Outdated certificates in JWS JOGL libraries

[rune.aasgaard]

The certificates have expired at the official jogl Java Web Start libraries at : http://download.java.net/media/jogl/builds/archive/jsr-231-1.1.1/webstart/jogl.jnlp, and now my users are complaining about the nasty looking warning messages. Could somebody at SUN care to upgrade the jars?

Rune

[Mickelukas]

Same as the applet launcher, Sun is being sloppy with renewing the certificates.

[gouessej]

Please send an email to Kenneth Russell to ask for updating the certificate.

Games published by our own members! Check 'em out!

[rune.aasgaard]

I have mailed him, even before I posted a message here. Nothing happened yet....

R

[BIS]

I will add my own to what I imagine is a flood of emails.
 
This is very, very bad. My work is currently being reviewed by a publisher and a professional society. The reviewers are not going to be impressed with error warning dialogs. I've put too much work into this project to see it torpedoed because Sun is too stingy/disorganized to re-up on their code signing certificates.
 
Frankly, this is just the sort of thing that I was afraid of when I decided to use Sun/Java/JOGL technology. This is incredibly irresponsible.

[sulim]

i was having the same issue, but i've since move to LWJGL as JOGL seems dead.

LWJGL is much more regularly updated, faster, has more features and not dependant on Sun who have a pretty lousy track record on fixing stuff.

It also seems to have a large community behind it so less likely to die like JOGL.

[gouessej]

i was having the same issue, but i've since move to LWJGL as JOGL seems dead.

LWJGL is much more regularly updated, faster, has more features and not dependant on Sun who have a pretty lousy track record on fixing stuff.

It also seems to have a large community behind it so less likely to die like JOGL.

As I already said, JOGL is not dead.

I sent an email to Mr Russell and to Mr Goethel a few minutes ago, I assume the certificates will be updated in a few days. Sorry for the disturbance.

[Ken Russell]

We're working on getting the new signing certificate. Sorry for the disturbance.

[Ken Russell]

Updates to the GlueGen runtime 1.0b06, JOGL 1.1.1, JOAL 1.1.2 and Java 3D 1.5.2 have been pushed out revising the signing certificate used for these binaries. As an added, though arguably dubious, benefit, if you are running Java SE 6 Update 10 or later you will not even need to accept a security dialog.

Note though that due to bugs in Java Web Start which apparently still haven't been fixed you may need to clear out your Java Web Start cache. If you see UnsatisfiedLinkErrors against JOGL then try that.

Apologies for how long this took.

[Ken Russell]

Forgot about the JNLPAppletLauncher, which has also been updated.

Games published by our own members! Check 'em out!

[Matzon]

if you are running Java SE 6 Update 10 or later you will not even need to accept a security dialog.

How is this made posible?
Would that be made possible for LWJGL too ?

[gouessej]

Updates to the GlueGen runtime 1.0b06, JOGL 1.1.1, JOAL 1.1.2 and Java 3D 1.5.2 have been pushed out revising the signing certificate used for these binaries. As an added, though arguably dubious, benefit, if you are running Java SE 6 Update 10 or later you will not even need to accept a security dialog.

Note though that due to bugs in Java Web Start which apparently still haven't been fixed you may need to clear out your Java Web Start cache. If you see UnsatisfiedLinkErrors against JOGL then try that.

Apologies for how long this took.

Thank you very much. [size=20pt]JOGL is not dead![/size] It is very interesting... no security dialog

[Glex]

Thank you very much. [size=20pt]JOGL is not dead![/size] It is very interesting... no security dialog

Was jogl.dev.java.net updated? As far as I can see no.

[BIS]

Thanks to Ken et al.

 

Now, if I can only get the JavaHelp people to update THEIR distribution's signature, I'll be a happy camper.

[gouessej]

Was jogl.dev.java.net updated? As far as I can see no.

This is not the subject of this thread. When I read your message, I checked that nothing was wrong with the JOGL link:
http://download.java.net/media/jogl/builds/archive/jsr-231-1.1.1/webstart/jogl.jnlp

Everything is fine, I'm under Java 1.6 update 13, I have even no security popup, it is excellent. Therefore, as I already said, JOGL is not dead

[princec]

OK so it seems there is a certificate Sun can use to push native libraries to the client without a security popup. We'd rather like to get ahold of that certificate for LWJGL. What's the score?

Cas

[renanse]

OK so it seems there is a certificate Sun can use to push native libraries to the client without a security popup.

I wonder how they decide who gets to use that special cert.  Seems a bit unfair if one GL binding can and another can not...   

[ryanm]

What's the score?

I'm going to predict an exchange something like this:

LWJGL: "Can we use your magic certificate please?"
Sun: "No."

Perhaps there'll be some kind of verification process for which libs can be submitted in order to use Sun's certificate, but it'll be slow and expensive.

It is interesting that they've done this for JOGL though, as it exposes huge globs of native code (that Sun has no control over) directly to malicious applet writers. It's going to be difficult to explain to an irate user that his pwned machine is the fault of his vulnerable graphics driver and not the invisible applet that accessed it.

[gouessej]

I wonder how they decide who gets to use that special cert.  Seems a bit unfair if one GL binding can and another can not...   

Is the behavior of JMonkeyEngine programmers fair? JME 2 pretends to support JOGL but when some bugs are found in the JOGL renderer, it is not considered as important as bugs in the LWJGL renderer. "Charité bien ordonnée commence par soi-même" -> before complaining about Sun's behavior, some people should teach their own lessons to themselves. Remind me who wrote the JOGL renderer of Ardor3D please.

it exposes huge globs of native code (that Sun has no control over) directly to malicious applet writers. It's going to be difficult to explain to an irate user that his pwned machine is the fault of his vulnerable graphics driver and not the invisible applet that accessed it.

It would be the same if LWJGL was able to benefit of this certificate and some people would program applets with it. If you really think Sun should not use this kind of certificate because it exposes huge globs of not controlled native code to malicious applet writers and if you are coherent, you won't wish that LWJGL benefits of it neither.

[ryanm]

It would be the same if LWJGL was able to benefit of this certificate and some people would program applets with it. If you really think Sun should not use this kind of certificate because it exposes huge globs of not controlled native code to malicious applet writers and if you are coherent, you won't wish that LWJGL benefits of it neither.

I agree with your analysis of your hallucination of my position.

Is this just a language barrier, or are you really this angry all the time?

[renanse]

Is the behavior of JMonkeyEngine programmers fair? JME 2 pretends to support JOGL but when some bugs are found in the JOGL renderer, it is not considered as important as bugs in the LWJGL renderer. "Charité bien ordonnée commence par soi-même" -> before complaining about Sun's behavior, some people should teach their own lessons to themselves. Remind me who wrote the JOGL renderer of Ardor3D please.

Um... ok?  As I recall, Steve Vaughan over at SRA wrote what he needed of a Jogl port and donated it.  Very nice of him to do that too.  Not sure why you have this chip on your shoulder, but personally I've never claimed it was a complete drop in replacement for jME's lwjgl impl.  I think they've improved it some since I left jME last year though.

[Ken Russell]

A while ago there was discussion within Sun about the possibility of signing third-party code that had been suitably audited. I'll ask one of the members of the Java security team to look at this thread and comment.

For what it's worth, I personally have no desire to put JOGL at an unfair advantage or LWJGL at an unfair disadvantage.

[princec]

It'd be nice to fast-track it seeing as we've been on about it for, oooh, years

Cas

[kappa]

I'm sure the LWJGL team will be happy to make any security changes needed to get it approved too.

[princec]

I believe it's already watertight.

Cas

[kikigey89]

Hello all together,

for a few weeks I get the following message when starting my applet:
java.io.IOException: Cannot validate certificate for jogl.dll
java.io.IOException: Cannot validate certificate for gluegen-rt.dll

Now I read this topic but I don't now, what to do. Is there an update? Which jnlp-File I have to call up?

[Mickelukas]

Are you using local copies of the files? if so re download them or use the one hosted by sun.

Otherwise post your jnlp file.

[kikigey89]

In my PHP-file I'm using this code:

1   2   3   4   5   6   7   8   9

<applet id="test" name="test" mayscript code="org.jdesktop.applet.util.JNLPAppletLauncher" width=743 height=558 archive="applet-launcher.jar, test.jar">   <param name="codebase_lookup" value="false" />   <param name="subapplet.classname" value="gov.nasa.worldwind.examples.applet.TestApplet" />   <param name="subapplet.displayname" value="Test" />   <param name="noddraw.check" value="true" />   <param name="progressbar" value="true" />   <param name="jnlpNumExtensions" value="1" />   <param name="jnlpExtension1" value="http://download.java.net/media/jogl/builds/archive/jsr-231-webstart-current/jogl.jnlp" /> </applet>

I also deleted the cached files.

But: In my test.jar, there is a jogl.jar and gluegen-rt.jar included (I created a Fat Jar with Eclipse).
Could it be, that the error is from these files? If yes, where can I get the new files with new certificates?
But offline in Eclipse it works. And when I delete the extension parameters of my applet code, I get a message if I want to disable Java's DirectDraw. If I click on "Yes", I get a message "Unable to open properties file" and there it ends. It doesn't work.

[Mickelukas]

Oh, a fat jar? That isn't necessary. Go back to the example they use at the applet launcher page and all will work splendidly for ya.

https://applet-launcher.dev.java.net/

If you really want to use a fat jar you need to redownload the applet launcher, jogl and gluegen jars.

[kikigey89]

Thanks! That part works now. But another not... I can create my Jar (Fat Jar as well) but when trying to start it, I get the following messages:

1   2   3   4   5   6   7   8   9   10   11   12   13   14   15   16   17   18   19   20   21   22   23   24   25   26   27   28   29   30   31   32   33   34   35   36   37   38   39   40   41   42   43   44   45   46   47   48   49   50   51   52   53   54   55   56   57   58   59

java.lang.NoClassDefFoundError: Could not initialize class gov.nasa.worldwind.WorldWind    at gov.nasa.worldwind.examples.applet.TestApplet.stop(TestApplet.java:326)    at org.jdesktop.applet.util.JNLPAppletLauncher.stop(JNLPAppletLauncher.java:927)    at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Unknown Source)    at java.lang.Thread.run(Unknown Source) JNLPAppletLauncher: static initializer os.name = windows xp nativePrefix =   nativeSuffix = .dll tmpRootDir = C:\DOKUME~1\CHRIST~1\LOKALE~1\Temp\jnlp-applet\jln118218448536438533 Applet.init subapplet.classname = gov.nasa.worldwind.examples.applet.TestApplet subapplet.displayname = Test Applet.start os.name = windows xp os.arch = x86 processNativeJar: using previously cached: C:\Dokumente und Einstellungen\[My Name]\.jnlp-applet\cache\localhost\01182800353d4550f1a3d260703eb7074a5def1b\jogl-natives-windows-i586.jar validateCertificates: VALIDATE: jogl.dll VALIDATE: jogl_awt.dll VALIDATE: jogl_cg.dll extractNativeLibs: EXTRACT: jogl.dll(jogl) EXTRACT: jogl_awt.dll(jogl_awt) EXTRACT: jogl_cg.dll(jogl_cg) processNativeJar: using previously cached: C:\Dokumente und Einstellungen\[My Name]\.jnlp-applet\cache\localhost\01182800353d4550f1a3d260703eb7074a5def1b\gluegen-rt-natives-windows-i586.jar validateCertificates: VALIDATE: gluegen-rt.dll extractNativeLibs: EXTRACT: gluegen-rt.dll(gluegen-rt) JNLPAppletLauncher.loadLibrary("jogl")     loading: C:\DOKUME~1\CHRIST~1\LOKALE~1\Temp\jnlp-applet\jln118218448536438533\jln6693041931166781508\jogl.dll java.lang.ExceptionInInitializerError    at gov.nasa.worldwind.WorldWind.createConfigurationComponent(WorldWind.java:178)    at gov.nasa.worldwind.WorldWind.initialize(WorldWind.java:43)    at gov.nasa.worldwind.WorldWind.<init>(WorldWind.java:37)    at gov.nasa.worldwind.WorldWind.<clinit>(WorldWind.java:26)    at gov.nasa.worldwind.awt.WorldWindowGLCanvas.<init>(WorldWindowGLCanvas.java:55)    at gov.nasa.worldwind.examples.applet.TestApplet.init(TestApplet.java:244)    at org.jdesktop.applet.util.JNLPAppletLauncher.startSubApplet(JNLPAppletLauncher.java:1929)    at org.jdesktop.applet.util.JNLPAppletLauncher.access$200(JNLPAppletLauncher.java:658)    at org.jdesktop.applet.util.JNLPAppletLauncher$5.run(JNLPAppletLauncher.java:1269)    at java.awt.event.InvocationEvent.dispatch(Unknown Source)    at java.awt.EventQueue.dispatchEvent(Unknown Source)    at java.awt.EventDispatchThread.pumpOneEventForFilters(Unknown Source)    at java.awt.EventDispatchThread.pumpEventsForFilter(Unknown Source)    at java.awt.EventDispatchThread.pumpEventsForHierarchy(Unknown Source)    at java.awt.EventDispatchThread.pumpEvents(Unknown Source)    at java.awt.EventDispatchThread.pumpEvents(Unknown Source)    at java.awt.EventDispatchThread.run(Unknown Source) Caused by: java.security.AccessControlException: access denied (java.util.PropertyPermission gov.nasa.worldwind.config.file read)    at java.security.AccessControlContext.checkPermission(Unknown Source)    at java.security.AccessController.checkPermission(Unknown Source)    at java.lang.SecurityManager.checkPermission(Unknown Source)    at java.lang.SecurityManager.checkPropertyAccess(Unknown Source)    at java.lang.System.getProperty(Unknown Source)    at gov.nasa.worldwind.Configuration.initializeCustom(Configuration.java:88)    at gov.nasa.worldwind.Configuration.<init>(Configuration.java:46)    at gov.nasa.worldwind.Configuration.<clinit>(Configuration.java:34)    ... 17 more

I tested the new applet call up code with the old Fat Jar (with old jogl.dll and gluegen-rt.dll) and that works perfect.

1   2   3   4   5   6   7   8   9

<applet id="test" name="test" mayscript code="org.jdesktop.applet.util.JNLPAppletLauncher" width=743 height=558 archive="test.jar, http://download.java.net/media/applet-launcher/applet-launcher.jar, http://download.java.net/media/jogl/builds/archive/jsr-231-webstart-current/jogl.jar, http://download.java.net/media/gluegen/webstart/gluegen-rt.jar">   <param name="codebase_lookup" value="false" />   <param name="subapplet.classname" value="gov.nasa.worldwind.examples.applet.TestApplet" />   <param name="subapplet.displayname" value="Test" />   <param name="noddraw.check" value="true" />   <param name="progressbar" value="true" />   <param name="jnlpNumExtensions" value="1" />   <param name="jnlpExtension1" value=" http://download.java.net/media/jogl/builds/archive/jsr-231-webstart-current/jogl.jnlp" /> </applet>

But I guess, that combination (Fat Jar with old certificates, new code [see above]) isn't a good one...