Path: csiph.com!eternal-september.org!feeder.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: Andreas Leitgeb <avl@logic.at>
Newsgroups: comp.lang.java.programmer
Subject: Re: Breaking JNLP apps
Date: Sat, 29 Apr 2017 00:11:53 -0000 (UTC)
Organization: A noiseless patient Spider
Lines: 48
Message-ID: <slrnog7moa.sk7.avl@logic.at>
References: <7r63k95sf6r7556n9ml6hrkcdnmjaljb9d@4ax.com> <slrnlk3d06.rhr.avl@login.logic.tuwien.ac.at> <lhughu$6cd$1@dont-email.me>
Reply-To: avl@logic.at
Injection-Date: Sat, 29 Apr 2017 00:11:53 -0000 (UTC)
Injection-Info: mx02.eternal-september.org; posting-host="be5b4dd88260543970ae8442262e9f97"; logging-data="9366"; mail-complaints-to="abuse@eternal-september.org";	posting-account="U2FsdGVkX18+ovxrY5X6xoUus9cmLvN0"
User-Agent: slrn/1.0.2 (Linux)
Cancel-Lock: sha1:45P40foUU01+K4EdbxsZJNqRCOw=
Xref: csiph.com comp.lang.java.programmer:36554

markspace <markspace@nospam.nospam> wrote:
> On 4/6/2014 1:07 PM, Andreas Leitgeb wrote:
>> I recently posted here about my jnlp-template problems, but either
>> no one saw it or no one knew an answer. No one was inclined to post
>> a followup. The post's subject was
>>    "difficulties with using signed jnlp template"
>> its message-id is: <slrnlf9tf8.ngg.avl@gamma.logic.tuwien.ac.at>
> Here's a blog from Oracle I just happened on.  I wonder if you could 
> leave a comment or use their community features to get feedback on the 
> issue you're having.
> <https://blogs.oracle.com/java-platform-group/entry/new_security_requirements_for_rias>

Ok now, about 3 years later, I've finally been making some progress. I did
get the app running on an 1.8.0_131 client, but face some restrictions,
which (if I can't solve them) would complicate the deployment quite a bit.

The problem is about the jnlp-templates: I can successfully replace *some*
parts like the <jnlp codebase="..."> or <title>...</title> value with a *,
but if I try to use wildcards for a custom property:
    <property name="jnlp.myapp.foo" value="*"/>
in the <resources> section, then the signature verification fails, no
matter what was the actual value in the downloaded myapp.jnlp. (Even,
if it had a literal "*" there thus being equal to the template!)

The question is: how can I freely parameterize aspects of the application
without needing to embed the exact parameterization into the main jar file
and w/o the need to produce a specific signed jar for each possible set of
parameterizations?

Are there other parts of the jnlp more suitable for passing strings to the
app than properties?

Thanks in advance.


PS: the linked page claims the following:

" Some developers may notice that the <security /> element is missing from
" the above JNLP. By providing it within the cryptographically signed JAR
" file, it is no longer necessary within the JNLP for Java 7 update 51
" (January 2014).

This appears to be no longer true with 1.8 (or wasn't ever true to begin
with), as the application kept failing with some misleading error(*), until
I added the <security>...</security> tags back into the jnlp file to match
the Manifest's "Permissions:" entry.    (*): no java console, no exception
text - some dialog popped up suggesting to check the control panel...