|License Type||SaaS & On-Prem|
|Agent Mode||Assess & Protect|
|Main Product Category||Java Agent|
Originally the Java agent that was downloaded from the Contrast UI was essentially a "launcher" jar. Rather than being the full agent the was effectively a wrapper and when launched would communicate with the Contrast server to download the full agent, which was then used to instrument your application. These launcher jars would automatically update to the latest version which doesn't allow customers to follow proper change control processes.
As of v3.5.8, the launcher jar has been deprecated (Java Agent v3.5.8 Release Notes). All
contrast.jar files downloaded since this time are full agent jars. This decision was made to hand back control of updates to our users. In its place, users are now able to download the agent directly from a number of widely used repositories, as well as programmatically from the Contrast UI itself. Please see the Java Installation docs for details.
How do I tell if my application is still using the deprecated Java launcher jar rather than a full agent jar?
To check whether your application is still using the launcher jar, you'll need to check the output from the agent when your application is started. For example, if you're running your application directly, you can write the output to a text file:
java -javaagent:contrast.jar -jar sampleApp.jar > output.txt
After that you can cat that output.txt and pipe it to grep with the string
auto-updating. For example
cat output.txt | grep Java auto-updating
If you see the string
Launcher successfully started the Contrast Agent then you know that you are still using the launcher agent and will need to replace this with a freshly downloaded agent jar to prevent further auto-updates.