JOGL not launching on Ubuntu 12.04 LTS

JOGL not launching on Ubuntu 12.04 LTS (32 bit). When I click http://jogamp.org/deployment/jogamp-current/jogl-demos/Gears.jnlp the window never shows up.

It used to work for me in Ubuntu 10.

Anybody knows why is that happening?

MY configuration:

Ubuntu 12.04 LTS (fresh installation)

AMD Athlon II x2

Nvidia 9200 integrated + Nvidia 8000 or higher (need to pop the hood to see it.)

Icedtea (from ubuntu software center)

openJDK (and all other dependencies from ubuntu software center)

On 05/21/2012 10:59 PM, Pixelapp [via jogamp] wrote: Looks like Icedtea failed to work (again) on Ubuntu, hmm.
But w/o having seen the logs, we cannot tell.
I will check on Friday.
You may test w/ the closed source version in the meantime.

Xerxes might know better about the status. Xerxes ?

~Sven

> JOGL not launching on Ubuntu 12.04 LTS (32 bit). When I click
> http://jogamp.org/deployment/jogamp-current/jogl-demos/Gears.jnlp the window
> never shows up.
>
> It used to work for me in Ubuntu 10.
>
> Anybody knows why is that happening?

Due to a icedtea-web security update:
"RH672262, CVE-2011-0025: IcedTea jarfile signature verification bypass"
http://icedtea.classpath.org/hg/icedtea-web/rev/97f40ebebbdf
the code now drops all privileges unconditionally when  singed jars get mixed with unsigned code, in this case no security dialog are displayed at all.
This new icedtea-web behaviour, that is more secure, currently break all applets and jnlp code that try to mix unsigned and signed code.

I have filed a IcedTea bugreport for this JOGL not launching bug: http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=880

Quick workaround if you want to run jogamp JOGL applets today:
add

grant codeBase "http://jogamp.org/-" {
        permission java.security.AllPermission;
};

to /usr/lib/jvm/java-6-openjdk/jre/lib/security/java.policy

It will take time to find a solution that please both the users and security experts.

Please install
icedtea-netx and icedtea-plugin
and then run

javaws http://jogamp.org/deployment/jogamp-current/jogl-demos/Gears.jnlp

from a terminal and report any error message.
Running the Gears.jnlp using javaws  should work.

javaws http://jogamp.org/deployment/jogamp-current/jogl-demos/Gears.jnlp works.

But for my unsigned jar wavelogy.pixelapp.biz/WavelogyDesktop.jnlp gives me the java.security.AccessController error.

I guess I'll have to wait for the bug to be fixed.

On 05/22/2012 08:01 PM, Pixelapp [via jogamp] wrote:
> javaws http://jogamp.org/deployment/jogamp-current/jogl-demos/Gears.jnlp works.
>
> But for my unsigned jar wavelogy.pixelapp.biz/WavelogyDesktop.jnlp gives me
> the java.security.AccessController Error.

Gears.jnlp and the corresponding jogl-demos.jar are not signed!
Only the referenced GlueGen and JOGL JARs are signed.
Hence I personally don't like to see this as an 'mixed [signed] code' issue,
since the top layer (unsigned demo code) calls into the
bottom layer (signed gluegen/jogl code) w/o leaving it.

2: unsigned demo
1: signed JOGL
0: signed GlueGen

IMHO the security critical part would be having a sort of
three or more layers where the last three ones are mixed up:

3: unsigned
2: signed
1: unsigned
0: signed

In your case, I don't know the issue actually,
i.e. the difference to Gears.jnlp.

>
> I guess I'll have to wait for the bug to be fixed.
>

I wouldn't know what to say, because my code runs on Mac and Windows.

Moreover Gears.jnlp doesn't run directly from the web browser either, from chrome or firefox.

I have exactly the same problem. My code runs on Windows, but since I upgraded Ubuntu to 12.04 (amd64), it doesnt work anymore. I changed the privacy (added the lines of code as described above) and Gears.jnlp runs now - but not any other JOGL-code that worked on previous Ubuntu version...

The Java plugin and webstart in Ubuntu 12.04 uses the new IcedTea-web 1.2 version
while previous Ubuntu releases used the 1.1.x versions.

The regression you observe have most likely been introduced by one of the changes inside the larger code switch from the old stable icedtea-web 1.1.x versions to the new stable 1.2 version.
http://dbhole.wordpress.com/2012/03/05/icedtea-web-1-2-released/
http://dbhole.wordpress.com/2012/03/05/icedtea-web-1-1-5-released/

All new features of the icedtea-web 1.2 version is summarized in the icedtea-web release plans and design notes:
http://icedtea.classpath.org/wiki/IcedTea-Web#Release_Plans

I am unable to reproduce any issues using javaws (icedtea-web 1.2 netx):

Barbara: do you have any public test application?

Pixelapp: both javaws http://jogamp.org/deployment/jogamp-current/jogl-demos/Gears.jnlp and your javaws http://wavelogy.pixelapp.biz/WavelogyDesktop.jnlp

(displays this nice image and playes some music) worked on my Ubuntu 12.04 32bit setup using IcedTea-Web 1.2 (1.2-2ubuntu1) javaws.

For me the browser-plugin (icedtea-web 1.2 plugin) work as well:
http://jogamp.org/deployment/jogamp-current/jogl-test-applets.html

Using IcedTea-web 1.2 and Ubuntu 12.04 all kinds of applet types, dual, N ans L applets worked fine for the signed jogl version applet:
2: signed jogl version applet
1: signed JOGL
0: signed GlueGen
http://jogamp.org/deployment/jogamp-current/jogl-applet-version.html - OK dual (using Lapplet fallback)
http://jogamp.org/deployment/jogamp-current/jogl-applet-version-lancheronly.html - OK Lapplet
http://jogamp.org/deployment/jogamp-current/jogl-applet-version-napplet.html - OK Napplet
http://jogamp.org/deployment/jogamp-current/jogl-application-version.jnlp - OK (javaws netx)


unfortunately... unsigned demo applets hit one or another security-policy issue:
2: unsigned demo
1: signed JOGL
0: signed GlueGen

http://jogamp.org/deployment/jogamp-current/jogl-applet-runner-newt-gears-normal.html ,
http://jogamp.org/deployment/jogamp-current/jogl-applet-runner-newt-gears-normal-launcheronly.html ,
http://jogamp.org/deployment/jogamp-current/jogl-applet-runner-newt-gears-special.html and
http://jogamp.org/deployment/jogamp-current/jogl-applet-runner-newt-GraphTextDemo01.html - (dual and Lapplers) FAILED with:
java.security.AccessControlException: access denied (java.io.FilePermission /tmp/jnlp-applet write)
        at java.security.AccessControlContext.checkPermission(AccessControlContext.java:393)
        at java.security.AccessController.checkPermission(AccessController.java:553)
        at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
        at net.sourceforge.jnlp.runtime.JNLPSecurityManager.checkPermission(JNLPSecurityManager.java:284)
        at java.lang.SecurityManager.checkWrite(SecurityManager.java:979)
        at java.io.File.mkdir(File.java:1169)
        at org.jdesktop.applet.util.JNLPAppletLauncher.initTmpRoot(JNLPAppletLauncher.java:1067)
        at org.jdesktop.applet.util.JNLPAppletLauncher.<clinit>(JNLPAppletLauncher.java:2190)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
        at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        at java.lang.reflect.Constructor.newInstance(Constructor.java:532)
        at java.lang.Class.newInstance0(Class.java:372)
        at java.lang.Class.newInstance(Class.java:325)
        at net.sourceforge.jnlp.Launcher.createApplet(Launcher.java:726)
        at net.sourceforge.jnlp.Launcher.getApplet(Launcher.java:676)
        at net.sourceforge.jnlp.Launcher$TgThread.run(Launcher.java:886)

http://jogamp.org/deployment/jogamp-current/jogl-applet-runner-newt-gears-normal-napplet.html ,
http://jogamp.org/deployment/jogamp-current/jogl-applet-runner-newt-gears-normal-napplet2.html ,
http://jogamp.org/deployment/jogamp-current/jogl-applet-runner-newt-gears-special-napplet.html and
http://jogamp.org/deployment/jogamp-current/jogl-applet-runner-newt-GraphTextDemo01-napplet.html - (all Napplets) FAILED with:
Exception in thread "Applet" java.lang.ExceptionInInitializerError
        at com.jogamp.common.util.PropertyAccess.addTrustedPrefix(PropertyAccess.java:51)
        at jogamp.newt.Debug.<clinit>(Debug.java:52)
        at com.jogamp.newt.awt.applet.JOGLNewtAppletBase.<clinit>(JOGLNewtAppletBase.java:58)
        at com.jogamp.newt.awt.applet.JOGLNewtApplet1Run.<clinit>(JOGLNewtApplet1Run.java:95)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
        at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        at java.lang.reflect.Constructor.newInstance(Constructor.java:525)
        at java.lang.Class.newInstance0(Class.java:372)
        at java.lang.Class.newInstance(Class.java:325)
        at net.sourceforge.jnlp.Launcher.createApplet(Launcher.java:726)
        at net.sourceforge.jnlp.Launcher.getApplet(Launcher.java:676)
        at net.sourceforge.jnlp.Launcher$TgThread.run(Launcher.java:886)
Caused by: java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "getProtectionDomain")
        at java.security.AccessControlContext.checkPermission(AccessControlContext.java:366)
        at java.security.AccessController.checkPermission(AccessController.java:555)
        at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
        at net.sourceforge.jnlp.runtime.JNLPSecurityManager.checkPermission(JNLPSecurityManager.java:284)
        at java.lang.Class.getProtectionDomain(Class.java:2123)
        at com.jogamp.common.util.SecurityUtil$2.run(SecurityUtil.java:52)
        at com.jogamp.common.util.SecurityUtil$2.run(SecurityUtil.java:50)
        at java.security.AccessController.doPrivileged(Native Method)
        at com.jogamp.common.util.SecurityUtil.getCerts(SecurityUtil.java:50)
        at com.jogamp.common.util.SecurityUtil.<clinit>(SecurityUtil.java:46)
        ... 13 more
java.lang.NullPointerException
        at net.sourceforge.jnlp.NetxPanel.runLoader(NetxPanel.java:154)
        at sun.applet.AppletPanel.run(AppletPanel.java:379)
        at java.lang.Thread.run(Thread.java:722)
java.lang.NullPointerException
        at sun.applet.AppletPanel.run(AppletPanel.java:429)
        at java.lang.Thread.run(Thread.java:722)

I will contact the icedtea-web team and look into the security policy implementaton to hopefully make it allow running unsigned applets on top of signed jogl.
2: unsigned demo
1: signed JOGL
0: signed GlueGen

Xerxes: I acctually can run most of the links you posted (even the one that you had privacy problems with - but I still have this privacy setting changed as described in one of the posts above).
This ones I cannot run however:
http://wavelogy.pixelapp.biz/WavelogyDesktop.jnlp (page does never load... The server at wavelogy.pixelapp.biz is taking too long to respond.)
jogamp.org/deployment/jogamp-current/jogl-application-version.jnlp (Error: Could not launch JNLP file [...] Caused by java.lang.ClassNotFoundException: jogamp.opengl.awt.VersionApplet)

I discovered the problem while trying to run for instance the project described in Wade Walker's blog (http://wadeawalker.wordpress.com/2010/10/09/tutorial-a-cross-platform-workbench-program-using-java-opengl-and-eclipse)

And then I noticed I used older version of JOGL (jogl-2.0-b688-20120227) ... after updating the jars and librarys with the newest JOGL version (jogl-2.0-b752-20120504) the tutorial from the Wade's blog works again :) Hopefully this will help other as well. Thank you for your help, Xerxes...

Sven:

I notice today that the http://jogamp.org/deployment/util/applet-launcher.jar signer certificate have expired.

jarsigner -verify applet-launcher.jar
jar verified.

Warning:
This jar contains entries whose signer certificate has expired.

Do we have the sourcecode to this JNLPAppletLauncher at all?
http://jogamp.org/applet-launcher/www/

... never mind I was simply looking at the wrong place:

applet-launcher sources:
http://jogamp.org/git/?p=applet-launcher.git;a=summary

correctly signed version:
http://jogamp.org/deployment/jogamp-current/jar/applet-launcher.jar

Its kind of sad that we do not have a the source code for this applet-launcher released under a free software license.
The JNLPAppletLauncher.java currently contains this nuclear facility clause that restrict its use:
 * You acknowledge that this software is not designed, licensed or
 * intended for use in the design, construction, operation or
 * maintenance of any nuclear facility.

It would be nice it we could find someone working at the SUN/Oracle legal group to re-license this code under a free software license.

Yes, when it takes forever is not my server's fault. It is caused by the security bug. Therefore the application never loads.

On 05/25/2012 03:02 PM, Xerxes Rånby [via jogamp] wrote:
> Its kind of sad that we do not have a the source code for this applet-launcher
> released under a free software license.

I have mentioned the Applet Launcher deprecation here:
 <http://forum.jogamp.org/Applet-Hangs-in-JRE-1-7-0-04-tp4006640p4007414.html>

IMHO there is little need for this hacked JNLP loading mechanism since:
 - We have the native library JAR loading mechanism build into GlueGen
   - and hence all JogAmp modules utilize it
   - external modules may also utilize this feature
   - NApplet launching is demonstrated on our applet test page,
     traditional Applet tag w/ native lib JAR loading.
   - License of this code is 'New BSD clause' and may be used
     in other projects 'freely'.

 - Applet Launcher only emulates 'a little bit' of JNLP Applets
   by loading the native libraries referenced of the named JNLP file
   w/o loading other JNLP 'extensions'

 - JNLP Applet support is underway in OpenJDK (?)

 - JNLP Applet support is given on all platforms w/ the proprietary
   Java implementation

> The JNLPAppletLauncher.java currently contains this nuclear facility clause
> that restrict its use:
>  * You acknowledge that this software is not designed, licensed or
>  * intended for use in the design, construction, operation or
>  * maintenance of any nuclear facility.
>
> It would be nice it we could find someone working at the SUN/Oracle legal
> group to re-license this code under a free software license.
>

AFAIK .. this last statement is sort-of 'invalid'
and was only copied to the code / LICENSE file by accident (copy/paste).
However, given the above details .. I doubt there is lots of value in the
actual Applet Launcher implementation. Parsing of the JNLP file is probably
already done in OpenJDK. In case somebody likes to peek-at & copy
our native JAR lib loading - they are free to do so.

~Sven

I have added a new icedtea-web bugreport to track this issue:
http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=1016 - IcedTea-web sandboxes all jars in mixed unsigned jars + signed jars applets.

Sven wrote:
>  - JNLP Applet support is underway in OpenJDK (?)

The  plugin + jnlp_href + jnlp support is currently unimplemented/broken.
please feel free to take it up!
It should use the same codepaths as the working javaws implementation.
This would allow a second way to get jogl applets working using icedtea-web.
Start hacking by following the Building IcedTea-Web guide.
http://icedtea.classpath.org/wiki/IcedTea-Web#Building_IcedTea-Web
And try get the http://jogamp.org/deployment/jogamp-current/jogl-applet-version.html and http://jogamp.org/deployment/jogamp-current/jogl-applet-runner-newt-gears-normal.html demos working using the jnlp_href .

Cheers
Xerxes