Urgent: Java 7 Update 51 (Mac OS X) Stops Servoy Launching

[ngervasi]

I'm using the latest version, this evening I will try to resign with the official certificate which fortunately arrived 10 mins ago from globalsign.

[siavash.roozbehan]

Hi Guys, Our server is on version 7.3.1 and I have resigned all the jar files with the latest signtester tool (version 1.3) as I still can't open the application with the java security set on high. We use the browsersuite plugin but we don't set any arguments for the plugin in the admin page. I don't know what am i missing that I can't seem to get to work!

ps, all the jar files seem to have the all-permission set to all-permissions.I don't set any codebase in the command I run to resign the jar files. Is it mandatory?

Can anyone tell me what can be the issue as it seems others are able to run the app with security set to high when resigned with the latest signtester tool and servoy 7.3.1.

Cheers,
Siavash

[ptalbot]

You can set a Java System property 'codebase' on the command line:
java -Dcodebase=* -jar signtester.jar ....

[jcompagner]

From what I read (http://docs.oracle.com/javase/7/docs/te ... dJNLP.html) adding the jnlp to the jar is possible Johan but only with the use of a template file with the name JNLP-INF/APPLICATION_TEMPLATE.JNLP.

The docs say: When a web start application is started, the JNLP file used must be identical to the JNLP file in the signed JAR in order for the application to run.

But most resources have these attributes: download="%%loadmethod%%" version="%%version%%"
Because they can change the template should include them as : download="*" version="*"

Or do I misinterpret this information?

yes you have to name it like they say (it must be a standard name) inside that dir in the main jar file which is j2db.jar

to get the actual jnlp file you need to get the jnlp file that is downloaded from the browser (you don't even have the main jnlp file on disk on the server like the plugins, its completely generated)

to get that file you can do:

https://yourhost:8080/servoy-client/MyS ... p?raw=true

that raw=true will let you see the jnlp file as is in the browser (view source and you see it even better)
save that file to disk.

The url you use to save it to disk, must be exactly the same as the url that you use to start the application. So that the contents of the jnlp file is exactly the same.

[siavash.roozbehan]

You can set a Java System property 'codebase' on the command line:
java -Dcodebase=* -jar signtester.jar ....

Ok, I resigned all the jar files again with codebase parameter added to the command and I still can't open the application with security setting set to high. Anyone has any suggestion on how can I get it to work or what can be wrong?

Thanks,
Siavash

[siavash.roozbehan]

Ok, I think it doesn't matter how I sign the jar files, I will still get the error as we are using self signed certificates. Do we have to but an official certificate from somewhere like global sign? if yes, can someone please advice me what type of certificate should we buy, maybe the name or the link to where can I find it.

Thanks in advance,
Siavash

[ngervasi]

I've ordered from globalsign.com, look for "Code signing certificate" and be careful to select "For Sun Java" when placing the order. It costs €170/year and they take 1 week usually to issue it. Watch out your snail mail post box for their address verification letter. There are many other CA to choose from: Tawthe, Komodo, etc. Just google for "code sign certificate".

[siavash.roozbehan]

I've ordered from globalsign.com, look for "Code signing certificate" and be careful to select "For Sun Java" when placing the order. It costs €170/year and they take 1 week usually to issue it. Watch out your snail mail post box for their address verification letter. There are many other CA to choose from: Tawthe, Komodo, etc. Just google for "code sign certificate".

Thanks Nicola for the suggestions.

[awvservoy]

Hello all- we're hitting the same problem and following all of the recommendations here (we have Thawte code-signing cert, disabled servoy.vmClientArgs in appserver) and still getting missing manifest error for j2db.jar.

- resign all jarfiles with signtester.jar 1.3 using our Thawte code-signing cert
- tried with 'Dcodebase=*" didn't work
- tried with 'Dcodebase="hostname.domain.com" - didn't work
- tried with 'Dcodebase="hostname.domain.com:443" - didn't work

I then tried to take Johan's suggestion below and open jd2b.jar, insert 'JNLP-INF'/APPLICATION_TEMPLATE.JNLP' with the contents being the "raw" output as viewed in source. Resign code with all above options- still didn't work.

I then created the file as 'JNLP-INF/MySolutionName.jnlp'. Rezipped the jarfile, signed it, and ran.

Now I get the following:

"Failed to validate signing of launch file. The signed version does not match the downloaded version."

I compared the jnlp source from the raw and the qtix.jnlp I included in the j2db.jar file- they match 100%.

Any suggestions on what I could be missing here? Thanks in advance for any and all suggestions.

Regards, Tony

From what I read (http://docs.oracle.com/javase/7/docs/te ... dJNLP.html) adding the jnlp to the jar is possible Johan but only with the use of a template file with the name JNLP-INF/APPLICATION_TEMPLATE.JNLP.

The docs say: When a web start application is started, the JNLP file used must be identical to the JNLP file in the signed JAR in order for the application to run.

But most resources have these attributes: download="%%loadmethod%%" version="%%version%%"
Because they can change the template should include them as : download="*" version="*"

Or do I misinterpret this information?

yes you have to name it like they say (it must be a standard name) inside that dir in the main jar file which is j2db.jar

to get the actual jnlp file you need to get the jnlp file that is downloaded from the browser (you don't even have the main jnlp file on disk on the server like the plugins, its completely generated)

to get that file you can do:

https://yourhost:8080/servoy-client/MyS ... p?raw=true

that raw=true will let you see the jnlp file as is in the browser (view source and you see it even better)
save that file to disk.

The url you use to save it to disk, must be exactly the same as the url that you use to start the application. So that the contents of the jnlp file is exactly the same.

[jcompagner]

the client starts right?

that you still get that missing manifest attributes is i think just a problem/bug of the java jre itself.

i personally never have really played with that signed certificate stuff so i can't say much more about it then what the docs say on the internet..
but from what i read it really has to be this name JNLP-INF/APPLICATION_TEMPLATE.JNLP (all capitals)