JWS 1.6 problem with signed .zip files?

Thread view:

Andrew Thompson - 18 Dec 2006 10:56 GMT

There was a possible problem raised on
this thread at the Sun JWS forum..
<http://forum.java.sun.com/thread.jspa?messageID=9401753>
..in relation to JWS 1.6 handling of signed .zip files.

'JWS 1.6 does not accept signed .zip files'

Can anybody confirm that earlier JWS would check
and handle signed .zip files like it does for jars?

Also, anybody else willing to point their browser
at that .JNLP listed, here ...
<http://www.physci.org/test/jws/zip/>
..and confirm it crashes for them as well?
(there is an 11K screenshot of my results..)

Andrew T.

Reply to this Message

Hemal Pandya - 18 Dec 2006 12:02 GMT

> There was a possible problem raised on
> this thread at the Sun JWS forum..
[quoted text clipped - 5 lines]
> Can anybody confirm that earlier JWS would check
> and handle signed .zip files like it does for jars?

If I download the jnlp file and change j2se version to 1.5 then it
gives security warning. More information says the security certificate
has not expired and is still valid. Clicking on Run starts the
application and it apparently runs as expected.

> Also, anybody else willing to point their browser
> at that .JNLP listed, here ...
> <http://www.physci.org/test/jws/zip/>
> ..and confirm it crashes for them as well?
> (there is an 11K screenshot of my results..)

I get similar result. First a pop-up that says Requesting JRE 1.6 from
java.sun.com and then another pop-up that says Unable to launch Audio
Trace 1.0.

I do not have Java 1.6 installed.

> Andrew T.

Reply to this Message

Thomas Hawtin - 18 Dec 2006 12:19 GMT

> 'JWS 1.6 does not accept signed .zip files'

You could have actually done what you suggested and searched for a bug.

"support for signed zip file with plug-in applets"
http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6472102

(That is for the Plug-in, but there is some shared code.)

And, yes I get the same thing on Solaris.

Tom Hawtin

Reply to this Message

Andrew Thompson - 18 Dec 2006 16:26 GMT

> > 'JWS 1.6 does not accept signed .zip files'
>
> You could have actually done what you suggested and searched for a bug.

My bad!

> "support for signed zip file with plug-in applets"
> http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6472102

Yes. That pretty much sums up the results we are
seeing, and confirms that handling of Zip files is
different for 1.5 and 1.6/6.0.

However, although it is currently listed as an
'In progress, bug' - I find this comment confusing..
"Evaluation: in 6.0, we will only read certficiates
for JAR files."

That *almost* implies to me 'we changed our minds,
and tightened the spec. without telling anyone - it will
stay that way - but we might document it somewhere'
(perhaps I read it wrong..)

Do you read that bug report as meaning that Sun
intends to change the behaviour of the 6.0 Plug-In
to again support signed Zip files?

Andrew T.

Reply to this Message

Knute Johnson - 18 Dec 2006 17:53 GMT

>>> 'JWS 1.6 does not accept signed .zip files'
>> You could have actually done what you suggested and searched for a bug.
[quoted text clipped - 23 lines]
>
> Andrew T.

Andrew:

Here is the exception if that helps any.

JNLPException[category: System Configuration : Exception: null :
LaunchDesc:
<jnlp spec="1.0" codebase="http://www.physci.org/test/jws/zip/"
href="http://www.physci.org/test/jws/zip/audiotrace.jnlp">
<information>
<title>Audio Trace 1.0</title>
<vendor>Andrew Thompson</vendor>
<homepage href="http://www.physci.org/test/jws/zip/audiotrace.html"/>
<description kind="one-line">Audio Trace - oscilloscope style sound
trace application.</description>
<description kind="tooltip">Audio Trace</description>
<icon
href="http://www.physci.org/test/jws/zip/audiotrace-64x64.gif"
height="64" width="64" kind="default"/>
<icon
href="http://www.physci.org/test/jws/zip/audiotrace-32x32.gif"
height="32" width="32" kind="default"/>
<shortcut online="false">
<desktop/>
<menu submenu="PhySci"/>
</shortcut>
<offline-allowed/>
</information>
<security>
<all-permissions/>
</security>
<update check="timeout" policy="always"/>
<resources>
<java href="http://java.sun.com/products/autodl/j2se" version="1.6"/>
<jar href="http://www.physci.org/test/jws/zip/audiotrace.zip"
download="eager" main="true"/>
</resources>
<application-desc main-class="org.physci.sound.AudioTrace"/>
</jnlp> ]
    at com.sun.javaws.Launcher.downloadJREResource(Unknown Source)
    at com.sun.javaws.Launcher.prepareLaunchFile(Unknown Source)
    at com.sun.javaws.Launcher.prepareToLaunch(Unknown Source)
    at com.sun.javaws.Launcher.launch(Unknown Source)
    at com.sun.javaws.Main.launchApp(Unknown Source)
    at com.sun.javaws.Main.continueInSecureThread(Unknown Source)
    at com.sun.javaws.Main$1.run(Unknown Source)
    at java.lang.Thread.run(Unknown Source)

Signature

Knute Johnson
email s/nospam/knute/

Reply to this Message

Andrew Thompson - 18 Dec 2006 18:43 GMT

...

> <java href="http://java.sun.com/products/autodl/j2se" version="1.6"/>

....

> </jnlp> ]
> at com.sun.javaws.Launcher.downloadJREResource(Unknown Source)

Sorry. I think that error is something else again, caused
by a stupid mistake on my part. The JNLP was directly
changed from 1.4 to 1.6, and I did not bother to check
the autoinstaller for 1.6 was available.

It seems your system is either 1.5, or 1.5 JWS is not
locating the 1.6 JRE? Are either of those things possible?
(both versions should be listed in the console).

Are you using 1.6 on that box yet?

In any case, the exception I am getting (from 1.6 JWS) is..

at com.sun.javaws.LaunchDownload.checkSignedResourcesHelper(Unknown
Source)
    at com.sun.javaws.LaunchDownload.checkSignedResources(Unknown Source)
    at com.sun.javaws.Launcher.prepareLaunchFile(Unknown Source)
    at com.sun.javaws.Launcher.prepareToLaunch(Unknown Source)
    at com.sun.javaws.Launcher.launch(Unknown Source)
    at com.sun.javaws.Main.launchApp(Unknown Source)
    at com.sun.javaws.Main.continueInSecureThread(Unknown Source)
    at com.sun.javaws.Main$1.run(Unknown Source)
    at java.lang.Thread.run(Unknown Source)

The message delivered to the console (copy/pasted) is..

#### Java Web Start Error:
#### Unsigned application requesting unrestricted access to system
Unsigned resource: http://www.physci.org/test/jws/zip/audiotrace.zip

Andrew T.

Reply to this Message

Knute Johnson - 19 Dec 2006 03:31 GMT

> ...
>> <java href="http://java.sun.com/products/autodl/j2se" version="1.6"/>
[quoted text clipped - 33 lines]
>
> Andrew T.

Andrew:

I am using Sun's 1.6 JDK. The box is WinXP SP2.

Signature

Knute Johnson
email s/nospam/knute/

Reply to this Message

Thomas Hawtin - 18 Dec 2006 20:26 GMT

>> "support for signed zip file with plug-in applets"
>> http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6472102
[quoted text clipped - 12 lines]
> stay that way - but we might document it somewhere'
> (perhaps I read it wrong..)

The bug description field implies that the spec has not changed, but
that the implementation is tighter.

I think the wording implies that the bug/RFE was found too late to get
into the first release of 1.6.

> Do you read that bug report as meaning that Sun
> intends to change the behaviour of the 6.0 Plug-In
> to again support signed Zip files?

I wouldn't be surprised to see, say, update 3 supporting signed zips
again. The only reasons I can see against doing so are firewall policies
that some companies may have, but that's pushing it.

Tom Hawtin

Reply to this Message

Andrew Thompson - 18 Dec 2006 21:30 GMT

> 'JWS 1.6 does not accept signed .zip files'

Thanks to Hemal, Thomas and Knute for the
test results.

This thread has been effectively resolved by
the bug report linked in Thomas' first reply.
It is a known bug.

Andrew T.

Reply to this Message

JWS 1.6 problem with signed .zip files?

Free Magazines