[SOLVED] [Java6 Update 19] Browser shows warning when running signed applets

[molzb]

Hi!

Java6 Update 19 was released one week ago.
This release of Java shows a warning in the browser window
if you mix signed code (e.g. jme.jar) and unsigned code (e.g.
your images in resource.jar) in your applet.

So if you run
http://lwjgl.org/applet
you will see sth. like that:

As you can see, this looks everything but inviting. You have to click
'No'(!) to go on, unlike every other application, where you always click 'yes'
to advance.

Sun has a tutorial how to avoid this warning:
http://java.sun.com/javase/6/docs/technotes/guides/jweb/mixed_code.html

Has anyone tried to make the demo applet run without that warning window?

Thanks,
Bernhard

[Matzon]

nightly builds contain the required trusted-library manifest key - so next release should "fix" this issue.

[molzb]

nightly builds contain the required trusted-library manifest key - so next release should "fix" this issue.

Thanks for the info. Let me first say that I feel honoured to talk to one
of the main developers. I had just a look into your new nightly build-applet.xml
and build.xml.

I still have a problem with signing my old version of LWJGL (sorry, can't update to
LWJGL2) . Perhaps you can give me some insight there.

My old version consists of lwjgl.jar, lwjgl_util_applet.jar and windows_natives.jar.
This version uses the old method installLibs() to install the DLLs into the temp directory.

When I sign all jars with my valid certificate and _without_ changing the manifest,
LWJGL works fine, but I get that nasty window (Mixed Code).

When I sign lwjgl.jar, lwjgl_util_applet.jar and windows_natives.jar and added

Trusted-Library: true
Sealed: true

to the manifest-files, I get that exception:

07.04.2010 15:34:53 class com.jme.system.lwjgl.LWJGLSystemProvider installLibs()
	07.04.2010 15:34:53 class com.jme.system.lwjgl.LWJGLSystemProvider installLibs()

	java.security.PrivilegedActionException: java.lang.Exception: Unable to open /windows_natives.jar, which was expected to be on the classpath
		at java.security.AccessController.doPrivileged(Native Method)
		at org.lwjgl.util.applet.LWJGLInstaller.tempInstall(LWJGLInstaller.java:103)
		at com.jme.system.lwjgl.LWJGLSystemProvider.installLibs(Unknown Source)

When I sign the 3 jars (lwjgl, lwjgl_util_applet, windows_natives) _without_ changing the
manifest, I get another exception:

NoClassDefFoundError: LWJGLInstaller

So I'm utterly confused, the jars are definitely there, the certificate is valid,
without changing the manifest everything works fine.

Do you have an idea what went wrong there?

Thank you,
Bernhard

[Matzon]

basically, the problem is that you will have different classloaders for different signed packages. So make sure *everything* is signed by the same certificate - and has Trusted-Library: true

[kappa]

personally wouldn't recommend you use such an old version of LWJGL especially for applets, I'm surprised it still works

Also LWJGLInstaller is really old and has its limitations (just take a look in your temp folder and you'll find masses of lwjgl natives ) if you can do upgrade to the latest and greatest LWJGL

[broumbroum]

When I sign lwjgl.jar, lwjgl_util_applet.jar and windows_natives.jar and added

Trusted-Library: true
Sealed: true

to the manifest-files, I get that exception:

07.04.2010 15:34:53 class com.jme.system.lwjgl.LWJGLSystemProvider installLibs()
	07.04.2010 15:34:53 class com.jme.system.lwjgl.LWJGLSystemProvider installLibs()

	java.security.PrivilegedActionException: java.lang.Exception: Unable to open /windows_natives.jar, which was expected to be on the classpath
		at java.security.AccessController.doPrivileged(Native Method)
		at org.lwjgl.util.applet.LWJGLInstaller.tempInstall(LWJGLInstaller.java:103)
		at com.jme.system.lwjgl.LWJGLSystemProvider.installLibs(Unknown Source)

...

Sealed : false must be more friendly

[molzb]

First, thanks to everyone for your responses.

personally wouldn't recommend you use such an old version of LWJGL especially for applets, I'm surprised it still works

Yes, indeed. I'm always happy if our applet works

I tried once to do that, but unfortunately there is an old JMonkey-Engine
http://www.jmonkeyengine.com/on top of an old LWJGL.
JMonkey has experienced lots of API changes, so updating JMonkey and
LWJGL is not an easy task for me and unfortunately I didn't write the applet
that I have to maintain now.
But someday I hope I am able to upgrade to the greatest LWJGL and Jmonkey,
then I will sit down, look back and I will put on a big smile 

Sealed : false must be more friendly

Thanks, I have removed [Sealed: false] from my make-file.
Didn't change anything, though.

So make sure *everything* is signed by the same certificate - and has Trusted-Library: true

Everything is signed with the same valid certificate and has Trusted-Library: true.

<applet archive="myMain.jar, jme.jar, lwjgl.jar, windows_natives.jar">

I have checked all jars with jarsigner -verify, everything's correct. The manifests are there, too.
The browser shows my certificate, when starting the applet.

There was one thing that seemed strange to me. When I removed windows_natives.jar
from my applet tag, leaving

<applet archive="myMain.jar,jme.jar,lwjgl.jar">

it still works (even after deleting the java cache manually).

Having a look into the source-code in (org.lwjgl.util.applet.)LWJGLInstaller.tempInstall
I saw that windows_natives.jar was hardcoded there. It loads the file and copies
it into my temp directory. So this is where the "mixed code" comes from, is that so?

private static final String NATIVES_PLATFORM_JAR = "/" + LWJGLUtil.getPlatformName() + "_natives.jar";
InputStream is = LWJGLInstaller.class.getResourceAsStream(NATIVES_PLATFORM_JAR);
File tmp_jar_file = File.createTempFile("lwjgl", ".jar");
copyFile(is, new FileOutputStream(tmp_jar_file));

And being loaded "secretly", the Java VM can't have a look at the manifest files
to avoid the "Mixed code" warning in the browser ?

Thanks

[kappa]

LWJGLInstaller is no longer part of LWJGL, its been deleted for being crap

You might want to have a go at trying to use LWJGL2's AppletLoader, it should work with LWJGL1 as its completely standalone from LWJGL2 and you won't have to upgrade the rest of LWJGL (i.e. lwjgl.jar or jme.jar).

The AppletLoader is completely contained in lwjgl_util_applet.jar, so if you grab that from the LWJGL2 package you should be able to use it with your current jars.

Note the AppletLoader works pretty differently from LWJGLInstaller. You don't need any java code at all to use it, it'll deploy the natives for you completely through html. So it might be worth looking into. It also works with Java6u19 without a scary dialog. For an example on how to use it download the LWJGL applet bundle from the download page and see the appletloader.html file to learn how to use it.

[molzb]

LWJGLInstaller is no longer part of LWJGL, its been deleted for being crap

Agree 

You might want to have a go at trying to use LWJGL2's AppletLoader, it should work with LWJGL1 as its completely standalone from LWJGL2 and you won't have to upgrade the rest of LWJGL (i.e. lwjgl.jar or jme.jar).

Thanks, that was the right idea. You made my day!
It works now with the new AppletLoader and without that
scary warning in the browser.

Thanks to Matzon and broumbroum, too.