Sourceless / J2EE Deployment

February 24, 2005 · 15 Comments

There seems to be a lot of confusion around these two features in ColdFusion MX 7 - yes, they are two separate features! I'll try to clarify them here... Sourceless deployment: The ability to deploy a ColdFusion application to another ColdFusion server without source code. J2EE deployment: The ability to create a WAR/EAR containing a ColdFusion application and the CF runtime which can then be deployed on any supported J2EE server. They can be combined: a J2EE deployment can contain source or not, your choice. It can also contain a CF Admin or not, your choice. Without a CF Admin, your deployed application can still use the new CF Admin API to modify settings. Sourceless deployment can be done from any edition to any edition - because the target deployment server already has a CF license. Sourceless deployment simply means compiling the CFML to Java bytecode and deployed the compiled files (the compile script compiles foobar.cfm to foobar.cfm in another directory - the target foobar.cfm file is really a .class file). J2EE deployment can be done from any edition to any J2EE server and the licensing of the deployed app is either Developer Edition (no serial number) or Enterprie Edition (buy a license, use that serial number in the creation of the archive or via the deployed CF Admin or via custom code in the deployed app that uses the CF Admin API to set the serial number). The Standard Edition does not support J2EE deployment because, well, it's Standard Edition (Enterprise Edition is effectively equivalent to the old J2EE Edition). There is an OEM program which lets you negotiate an appropriate license structure for application deployment.

Tags: coldfusion

15 responses so far ↓

1 Patrick WHittingham // Feb 25, 2005 at 3:53 AM

Sean -

Is there a cost involved if you want to move these sourceless deployments to management laptops. Can one get a 'free' cfmx 7 app server for a W2K/XP box.
2 Dominick // Feb 25, 2005 at 5:40 AM

Ok, sourceless deployment when you own the app server... that i understand! How about with hosting solutions. I still haven't asked crystaltech if they offer the option to deploy sourceless but it seems that I would feel even safer if I could deploy my compiled code to my hosting solutions servers. I'll find this info out, but if someone has a quick answer then shout it out!
3 Sean Corfield // Feb 25, 2005 at 8:13 AM

Patrick, the Developer Edition has always been free - sounds like that's what you need on the "management laptops"?

Dominick, you can do sourceless deployment to *any* edition of CFMX 7 so as long as your hosting company is running CFMX 7, you can do a sourceless deploy.
4 Mike Tangorre // Feb 25, 2005 at 12:20 PM

Sean,

What do you think about the following. Say you have three environments setup: development, testing/staging, production. Could you utilize these features to deploy a tested application to another server, resulting in one location to manage source code. I know it would require pushing changes from development all the way up, but isn't that how it's suppose to be? Perhaps this whole process could be automated? Just thinking here... sometimes it becomes a real PITA to manage all the environments, etc and synch them up (i know i know... follow the processes and this wouldn't be an issue).

Thoughts?
5 Sean Corfield // Feb 25, 2005 at 1:37 PM

Depending on how your app works, that might be a good solution. The J2EE packaging works by taking a single directory tree (e.g., your webroot) and putting the whole tree in a WAR/EAR file along with everything else. We have embedded config files that differ between servers so it wouldn't work for us and if you have Fusebox apps that generate parsed files you might not want to roll those from dev up to prod. We also have some apps that write files under the webroot and we certainly wouldn't want those pushed up to prod.
6 Nando // Feb 26, 2005 at 2:35 PM

Sean, I have one lingering question regarding sourceless deployment. From what i understand (and i have no experience here, so this could be completely off), there are tools out there that you can use to extract the java source code from compiled java byte code. While that makes it virtually impossible for someone to use the source in CF, it still may expose details about your code you'd want hidden. I *think* what i'd need in a few templates, but just a few, is the ability to encrypt and compile, but i'm not sure if that would function, or "work". If it functions, would the java source be unintelligible (would it "work" to hide all details about the source)?

One scenario i'm imagining is i'd like to set up a filter within a compiled app that checks cgi.server_name, and if the domain is not the one that the application is licensed to, it throws an error message. What i wouldn't want to happen is that some enterprising fellow renders the compiled code to java source, digs around to find the domain filter, an easy search if you know the domain, and rewrites that single template in CF.

So the basic question is for us folks new to the world of compiled source code, what does compiling give you in terms of protecting your source code, particularly with CF, and if there are holes, are there ways to close them?

Thanks much, Nando
7 Sean Corfield // Feb 28, 2005 at 7:58 AM

Nando, the Java bytecode that the CFMX compiler produces is pretty obscure so decompiling it won't be tremendously useful. If you have key strings like that in your code, what you can do is encrypt the key string and then encrypt the incoming server name and compare the encrypted versions - that makes the string much harder to find. Of course they could probably still find the string "server_name" (for the cgi.server_name variable lookup) so if you're really paranoid you could encrypt that too.

Bear in mind that it's pretty much impossible to create an uncrackable application. CF's encryption was pretty poor in the old days, compiling to Java bytecode is actually better protection out-of-the-box already.
8 Ant // Mar 7, 2005 at 5:38 AM

Hi Sean, just to confirm, you said "Sourceless deployment can be done from any edition to any edition". On macromedia.com it says that sourceless deployment isn't supported in Standard edition. What I'd like to do is create a .car on my developer edition and deploy it to a CFMX 7 Standard server. Is this possible? :-S

Thanks, Ant
9 Sean Corfield // Mar 7, 2005 at 7:55 AM

Ant, a CAR has nothing to do with sourceless deployment.

If you look in the detailed feature matrix (Flash Paper / PDF linked from the bottom of the Editions page), it says "Compiled Bytecode Applications
(Sourceless Deploy)" is available in both Standard and Enterprise Edition.

Sourceless deployment is not an automated process. You manually run the cfcompile script and then you manually deploy the compiled .cfm / .cfc files to a new CF server.
10 rui // Oct 29, 2005 at 1:21 AM

i am new to packaging and deployment of coldfusion applications, infact i have never done packing in any language applications.
i am using CFMX 7 ent, i got some idea of how to package and deploy cf applications, but can anyone tell me how to package cfmx application along with database. i am using mysql database.
i mean i have a cfmx application using mysql database,so how can i package the application along with mysql database?
11 Sean Corfield // Nov 1, 2005 at 1:53 PM

Rui, MySQL is a separately installed application and people usually put databases on separate servers too so your question doesn't really apply to most databases. You would generally deploy an application to infrastructure that is already in place.

You could have your ColdFusion application create and populate all the necessary database tables at first startup I suppose.

If you just want to ship a 'toy' database, you could use PointBase (the CFMX samples ship in an included PointBase database) on some platforms or Access on Windows.
12 JDog // Nov 23, 2008 at 8:36 AM

My situation:

We are a CF shop with our own SAAS apps. I have a prospective client that wants to host their website (and our applications) on their own servers. From what I can tell, the only reason that they want to do this is so that the IT guy can justify his salary (another discussion). He also used to be a web design teacher at a college, so the fear of him reselling our code is great (even with a legal agreement).

Anyhow, I would like to give them a J2EE option, that they could install in their Windows environment. Our applications use MySQL or MS SQL, and I have no problem giving him the databases. We don't really own enterprise, but I am OK with purchasing it if we need to.

So would this work?:

1. we get enterprise
2. we use our enterprise serial to create WAR/EAR files.
3.Customer installs our databases.
4. we use customers SQL logins to test the application remotely.
5. we create the war/ear files and send it to them.
6. we get paid and sleep easy.

Can it be done?
13 Sean Corfield // Nov 23, 2008 at 11:10 AM

@JDog, you can create the WAR from Developer Edition or Enterprise Edition. You need the Enterprise license on the *target* system to deploy the WAR, however.
14 JDog // Nov 24, 2008 at 9:03 AM

CRAP. That is what I am trying to avoid. So then a more cost-effective solution would be Blue Dragon? When you are building a website project in CF (because you have the apps ready to go), that the client wants to host, and they don't like CF, then you are screwed I guess. I was hoping that the J2EE option would let me send it to them without worry. This is another point in the C#/ASPX column. Darn.
15 Sean Corfield // Nov 24, 2008 at 10:24 AM

Well, New Atlanta's BlueDragon is about the same price as Adobe's ColdFusion so you won't save there - and I don't believe the BDA (BlueDragon Archive) deployment is available in the OpenBD open source / free project (not sure about that - check the project website).

There's also Railo which has a free, unrestricted edition which should allow you to do a WAR deployment. Railo is about to release 3.1 as open source (currently 3.0 is available as both free and enterprise editions) via JBoss.org - that may be a "selling point" if the client doesn't like CF.

An Architect's View

ColdFusion, Software Design, Frameworks and more...