This Bugzilla instance is a read-only archive of historic NetBeans bug reports. To report a bug in NetBeans please follow the project's instructions for reporting issues.

Bug 238813

Summary: web start does not sign JNLP file
Product: apisupport Reporter: maciekos
Component: HarnessAssignee: Martin Kozeny <mkozeny>
Status: RESOLVED FIXED    
Severity: normal CC: danielferber
Priority: P2    
Version: 7.4   
Hardware: PC   
OS: Linux   
URL: https://blogs.oracle.com/thejavatutorials/entry/signing_a_jnlp_file
Issue Type: DEFECT Exception Reporter:
Attachments: IDE log
screenshot
VM logs

Description maciekos 2013-11-26 10:11:19 UTC
Product Version = NetBeans IDE 7.4 (Build 201310111528)
Operating System = Linux version 3.7.10-1.16-desktop running on amd64
Java; VM; Vendor = 1.7.0_45
Runtime = Java HotSpot(TM) 64-Bit Server VM 24.45-b08

as stated in: https://blogs.oracle.com/thejavatutorials/entry/signing_a_jnlp_file 
deploying and signing java webstart project (and netbeans RPC) should copy '[appname].JNLP' file to '[mainJAR].jar/META-JNLP/APPLICATION.JNLP' and then sign JAR file afterwards.
currently netbeans doesn't  have that ability. so when launching an JNLP app user gets demotivating message:
"Although the application has a digital signature, the application's associated file (JNLP) does not have one. A digital signature ensures that a file is from the vendor and that it has not been altered."
Comment 1 maciekos 2013-11-26 10:11:23 UTC
Created attachment 142583 [details]
IDE log
Comment 2 David Strupl 2013-12-02 10:31:15 UTC
Hello,

I have re-assinged to apisupport (because the reporter mentioned also platform app).

I am not sure whether this is the same report as what you were solving recently. if so please mark as a duplicate.

Thanks,

David
Comment 3 Martin Kozeny 2013-12-03 08:20:15 UTC
Hello could you please attach screenshot or output from java console when this happen? And do you know what is [appname].jnlp in platform app? is it master.jnlp? And [mainJAR] is startup.jar? Thanks.
Comment 4 maciekos 2013-12-09 10:19:58 UTC
Created attachment 142963 [details]
screenshot
Comment 5 maciekos 2013-12-09 10:20:32 UTC
Created attachment 142964 [details]
VM logs
Comment 6 maciekos 2013-12-09 10:36:30 UTC
yes, in RPC its 'master.jnlp' should go into 'startup.jar'. But in RPC its more complicated, every 'jnlp' file should go into corresponding 'jar' file.

for simple java project its 'launch.jnlp' should go to [mainJAR].


I`ve added screenshots and logs. 

(In reply to Martin Kozeny from comment #3)
> Hello could you please attach screenshot or output from java console when
> this happen? And do you know what is [appname].jnlp in platform app? is it
> master.jnlp? And [mainJAR] is startup.jar? Thanks.
Comment 7 Martin Kozeny 2013-12-10 09:32:53 UTC
As I can see output from Java Console, there are warnings about third party jars, that their manifests does not contain application name, codebase and permissions attributes. It is connected with JDK 7_u45 and this problem is described in https://netbeans.org/bugzilla/show_bug.cgi?id=238098, b/c third party jars are already signed, I am unable to alter their manifest. Try to use please at this time JDK 7_u25 or 7_u21 and if problem persists, feel free to reopen the issue. Thanks.

*** This bug has been marked as a duplicate of bug 238098 ***
Comment 8 Martin Kozeny 2013-12-10 09:38:50 UTC
Sorry try use JDK 7_u21, but I am afraid that this probably not help, b/c there will be still problem with signing...
Comment 9 Martin Kozeny 2013-12-10 10:02:18 UTC
(In reply to maciekos from comment #6)
> yes, in RPC its 'master.jnlp' should go into 'startup.jar'. But in RPC its
> more complicated, every 'jnlp' file should go into corresponding 'jar' file.
> 
> for simple java project its 'launch.jnlp' should go to [mainJAR].

As I can see, we have only master.jnlp and branding.jnlp in RCP projects...
Comment 10 maciekos 2013-12-10 12:33:40 UTC
You closed this bug quickly.

lack of manifest attibutes has nothing to do with bug I`ve issued. bug 238098 describes lack of manifest attributes(which still persist in my netbeans 7.4, so thats why its present in logs.).

BUT 

this bug is about JNLP file not being properly signed. please see atached screenshot(side effect of not signing JNLP) and link which I`ve provided: 
https://blogs.oracle.com/thejavatutorials/entry/signing_a_jnlp_file  

its about how to properly sign JNLP for webstart deployement.
Comment 11 Martin Kozeny 2013-12-11 08:15:54 UTC
OK you're right. Could you please attach sample application to demonstrate the bug? I am unable to reproduce it. Thank you.
Comment 12 Martin Kozeny 2013-12-11 14:03:52 UTC
It is ok now, I am able to reproduce it.
Comment 13 Martin Kozeny 2013-12-12 12:55:49 UTC
I've put every jnlp into corresponding jars (master.jnlp to startup.jar) to JNLP-INF directory. Warning appears again and again. I've also leave the jnlp name, then change it to APPLICATION.JNLP, then to ${application.name}.jnlp and no success.
Comment 14 maciekos 2013-12-12 13:04:47 UTC
your JNLP files uses dynamic codebase?($$codebase)
Comment 15 Martin Kozeny 2013-12-12 13:33:15 UTC
Yes they are using dynamic codebase
Comment 16 maciekos 2013-12-12 13:45:18 UTC
when you use dynamic codebase the opening JNLP file is different than the one in JAR file. '$$codebase' is renamed by JVM with the opening location of opening JNLP file, but the '$$codebase' in JNLP in JAR  remains intact. (warning message remains).

so I dont have an idea how to use it with dynamic codebase. 

Ive only figured out without dynamic codebase. when using static codebase(like 'http://example.com'), main JNLP and JNLP in jar file remains the same all time, and only then it works.
Comment 17 Martin Kozeny 2013-12-12 14:28:06 UTC
And how about other variables like ${user.home} in master.jnlp...?
Comment 18 jczwo 2014-01-22 07:31:10 UTC
Please have a look at http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/signedJNLP.html

You could use JNLP-INF/APPLICATION_TEMPLATE.JNLP for dynamic content.

Have you got a working Patch for static codebase? We are waiting desperately. :-)
Comment 19 Martin Kozeny 2014-01-27 15:54:15 UTC
No I haven't. There are still other attributes in master.jnlp, that are referenced by variable like ${branding.token} and other app properties...
Comment 20 jczwo 2014-04-01 13:49:00 UTC
I tested today with with Java 8 and Netbeans 8. Problem still exists. I also want to note that this problem is operating system independent.

No Netbeans Plattform JNLP application is able to run on current Java 7 or Java 8 runtime environments. Priority should be increased.
Comment 21 Martin Kozeny 2014-05-30 15:40:04 UTC
(In reply to jczwo from comment #18)
> Please have a look at
> http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/signedJNLP.html
> 
> You could use JNLP-INF/APPLICATION_TEMPLATE.JNLP for dynamic content.
> 
> Have you got a working Patch for static codebase? We are waiting
> desperately. :-)

Yeah I can use jnlp template for dynamic content, but template allows you to have '*' as values for elements and attributes, not ${} variables. I am still playing with that problem...
Comment 22 Martin Kozeny 2014-07-21 13:59:32 UTC
Fix: https://hg.netbeans.org/core-main/rev/ee227c0cfa40
If problem persists feel free to reopen.
Comment 23 Quality Engineering 2014-07-23 02:06:59 UTC
Integrated into 'main-silver', will be available in build *201407230001* on http://bits.netbeans.org/dev/nightly/ (upload may still be in progress)

Changeset: http://hg.netbeans.org/main-silver/rev/ee227c0cfa40
User: Martin Kozeny <mkozeny@netbeans.org>
Log: #238813: web start does not sign JNLP file.