI, Little Endian"
  elif [ "${SYNO_CPU_ARCH}" == "i686" ]; then
    JAVA_BINARY="ejre-7u71-fcs-b14-linux-i586-headless-26_sep_2014.tar.gz"
    JAVA_BUILD="x86 Linux Small Footprint - Headless"  
  elif [ "${SYNO_CPU_ARCH}" == "ppc" ]; then
    JAVA_BINARY="ejre-7u71-fcs-b14-linux-ppc-e500v2-headless-26_sep_2014.tar.gz"
    JAVA_BUILD="Power Architecture Linux - Headless - e500v2 with double-precision SPE Floating Point Unit"
  fi

elif [ "${SYNOPKG_PKGNAME}" == "java8" ]; then
  DOWNLOAD_URL="http://tinyurl.com/javaembed"
  EXTRACTED_FOLDER="ejdk1.8.0_06"
  if [ "${SYNO_CPU_ARCH}" == "armv5tel" ]; then
    JAVA_BINARY="ejdk-8u6-fcs-b23-linux-arm-sflt-12_jun_2014.tar.gz"
    JAVA_BUILD="ARMv5 Linux - Headless EABI, SoftFP ABI, Little Endian"
  elif [ "${SYNO_CPU_ARCH}" == "armv7l" ]; then
    JAVA_BINARY="ejdk-8u6-fcs-b23-linux-arm-vfp-sflt-12_jun_2014.tar.gz"
    JAVA_BUILD="ARMv6/7 Linux - VFP, SoftFP ABI, Little Endian"
  elif [ "${SYNO_CPU_ARCH}" == "armv7l-neon" ]; then
    JAVA_BINARY="ejdk-8u6-fcs-b23-linux-arm-vfp-hflt-12_jun_2014.tar.gz"
    JAVA_BUILD="ARMv7 Linux - VFP, HardFP ABI, Little Endian"
  elif [ "${SYNO_CPU_ARCH}" == "i686" ]; then
    JAVA_BINARY="ejdk-8u6-fcs-b23-linux-i586-12_jun_2014.tar.gz"
    JAVA_BUILD="x86 Linux Small Footprint - Headless"
  elif [ "${SYNO_CPU_ARCH}" == "ppc" ]; then
    JAVA_BINARY="ejdk-8u6-fcs-b23-linux-ppc-e500v2-12_jun_2014.tar.gz"
    JAVA_BUILD="Power Architecture Linux - Headless - e500v2 with double-precision SPE Floating Point Unit"
  fi
fi

JAVA_BINARY=`echo ${JAVA_BINARY} | cut -f1 -d'.'`
PUBLIC_FOLDER="`synoshare --get public | sed -r "/Path/!d;s/^.*\[(.*)\].*$/\1/"`"
TEMP_FOLDER="`find / -maxdepth 2 -name '@tmp' | head -n 1`"
NATIVE_BINS_URL="http://packages.pcloadletter.co.uk/downloads/java-native-${SYNO_CPU_ARCH}.tar.xz"
NATIVE_BINS_FILE="`echo ${NATIVE_BINS_URL} | sed -r "s%^.*/(.*)%\1%"`"
#DSM versions older than 4.3 need locale support adding, don't download unless needed
[ ! -e /usr/bin/locale ] && INSTALL_FILES="${NATIVE_BINS_URL}"
source /etc/profile


preinst ()
{
  synoshare -get public > /dev/null || (
    echo "A shared folder called 'public' could not be found - note this name is case-sensitive. "
    echo "Please create this using the Shared Folder DSM Control Panel and try again."
    exit 1
  )

  JAVA_BINARY_FOUND=

  if [ -n "${JAVA_HOME}" ]; then
    echo "It seems from /etc/profile that a Java Runtime is already installed at ${JAVA_HOME}. Uninstall it and try again."
    exit 1
  fi
  
  [ -f ${PUBLIC_FOLDER}/${JAVA_BINARY}.tar.gz ] && JAVA_BINARY_FOUND=true
  [ -f ${PUBLIC_FOLDER}/${JAVA_BINARY}.tar ] && JAVA_BINARY_FOUND=true
  [ -f ${PUBLIC_FOLDER}/${JAVA_BINARY}.tar.tar ] && JAVA_BINARY_FOUND=true
  [ -f ${PUBLIC_FOLDER}/${JAVA_BINARY}.gz ] && JAVA_BINARY_FOUND=true
  
  if [ -z ${JAVA_BINARY_FOUND} ]; then
    echo "Java binary bundle not found. " > $SYNOPKG_TEMP_LOGFILE
    echo "I was expecting the file ${PUBLIC_FOLDER}/${JAVA_BINARY}.tar.gz. "
    echo "Please agree to the Oracle licence at ${DOWNLOAD_URL}, then download the '${JAVA_BUILD}' package"
    echo "and place it in the 'public' shared folder on your NAS. This download cannot be automated even if "
    echo "displaying a package EULA could potentially cover the legal aspect, because files hosted on Oracle's "
    echo "server are protected by a session cookie requiring a JavaScript enabled browser."
    exit 1
  fi

  cd ${TEMP_FOLDER}
  for WGET_URL in ${INSTALL_FILES}
  do
    WGET_FILENAME="`echo ${WGET_URL} | sed -r "s%^.*/(.*)%\1%"`"
    [ -f ${TEMP_FOLDER}/${WGET_FILENAME} ] && rm ${TEMP_FOLDER}/${WGET_FILENAME}
    wget ${WGET_URL}
    if [[ $? != 0 ]]; then
      if [ -d ${PUBLIC_FOLDER} ] && [ -f ${PUBLIC_FOLDER}/${WGET_FILENAME} ]; then
        cp ${PUBLIC_FOLDER}/${WGET_FILENAME} ${TEMP_FOLDER}
      else     
        echo "There was a problem downloading ${WGET_FILENAME} from the official download link, "
        echo "which was \"${WGET_URL}\" "
        echo "Alternatively, you may download this file manually and place it in the 'public' shared folder. "
        exit 1
      fi
    fi
  done
  
  exit 0
}


postinst ()
{
  WORKING_DIR=`pwd`
  
  #ldd tool is very useful but not included in DSM
  [ ! -e /usr/bin/ldd ] && cp ${SYNOPKG_PKGDEST}/tools/ldd-${SYNO_CPU_ARCH} /usr/bin/ldd

  #extract native binaries if needed
  if [ -e ${TEMP_FOLDER}/${NATIVE_BINS_FILE} ]; then
    cd ${SYNOPKG_PKGDEST}
    #older DSM tar uses different command line switch for xz archives
    tar xJf ${TEMP_FOLDER}/${NATIVE_BINS_FILE} || tar xaf ${TEMP_FOLDER}/${NATIVE_BINS_FILE}
    rm ${TEMP_FOLDER}/${NATIVE_BINS_FILE}
  fi

  #extract Java (Web browsers love to interfere with .tar.gz files)
  cd ${PUBLIC_FOLDER}
  if [ -f ${JAVA_BINARY}.tar.gz ]; then
    #Firefox seems to be the only browser that leaves it alone
    tar xzf ${JAVA_BINARY}.tar.gz
  elif [ -f ${JAVA_BINARY}.gz ]; then
    #Chrome
    tar xzf ${JAVA_BINARY}.gz
  elif [ -f ${JAVA_BINARY}.tar ]; then
    #Safari
    tar xf ${JAVA_BINARY}.tar
  elif [ -f ${JAVA_BINARY}.tar.tar ]; then
    #Internet Explorer
    tar xzf ${JAVA_BINARY}.tar.tar
  fi
  
  #install Java
  if [ "${EXTRACTED_FOLDER}" != "${EXTRACTED_FOLDER/jdk/}" ]; then
    mv ${EXTRACTED_FOLDER} ${SYNOPKG_PKGDEST}
    JRE_PATH="`find ${SYNOPKG_PKGDEST}/${EXTRACTED_FOLDER} -name jre`"
  else
    mv ${EXTRACTED_FOLDER} ${SYNOPKG_PKGDEST}/jre
    JRE_PATH="${SYNOPKG_PKGDEST}/jre"
  fi
  
  #change owner of folder tree
  chown -R root:root ${SYNOPKG_PKGDEST}

  echo "NOTE - This package does *not* start and stop like other packages. "
  echo "Java is correctly installed if you can see the runtime and HotSpot version numbers, "
  echo "and locale information in the package Log tab."
  
  exit 0
}


preuninst ()
{
  exit 0
}


postuninst ()
{
  #clean up profile mods
  sed -i "/${COMMENT}/d" /etc/profile
  sed -i "/${COMMENT}/d" /root/.profile

  #leave locale support in place on older DSM versions - too risky to delete system binaries
  
  exit 0
}
 

start-stop-status.sh

#!/bin/sh

JRE_PATH="`find ${SYNOPKG_PKGDEST} -name jre`"
COMMENT="# Synology Java Package"
#set the current timezone for Java so that log timestamps are accurate, modern timezone names so DST works
SYNO_TZ=`cat /etc/synoinfo.conf | grep timezone | cut -f2 -d'"'`
SYNO_TZ=`grep "^${SYNO_TZ}" /usr/share/zoneinfo/Timezone/tzname | sed -e "s/^.*= //"`


EnvCheck ()
#updates to DSM will reset these changes so check them each startup 
{
  #/etc/profile should contain 5 lines added by this package tagged with trailing comments
  COUNT=`grep -c "$COMMENT$" /etc/profile`
  if [ $COUNT != 5 ]; then

    #remove any existing mods
    sed -i "/${COMMENT}/d" /etc/profile

    #add required environment variables
    echo "PATH=\$PATH:${JRE_PATH}/bin ${COMMENT}" >> /etc/profile
    echo "JAVA_HOME=${JRE_PATH} ${COMMENT}" >> /etc/profile
    echo "CLASSPATH=.:${JRE_PATH}/lib ${COMMENT}" >> /etc/profile
    echo "LANG=en_US.utf8 ${COMMENT}" >> /etc/profile
    echo "export CLASSPATH JAVA_HOME LANG PATH ${COMMENT}" >> /etc/profile
  fi

  #/root/.profile should contain 3 lines added by this package tagged with trailing comments
  COUNT=`grep -c "$COMMENT$" /root/.profile`
  if [ $COUNT != 3 ]; then

    #remove any existing mods
    sed -i "/${COMMENT}/d" /root/.profile

    #add required environment variables
    echo "PATH=\$PATH:${JRE_PATH}/bin ${COMMENT}" >> /root/.profile
    echo "TZ='${SYNO_TZ}' ${COMMENT}" >> /root/.profile
    echo "export PATH TZ ${COMMENT}" >> /root/.profile
  fi

  #timezone needs setting each startup in case system value has changed
  sed -i "s%^TZ=.* ${COMMENT}%TZ='${SYNO_TZ}' ${COMMENT}%" /root/.profile

  #DSM versions older than 4.3 need locale support adding
  if [ ! -e /usr/bin/locale ]; then

    #build missing locale with UTF-8 support (don't think it matters which language)
    cp ${SYNOPKG_PKGDEST}/bin/* /usr/bin
    cp -R ${SYNOPKG_PKGDEST}/share/i18n /usr/share
    if [ ! -d /usr/lib/locale ]; then
      mkdir /usr/lib/locale
    fi
    localedef -c -f UTF-8 -i en_US en_US.utf8
  fi

  #DSM version 5.0 is missing the zoneinfo timezone definitions which causes inaccurate log timestamps
  #thanks to CoolRaoul here: http://forum.synology.com/enu/viewtopic.php?f=19&t=69232#p310553
  #to revert, just remove everything apart from 'Timezone' 'zone.tab' from /usr/share/zoneinfo
  if [ ! -e /usr/share/zoneinfo/Europe/London ]; then
    cp -R ${SYNOPKG_PKGDEST}/zoneinfo/* /usr/share/zoneinfo/
  fi

}

case $1 in
  start)
    EnvCheck
    source /etc/profile
    source /root/.profile

    #evidence of whether Java can start successfully is written to the package log
    java -version > ${SYNOPKG_PKGDEST}/output.log 2>&1
    echo >> ${SYNOPKG_PKGDEST}/output.log
    echo System installed locales: >> ${SYNOPKG_PKGDEST}/output.log
    locale -a >> ${SYNOPKG_PKGDEST}/output.log
    echo >> ${SYNOPKG_PKGDEST}/output.log
    echo JAVA_HOME=$JAVA_HOME >> ${SYNOPKG_PKGDEST}/output.log
    echo TZ=$TZ >> ${SYNOPKG_PKGDEST}/output.log

    exit 0
  ;;

  stop)
    exit 0
  ;;

  status)
    source /etc/profile
    source /root/.profile
    if [ -e "${JAVA_HOME}/bin/java" ]; then
      exit 0
    else
      exit 1
    fi
  ;;

  log)
    echo "${SYNOPKG_PKGDEST}/output.log"
    exit 0
  ;;

esac
 

Changelog:

  • 0029 DSM timezone zone.tab file is no longer overwritten, which had been prompting a malware alert in DSM 5.1 Security Advisor
  • 0028 Updated to Java 7u71, added missing zoneinfo timezone definitions to fix inaccurate timestamps for non-GMT timezones (checked every startup), switched native binary archives from .tgz to .tar.xz format to reduce size
  • 0027 Updated Java 8 to 8u6, added support for Mindspeed Comcerto 2000 CPU in DS414j for Java 7 and Java 8
  • 0026 DSM updates will no longer break Java
  • 0025 Updated to Java 7u60
  • 0024 Updated to Java 7u55
  • 0023 Added Java 8 support
  • 0022 Updated to Java 7u51
  • 0021 Locale support is no longer downloaded and added to DSM 4.3 or newer since it’s already present
  • 0020 Added support for Intel Atom Evansport and Armada XP CPUs in new DSx14 products, removed Early Access JDK 8 support since it did not run on the Armada SoCs
  • 0019 Updated to Java 7u45
  • 0018 Updated to Java 7u40, and JDK8 Early Access b106
  • 0017 For Armada370 CPU changed from ARMv7 Server JVM to Client JVM since the Server one turned out to be unstable. Added support for Early Access JDK 8 for Armada 370.
  • 0016 Added Armada370 CPU support (DS213j)
  • 0015 Updated to Java 7u21, Java 6 Embedded seems to be no longer maintained by Oracle
  • 0014 Fixed metadata for DSM 4.2 Package Center
  • 013 Updated to Java 6u38 and Java 7u10
  • 012 Installer script fetches native binaries separately to reduce bandwidth on repo hosting
  • 011 Added support for Freescale QorIQ PowerPC CPUs used in some Synology x13 series products, PowerQUICC PowerPC processors in previous Synology generations with older glibc versions are not supported
  • 010 updated to Java 6u34 and Java 7u6
  • 009 corrected timezone bug for Atlantic and Pacific timezones which may have caused error messages when in fact the package had installed correctly
  • 008 unified the build scripts
  • 007 included the locale binaries to simplify installation, fixed environment variables for root user (inc. timezone with DST support), displayed Java version information and env vars in Log tab, incremented Java to latest versions 6u32 and 7u4, fixed detection of renamed .tar.gz archives downloaded by Google Chrome
  • 006 fixed path issue for root user on non-bootstrapped systems, updated info link to refer back to this page, and improved description text
  • 005 incremented JRE versions to match new releases from Oracle
  • 004 forced check for existence of ‘public’ shared folder
  • 003 fixed a stupid typo that stopped 002 from working :)
  • 002 rewrote scripts to be easier to maintain, and to allow for web browsers that untar or rename the Java and toolchain binary bundles as they’re saved
  • 001 fixed package repo support, defined as a non-runnable service, prevented more than one JRE being installed, saved files into actual package folder rather than @appstore/java now that package names can be separate from Package Center display names
  • v3 initial spk release (I think!)
 
 
About these ads

845 thoughts on “Java SE Embedded package for Synology NAS

  1. Troy

    So are you saying that it’s normal for Java to be eating that much RAM? The Crashplan process is not using that much RAM. Is it a Java 8 embedded issue? If I went back to 7 would it make a difference? I never noticed java eating that much RAM before. With regard to what you are saying about scheduling Crashplan,even if I stop Crashplan it doesn’t free up the RAM until I uninstall Java. It really seems this is a Java issue going on.

    Reply
  2. Duc

    Does the package change the file /usr/share/zoneinfo/zone.tab? The DSM 5.1 beta includes file hash checking. Security scans will fail with a malware alert for changes to system files.

    Reply
    1. patters Post author

      I have now done some DSM 5.1 testing and I have released a new Java package version (0029) which fixes this issue. To revert your system’s zone.tab file back to the DSM 5.1 stock version run the following:
      wget -O /usr/share/zoneinfo/zone.tab http://dl.dropboxusercontent.com/u/1188556/zone.tab

      Your system will then pass the Malware scan.

      Reply
      1. patters Post author

        The first wget command I posted had issues. This one will work:
        wget -O /usr/share/zoneinfo/zone.tab http://dl.dropboxusercontent.com/u/1188556/zone.tab

  3. Troy

    Patters – I uninstalled Java embedded 8 and went back to 7 and the RAM issue is gone. There is absolutely a problem/conflict/issue going on with the Java 8 embedded package that causes some type of memory hogging/leaking issue going on. You should take a look at it and update the package or remove it until it’s fixed.

    Reply
    1. patters Post author

      I don’t maintain Java as such. I just provide a relatively straightforward way to install the ready-compiled binaries on the NAS. Any problems are for Oracle to fix. Is the software you’re running with it supported on Java 8?

      Reply
  4. John B.

    It *seems like* the new DSM 5.1 Security Advisor will flag a malware threat after installing this package. Unfortunately the critical message is way too vague, “DSM system files have been unintentionally modified” and they recommend you to contact Synology support.
    Any idea of how to check this? (i.e. any suggestion as to which files are safe to delete/move?)

    Reply
    1. John B.

      I contacted Synology support and they confirmed it:
      =====
      /usr/share/zoneinfo/zone.tab size expect[17990] but get[18838]
      /usr/share/zoneinfo/zone.tab hash expect[51f1950d67cc3ec4cb11fe13a9057371c16e0536] but get[28ea26fe9e68cebce3ba1fad622e583167094e5f]
      =====

      The Security Advisor is now permanently flagging this as a potential malware threat.
      Hopefully they will adjust the SA functionality to provide more information about what the changes are, and somehow allow us to handle local changes.

      Reply
      1. toto

        I compared the original zone.tab from DSM 5.1 with the zone.tab from JRE and the only differences are:
        1. an additional line in the DSM file (RU +5345+08707 Asia/Novokuznetsk Moscow+03 – Novokuznetsk)
        2. the DSM file starts with:
        #
        # Lines beginning with `#’ are comments.

        instead of comments at the beginning of the JRE file.
        I assumed this original DSM zone.tab won’t be a problem for the JRE installation and I decide to copy the original DSM file to ‘/usr/share/zoneinfo/’ and to ‘/volume1/@appstore/java7/zoneinfo/’.
        This fixed the problem with the Security Advisor and Java is still running well. I assume the next DSM update won’t bring back the Problem (as long as they don’t change zone.tab) because the Java start script will now copy the original zone.tab file. We will see what happend with the next Java Package update.

      2. patters Post author

        To anyone else that this affected, I suggest you stop your packages that depend on Java, uninstall Java, then install the newest version of my Java package (0029) which fixes this issue. Finally, you can reinstate your original DSM 5.1 version of the zone.tab file by running:
        wget -O /usr/share/zoneinfo/zone.tab http://dl.dropboxusercontent.com/u/1188556/zone.tab

      3. patters Post author

        I have now done some DSM 5.1 testing and I have released a new Java package version (0029) which fixes this issue. To revert your system’s zone.tab file back to the DSM 5.1 stock version run the following:
        wget -O /usr/share/zoneinfo/zone.tab http://dl.dropboxusercontent.com/u/1188556/zone.tab

        Your system will then pass the Malware scan.

      4. marselaar

        I was not able to update to the new package v29. I get the error that the package has no digital signature. Anyone else got this problem too?

    1. patters Post author

      You should use the 0028 CrashPlan package from the package repo. It definitely works fine on the various models of Synology with ARM CPUs.

      Reply
  5. jacobacci

    With DMS 5 there is a Synology supplied / approved Java in the package manager. Can this be used with Serviio instead of the Java SE Embedded package that causes the malware alarm?

    Reply
    1. patters Post author

      It can yes. Synology doesn’t publish the Java Manager for all Syno architectures, and I believe it’s the full JRE rather than Java Embedded, so it will use more memory.

      However, I have fixed that Security Advisor issue and released an updated Java package..

      Reply
  6. Bud

    Hi, can’t install none of Java embedded packages, getting message that files at Oracle server are protected by session cookie… Have you, by any chance a download link of them, so I could get and install them manually? Thanks

    Reply
    1. patters Post author

      That’s expected. You need to visit the URL from the error message and download the correct Java file and place it on your NAS. Please read this blog page for details.

      Reply
  7. toto

    Little modification to the workaround in my last post:
    remove the zone.tab in ‘/volume1/@appstore/java7/zoneinfo/’ and we won’t get a problem with any DSM update and hopefully the next Java Package won’t have a different Zone.tab

    Reply
  8. Dave

    I just updated to the newest DSM. When I tried to re-install Java I got the message “This package does not contain a digital signature.” I tried with JAVA 7 and 8. I re-downloaded 7 and 8 from Oracle and put them in my public folder. Same problem.
    Any ideas?

    Reply
  9. outkast04

    Hello @patters.
    FYI, ‘To anyone else that this affected, I suggest you stop your packages that depend on Java, uninstall Java, then install the newest version of my Java package (0029) which fixes this issue. Finally, you can reinstate your original DSM 5.1 version of the zone.tab file by running:
    wget -O /usr/share/zoneinfo/zone.tab http://tinyurl.com/zonetab

    I followed these instructions exactly; I’m still getting the security warning about the /usr/share/zoneinfo/zone.tab…. Any ideas?

    Reply
    1. patters Post author

      Did you reboot, then scan? I found that my DS111 still claimed there was malware even though the file scan passed ok – until I rebooted.

      Reply
      1. outkast04

        Thanks for the reply, Patters. I did reboot, then ran the scan, and unfortunately it’s still reporting the zone.tab Malware threats. I guess I’ll need to wait for the next DSM update. Hopefully sooner rather than later. Okay – thanks for the help, Patters!

  10. Chip

    Thanks for all the help Patters. I updated DSM before seeing you had a Java update available. Between the script to fix the timezone file and the hint to allow all packages, I was able to get everything back up.

    Reply
  11. Morbeas

    Ok so I followed your advice, stopped the Serviio package, uninstalled Java SE 7, ran the wget command you posted and reinstalled the new (029) version of Java SE 7 and am still getting the malware reported by Security Advisor. Any other ideas?

    Reply
      1. patters Post author

        Not sure then, perhaps the file is very subtly different on some models of NAS. I guess you could try to see if someone with your model can send you the original file. Failing that you will have to ignore that warning until the next DSM update (updates usually check and replace all the system files it seems). Given how fast Synology seem to be pushing updates, I don’t think you will have long to wait.

  12. John Pane

    Trying to install Java SE Embedded 7 1.7.0_71-0029 and I’m getting an error: “This package does not contain a digital signature”

    Reply
      1. Troy

        My problem is different. After replacing the zone file, the security advisor is saying

        Severity: Critical
        Description: DSM files have been unintentionally modified
        Details: Check for any accidental or malicious modifications such as viruses, root kits or hacking activity on DSM
        Recommended Action: The following file(s) have been modified: /usr/share/zoneinfo/zone.tab, /uxr/share/zoneinfo/zone.tab. Please contact Synology support for further assistance.

        Open Support Center to take recommended actions

    1. Troy

      Arthur – that totally fixed it. Thank you very much for posting the resolution so the security advisor stopped barfing on the modified zone.tab.

      Reply
  13. Morbeas

    Excuse my newbness but how do I copy the file to the new directory? I have the new zone.tab file in the public folder so using putty, I cd /volume1/public and then I do cp zone.tab /volume1/usr/share/zoneinfo but that doesn’t work. I get a no such directory error! :(

    Reply
    1. patters Post author

      Yes. You probably need to be logged in as root.
      That command is using wget to download the unaltered copy of that file from my dropbox account and save it out as the correct filename. I aliased the URL of the file in dropbox with TinyURL to make it neater.

      Reply
      1. patters Post author

        I now realise that using TinyURL was a bad idea. Wget saves out the referral HTML rather than the actual file.
        wget -O /usr/share/zoneinfo/zone.tab http://dl.dropboxusercontent.com/u/1188556/zone.tab

  14. Lluke

    To those still getting the malware warning after `wget -O /usr/share/zoneinfo/zone.tab http://tinyurl.com/zonetab`, check the contents of zone.tab. If it contains html, then you may have downloaded a dropbox error/info page instead of the actual zone.tab file. This happened to me. Rerunning the wget command fixed the problem.

    Reply
  15. Alexandre

    I am trying to install crashplan on a DS413. But i find only this package :
    -bliss
    -craftbukkit
    -JAVA SE 6-7-8
    -Minecraft
    -Openremote
    -Serviio

    I use http://packages.pcloadletter.co.uk to find the packages.

    I tried on another NAS DS211 where crashplan runs. I delete the sources http://packages.pcloadletter.co.uk and i find all the packages above + crashlan home-pro-e

    What can i do to find all the packages for the DS413 ?

    I accepted beta, and all editors…

    Reply
  16. Al

    I can’t install the update as this message pops up and I click ok but it doesn’t install.

    “Java SE Embedded 7. This package does not contain a digital signature.”

    Also, is there a complete step by step noob guide to changing that file back, the one that gets flagged by the Synology security advisor. I’ve zero experience with command lines or how to go about doing with my NAS.

    Reply
  17. Aleksey

    Thank you. Used to Openremote, works well.
    I want to ask, could you make a package Domoticz for Synology DS214Play and DS3612?

    Reply
  18. Jonas Lönborg (@nightgolfer)

    Had problems connecting the Client to the NAS (Synology DS412+) after updating to newest DSM and updating Java + Synology packages.

    Thought I’d tried everything, turns out I hadn’t.

    Used the Synology Assistant app on my Mac to get the current IP number of the NAS.

    Commented out ServicePort line in ui.properties (Applications > CrashPlan > Contents > Resources > Java > conf > ui.properties), and removed the comment from ServiceHost, adding the IP I got from Synology Assistant.

    serviceHost=xxx.xxx.xxx.xxx <- IP from Synology Assistant
    #servicePort=4200

    CrashPlan finally connected, and it seems like it's taking care of the adoption process itself, currently "synchronizing block information" and I'm hoping our cloud backup will be up to date tomorrow morning.

    This was much easier than the last time I updated DSM – back then I had to create a SSL tunnel to get the client to connect (the method I'm using now did not work back then, and the tunnel method isn't working now).

    Thanks for all the hard work Patters =)

    Reply

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s