JWebStart app signing problem

I try to deploy a Java3d app with Java Web Start. It does not start because Jars are unsigned. (my own and JogAmp one's).
I set up the Exception Site List, as described in Java doc. and use the latest Java version.
You can try it there : http://cliper.pagesperso-orange.fr/launchTest.html
I am looking for help because I do not know what to do now.
Thank you for any help
jfp

Hi

Some entries are still unsigned, including gluegen-rt.jar. You should rather sign all your JARs (JogAmp JARs too) with your (untrusted) certificate. I'm sorry, my tutorial about Java3D tells nothing about deployment unlike the next one about JogAmp's Ardor3D Continuation.

To sum up, if you still want to use Java Web Start, sign all JARs mentioned in a single JNLP file with the same certificate even though you use the exception list. As you can see in this ticket, I'm a bit upset by the security changes.

Otherwise, if you want to use another deployment method, let me know, I can make some suggestions.

Your jnlp file seems to be correct but the use of "nativelib" isn't mandatory with JOGL 2 (it was mandatory with JOGL 1). At first, if you make a mistake in the naming of an architecture, Java Web Start will be unable to load the correct native libraries. Moreover, there is a bug in Java Web Start that makes it fail to extract and load native libraries when the end user disables the cache or when its size is too small. I advise you to the "jar" JNLP tag for all JARs and then GlueGen will take care of picking the right libraries for you. The only drawback is that Java Web Start will download all native libraries instead of just the supported ones.

There is a spelling mistake in your jnlp file, replace "jjogl/ogl-all-natives-windows-i586.jar" by "jogl/jogl-all-natives-windows-i586.jar".

Use "keytool" to create your own certificate (only once) and use "jarsigner" to sign all JARs with the same certificate as you use a single jnlp file, you don't use any extension.

You might have to modify the "Trusted-Only" and "Trusted-Library" manifest attributes to make it work, use "jarsigner" to do it.

Edit.: The use of MP3 might require you to pay some fees, I advise you to use Paul Lamb Sound Library with its JOAL plugin and its OGG codec instead. Moreover, it works better under OpenJDK and JavaSound is quite buggy even under Windows.

Edit.2: Please use SVN or Git in your Sourceforge project to help people to look at your source code and see the changes more easily than with a zip. My own project is an Eclipse project, it's easy to make it work in Netbeans than make a Netbeans project work in Eclipse because Netbeans creates tons of files except when it is used with Maven.

Edit.3: The file Thumbs.db isn't very useful, maybe you should remove it from your ZIP archive. Your project should mention all licences (third party libraries and contents + yours). Why does Cliper extend JApplet?

Thank you for your response, fast and efficient. I am going to do what you said for signing jars.
I plan to use an installer for Windows (Nsis one). I am inerested to know your ideas about deployment because Java web start, which is "magic", has problems with security (I can understand that)
For mp3 use, I got clearance from author for demonstration purposes but I will look at your suggest for sound.
So, thank you for advise. I will come back if I have difficulties, but anyway to tell how all this works.
jfp

Hi

You're welcome. Signing JARs won't be enough but it is necessary. I'm currently writing a tutorial about JogAmp's Ardor3D Continuation, I'm going to publish it as is, unfinished and there is a huge section about deployment. This section contains the details that I forgot to mention yesterday about Java Web Start and security changes with tons of references to the official Oracle tutorials.

The problem with the MP3 doesn't come from the library that you use (JavaZoom), it comes from the MP3 format. There is a very few chances that you get into trouble because of it but OGG is more efficient, open and largely used.

NSIS is good but keep in mind that:
- it's not the same experience, it's rather "Download, install and run"
- there are better tools to make an executable from a Java application if you want to keep it simple for you and for the end users

I'm going to post a link to my tutorial today as soon as possible in order to avoid rewriting the same thing here, with a list of interesting tools. Stay tuned ;)

Edit.: Please don't only take care of Windows. I'll show you some tools to create some bundles for other operating systems without having to install them as I fear that you're still under XP :p

I advise you to read the section about the deployment, my user's guide is ready:
http://tinyurl.com/mpuu8or

OK. I am going to the guide.
Thanks
jfp

You're welcome. Let me know if you need some help. I'm sure that I have to clarify some aspects.