I get plenty of searches arriving at this blog looking for information about the infamous "907 Invalid JAR" Java ME OTA provisioning error. After 6 months of solid data from our provisioning platform I feel I am finally starting to understand the causes of this frustrating error.

Update: After Enrique's comment I decided to make my post more comprehensive so I have included the causes of 907 errors that one would encounter during development / early deployment phase. I will add to this post over time so that it becomes an all inclusive help file. Let me know if you have anything to contribute.

(1) Your manifest file or JAD are incorrectly formatted. Ensure the end-of-line characters are consistent and that the files are properly formatted (no weird spaces/line breaks). My recent troubles downloading the CNN application were as a result of a badly formatted manifest file.

(2) Your manifest or JAD are missing attributes (MIDP/CLDC declaration for example). This is easy to do if you are manually creating or editing your descriptor files. Rely on your build tools (J2ME Polish, Antenna, Netbeans, etc) to do this for you.

(3) The JVM you are targeting doesn't like something about your JAR. Even though your application works perfectly on Nokia and Sony Ericsson devices be prepared for some JVMs to throw this error when trying to install the application. The only solution for this is painful manual debugging. Strip your application down to the basics and slowly add features until you find the offending bit of code then refactor mercilessly until it works.

(4) The download times out and the network operator proxy server sends a message which the Java Application Manager (JAM) doesn't understand and it throws a 907. Ask your user to try again, maybe at a different (quieter) time of day. If people are persistent on slow networks they can still get the application. This error happens fairly regularly on all devices on slower 2.5G networks.

(5) The certification validation fails. If the application is certified ensure the device has the correct root certificates and the device date/time are set correctly.