Urgent: Java 7 Update 51 (Mac OS X) Stops Servoy Launching

[swingman]

As I understand Christian is using a plain Servoy install, so no resigning done.
Christian is this correct?

Yes it is plain 7.2.x

[ngervasi]

No Johan, I'm having the issue with Servoy 7.3.1 on Windows7 using a self-signed certificate and Robert is using a full GlobalSign certificate.

[ngervasi]

Setting the security mode of java to "medium" allow the smart client to open. In the java console I only get this:

Missing Permissions manifest attribute in main jar: http://servoy.xxxxxxxxxxx.it:8080/lib/j2db.jar
Under WebStart on Java >= 1.6.0_18, the value of the "sun.awt.disableMixing" system property needs to be defined in the JNLP descriptor with value "true" (or "false" if you really want the default behavior). When not set to "true", the content of the native components may not be displayed.

[Harjo]

We are running fine, with 7.3.1 and Java 7 Update 51 signed with our own GlobalSign certificate and Security set to High!
I even set the security to Very High, and everything works fine!

I still get the yellow balloon warning.
but accepting that (once) works fine

Maybe you guys use the browserSuite plugin? which is blocking now, because of the (unsecure) vmargs

2014-01-15_1614.png (49.49 KiB) Viewed 8439 times

[ngervasi]

I do use the Browser suite but the only args that I have set in the admin pages are:

Code: Select all

-XX:MaxHeapFreeRatio=10 -XX:MinHeapFreeRatio=10

[Harjo]

Try to remove those from the servoy-admin page (replace by a space, or else you will auto get the vmarg: -XX:SoftRefLRUPolicyMSPerMB=3600000

Those vmargs are been listed as unsecure!

[ngervasi]

Unsecure? Harjo, are you sure about that? I need those args to control memory usage for a client that is running all the smart clients in Citrix, without those args the memory is never released to the operating system and they would need to add more servers to support all their users.
It's weird that I don't get any warning in the java console about that.

[Harjo]

Yes I believe so, the only way to set & accept insecure system properties, is to sign the jnlp

http://docs.oracle.com/javase/7/docs/te ... dJNLP.html

There are several advantages to signing a JNLP file. It will:

Ensure that others cannot change the content in your JNLP file. For example, by adding a random library, or changing application information.
Allow the use of arbitrary Java Virtual Machine (JVM) options and Java system properties in your application.
Prevent others from referencing your JAR file directly in their HTML browser applets.

But that is the whole problem of Servoy, because you can't sign the jnlp launching file, because the jnlp is totally dynamically created when you download it.

[ngervasi]

This is a big problem for me, when a client generate a big Jasper report the memory usage raises up to more than 700MB and without those arguments it's never released to the system.
Johan do you have any suggestion?

[ROCLASI]

I just re-signed my server again and made sure I was using the latest signtester version (1.3) and now it works indeed.
So it looks like I didn't sign my server using the latest version of Signtester.

But in any case I believe if you don't use the latest Servoy versions (that have the proper signing already done) OR don't re-sign your server with a valid certificate and the latest sign tester version (i.e. version 1.3 and up) you can't use Java 7 Update 51 since that now requires the permissions to be set.
Or am I wrong here?

[jcompagner]

robert is right, it looks like that update51 with high security settings (i think medium still works) will not let any thing through that doesn't have:

1> signed with a valid certificate (not self signed)
2> all the manifest attributes (codebase,permissions) have to be set on all the jars

Then it should work i think (as far as i have tested)

If you want to use self signed then the slider must be on the bottom (medium security)

So if you have a valid certificate using the latest signtester then you should be able to resign any servoy version and that one should work then in the default java security settings.

You still seem to be getting that yellow balloon because of unsigned jnlp (which is because of what they have marked as unsecure vm args, or better said i think, what they didn't mark as secure vm args)

This can be fixed i guess IF your jnlp file is stable (you don't need arguments send to the solution or use profiles)
Because if you just always hit the default jnlp file, what you can do is save that jnlp file to disk, then add it to the jar (https://blogs.oracle.com/thejavatutoria ... _jnlp_file)
then resign that jar.

then the "jnlp" is signed.

[IT2Be]

Because if you just always hit the default jnlp file, what you can do is save that jnlp file to disk, then add it to the jar (https://blogs.oracle.com/thejavatutoria ... _jnlp_file) then resign that jar.

From what I read (http://docs.oracle.com/javase/7/docs/te ... dJNLP.html) adding the jnlp to the jar is possible Johan but only with the use of a template file with the name JNLP-INF/APPLICATION_TEMPLATE.JNLP.

The docs say: When a web start application is started, the JNLP file used must be identical to the JNLP file in the signed JAR in order for the application to run.

But most resources have these attributes: download="%%loadmethod%%" version="%%version%%"
Because they can change the template should include them as : download="*" version="*"

Or do I misinterpret this information?

[Harjo]

The jar? Which jar?

[ngervasi]

I guess the main jar, in console I only see this warning:

Code: Select all

Missing Permissions manifest attribute in main jar: http://servoy.xxxxxxxxxxx.it:8080/lib/j2db.jar

[Harjo]

Nicola, my guess your problem still lies in the fact that you did'nt use the latest sign-tester!

if you use version 1.3 you won't get that error!!

you can easily check this, by downloading this jar, rename it to .zip, open it, en look if this attribute is there!