Mac OS Java Update ( 1.6.0_20) breaks JOGL applets

Hi all,

It seems that the latest Mac OS Java update break JOGL applets, which our product uses :-(.
On this site in fact you can see the applets no longer work if you just installed the latest release from Apple...

More than just posting the news, I will try to give some info to help with sorting this mess out :)
I will attempt to open page:
http://jogamp.org/jogl-demos/www/applettest-jnlp.html

First off, when going to the applet a new (at least for Mac users) dialog pops up, the "Welcome to the Java Extension Installer".  Yikes! This just about scares my users out of their pants, as before the JNLP-applet process was as clean as a Flash app, no dialog, no install, just run. OUCH.

Second, after clicking though that dialog, it say "error" in the applet due to security issues and the console has this dump:
ava.lang.reflect.InvocationTargetException
        at com.sun.deploy.util.DeployAWTUtil.invokeAndWait(DeployAWTUtil.java:116)
        at sun.plugin2.applet.Plugin2Manager.runOnEDT(Plugin2Manager.java:3415)
        at sun.plugin2.applet.Plugin2Manager.createApplet(Plugin2Manager.java:2967)
        at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Plugin2Manager.java:1444)
        at java.lang.Thread.run(Thread.java:637)
Caused by: java.lang.SecurityException: attempted to open sandboxed jar http://jogamp.org/deployment/webstart/jogl.all.cdc.jar as a Trusted-Library
        at com.sun.deploy.security.CPCallbackHandler$ParentElement.checkResource(CPCallbackHandler.java:354)
        at com.sun.deploy.security.DeployURLClassPath$JarLoader.checkResource(DeployURLClassPath.java:790)
        at com.sun.deploy.security.DeployURLClassPath$JarLoader.getResource(DeployURLClassPath.java:980)
        at com.sun.deploy.security.DeployURLClassPath$JarLoader.getResource(DeployURLClassPath.java:896)
        at com.sun.deploy.security.DeployURLClassPath.getResource(DeployURLClassPath.java:231)
        at sun.plugin2.applet.Plugin2ClassLoader$2.run(Plugin2ClassLoader.java:796)
        at java.security.AccessController.doPrivileged(Native Method)
        at sun.plugin2.applet.Plugin2ClassLoader.findClassHelper(Plugin2ClassLoader.java:785)
        at sun.plugin2.applet.JNLP2ClassLoader.findClass(JNLP2ClassLoader.java:317)
        at java.lang.ClassLoader.loadClass(ClassLoader.java:307)
        at java.lang.ClassLoader.loadClass(ClassLoader.java:296)
        at java.lang.ClassLoader.loadClass(ClassLoader.java:248)
        at java.lang.Class.getDeclaredConstructors0(Native Method)
        at java.lang.Class.privateGetDeclaredConstructors(Class.java:2389)
        at java.lang.Class.getConstructor0(Class.java:2699)
        at java.lang.Class.newInstance0(Class.java:326)
        at java.lang.Class.newInstance(Class.java:308)
        at sun.plugin2.applet.Plugin2Manager$12.run(Plugin2Manager.java:2955)
        at java.awt.event.InvocationEvent.dispatch(InvocationEvent.java:199)
        at java.awt.EventQueue.dispatchEvent(EventQueue.java:633)
        at java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:296)
        at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:211)
        at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:201)
        at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:196)
        at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:188)
        at java.awt.EventDispatchThread.run(EventDispatchThread.java:122)
Exception: java.lang.reflect.InvocationTargetException

3) After going into Java Preferences, setting "Run Applets: In their own process" and under ADVANCED tab setting security to "Disable - insecure, not recommended" and rerunning, we now get this:

VALIDATE: libjogl_cg.jnilib
java.io.IOException: Cannot validate certificate for libjogl_cg.jnilib
        at org.jdesktop.applet.util.JNLPAppletLauncher.validateCertificates(JNLPAppletLauncher.java:1815)
        at org.jdesktop.applet.util.JNLPAppletLauncher.processNativeJar(JNLPAppletLauncher.java:1579)
        at org.jdesktop.applet.util.JNLPAppletLauncher.initResources(JNLPAppletLauncher.java:1350)
        at org.jdesktop.applet.util.JNLPAppletLauncher.initAndStartApplet(JNLPAppletLauncher.java:1254)
        at org.jdesktop.applet.util.JNLPAppletLauncher.access$000(JNLPAppletLauncher.java:658)
        at org.jdesktop.applet.util.JNLPAppletLauncher$1.run(JNLPAppletLauncher.java:907)
May 18, 2010 8:10:31 PM org.jdesktop.applet.util.JNLPAppletLauncher displayError
SEVERE: java.io.IOException: Cannot validate certificate for libjogl_cg.jnilib

I hope you can reproduce this, and I hope this is the right place to post this kind of thing!
Thanks for any help.

Shawn Kendall
IMILabs

I should mention that if we use the old JNLPAppletLauncher fallback, I can get our JOGL applet to load and run.  But strangely, only in FireFox.  In Safari, we get a weird error:

java.io.IOException: Server returned HTTP response code: 400 for URL: http://download.java.net/media/jogl/builds/archive/jsr-231-webstart-current/jogl.jnlp
        at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1313)
        at org.jdesktop.applet.util.JNLPAppletLauncher$JNLPParser.parse(JNLPAppletLauncher.java:2191)
        at org.jdesktop.applet.util.JNLPAppletLauncher$JNLPParser.access$600(JNLPAppletLauncher.java:2155)
        at org.jdesktop.applet.util.JNLPAppletLauncher.parseJNLPExtensions(JNLPAppletLauncher.java:2046)
        at org.jdesktop.applet.util.JNLPAppletLauncher.initResources(JNLPAppletLauncher.java:1329)
        at org.jdesktop.applet.util.JNLPAppletLauncher.initAndStartApplet(JNLPAppletLauncher.java:1254)
        at org.jdesktop.applet.util.JNLPAppletLauncher.access$000(JNLPAppletLauncher.java:658)
        at org.jdesktop.applet.util.JNLPAppletLauncher$1.run(JNLPAppletLauncher.java:907)
May 18, 2010 8:34:42 PM org.jdesktop.applet.util.JNLPAppletLauncher displayError
SEVERE: java.io.IOException: Server returned HTTP response code: 400 for URL: http://download.java.net/media/jogl/builds/archive/jsr-231-webstart-current/jogl.jnlp

Again this is still after having to go into the Java Pref settings and setting to insecure...
Oh and the plug-in eventually crashes as well...:(

On Wednesday, May 19, 2010 02:37:29 Shawn Kendall [via jogamp] wrote:
Thank you Shawn for the heads up ..

I will check the MacOSX issues before the next JAR signing .. for sure,
hopefully within this week.

Cool .. I didn't know that Apple supports the JNLP deployment method,
as you know .. this is new, before then 'applet-launcher' was the only method
for proper deployment on osx ..

Later, Sven

hello Shawn,

thanks for the report. JogAmp suffers currently under chronical Mac shortage... hope this will change soon.

but still i believe you are mixing things up:

Shawn Kendall wrote

java.io.IOException: Server returned HTTP response code: 400 for URL: http://download.java.net/media/jogl/builds/archive/jsr-231-webstart-current/jogl.jnlp

the builds on java.net are very old and not maintained by us.

Shawn Kendall wrote

Caused by: java.lang.SecurityException: attempted to open sandboxed jar http://jogamp.org/deployment/webstart/jogl.all.cdc.jar as a Trusted-Library

cdc means connected device configuration and is not supposed to be used on the desktop ;)

there is a little bit info on the wiki:
http://jogamp.org/wiki/index.php/Jogl_FAQ
http://jogamp.org/wiki/

and in the howtos
http://jogamp.org/jogl/doc/deployment/JOGL-DEPLOYMENT.html
http://jogamp.org/jogl/doc/HowToBuild.html

best regards,
michael

Hi Michael,

Just to clarify a few things about my post;

WRT to:
========
but still i believe you are mixing things up:
Shawn Kendall wrote:
java.io.IOException: Server returned HTTP response code: 400 for URL: http://download.java.net/media/jogl/builds/archive/jsr-231-webstart-current/jogl.jnlp
the builds on java.net are very old and not maintained by us.
========

The JOGL .net site sends users here now...That's why I posted here.

WRT
========
Shawn Kendall wrote:
Caused by: java.lang.SecurityException: attempted to open sandboxed jar http://jogamp.org/deployment/webstart/jogl.all.cdc.jar as a Trusted-Library
cdc means connected device configuration and is not supposed to be used on the desktop ;)
========

That is literally the error I get from just going to this site's demo page, not something we made.  I agree CDC is not desktop.  I am just reporting that error as console dumped. Below is the entire capture top to bottom for the page:
http://jogamp.org/jogl-demos/www/applettest-jnlp.html
Anyone can give it a try, Mac OS 10.6.3, latest Java update that came out today, Safari browser.
(In FireFox it's a different error. java.io.IOException: Cannot validate certificate for libjogl_cg.jnilib)


Java Plug-in 1.6.0_20
Using JRE version 1.6.0_20-b02-279-10M3065 Java HotSpot(TM) 64-Bit Server VM
User home directory = /Users/macuser

----------------------------------------------------
c:   clear console window
f:   finalize objects on finalization queue
g:   garbage collect
h:   display this help message
l:   dump classloader list
m:   print memory usage
o:   trigger logging
q:   hide console
r:   reload policy configuration
s:   dump system and deployment properties
t:   dump thread list
v:   dump thread stack
x:   clear classloader cache
0-5: set trace level to <n>
----------------------------------------------------

java.lang.reflect.InvocationTargetException
        at com.sun.deploy.util.DeployAWTUtil.invokeAndWait(DeployAWTUtil.java:116)
        at sun.plugin2.applet.Plugin2Manager.runOnEDT(Plugin2Manager.java:3415)
        at sun.plugin2.applet.Plugin2Manager.createApplet(Plugin2Manager.java:2967)
        at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Plugin2Manager.java:1444)
        at java.lang.Thread.run(Thread.java:637)
Caused by: java.lang.SecurityException: attempted to open sandboxed jar http://jogamp.org/deployment/webstart/jogl.all.cdc.jar as a Trusted-Library
        at com.sun.deploy.security.CPCallbackHandler$ParentElement.checkResource(CPCallbackHandler.java:354)
        at com.sun.deploy.security.DeployURLClassPath$JarLoader.checkResource(DeployURLClassPath.java:790)
        at com.sun.deploy.security.DeployURLClassPath$JarLoader.getResource(DeployURLClassPath.java:980)
        at com.sun.deploy.security.DeployURLClassPath$JarLoader.getResource(DeployURLClassPath.java:896)
        at com.sun.deploy.security.DeployURLClassPath.getResource(DeployURLClassPath.java:231)
        at sun.plugin2.applet.Plugin2ClassLoader$2.run(Plugin2ClassLoader.java:796)
        at java.security.AccessController.doPrivileged(Native Method)
        at sun.plugin2.applet.Plugin2ClassLoader.findClassHelper(Plugin2ClassLoader.java:785)
        at sun.plugin2.applet.JNLP2ClassLoader.findClass(JNLP2ClassLoader.java:317)
        at java.lang.ClassLoader.loadClass(ClassLoader.java:307)
        at java.lang.ClassLoader.loadClass(ClassLoader.java:296)
        at java.lang.ClassLoader.loadClass(ClassLoader.java:248)
        at java.lang.Class.getDeclaredConstructors0(Native Method)
        at java.lang.Class.privateGetDeclaredConstructors(Class.java:2389)
        at java.lang.Class.getConstructor0(Class.java:2699)
        at java.lang.Class.newInstance0(Class.java:326)
        at java.lang.Class.newInstance(Class.java:308)
        at sun.plugin2.applet.Plugin2Manager$12.run(Plugin2Manager.java:2955)
        at java.awt.event.InvocationEvent.dispatch(InvocationEvent.java:199)
        at java.awt.EventQueue.dispatchEvent(EventQueue.java:633)
        at java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:296)
        at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:211)
        at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:201)
        at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:196)
        at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:188)
        at java.awt.EventDispatchThread.run(EventDispatchThread.java:122)
Exception: java.lang.reflect.InvocationTargetException

On 05/19/2010 03:57 AM, Shawn Kendall [via jogamp] wrote: thats good, stay here - don't run away :)

we are investigating this issue right now... thanks
(something strange is going on here since the jnlps look all fine)
regards,
michael

On Wednesday, May 19, 2010 04:19:00 Michael Bien [via jogamp] wrote:
*.cdc.jar issue:

Ok .. the culprit was: the index file within jogl-demos.jar,
I have removed it now - and it works, at least no more pulling the cdc files in.

Thanks for the report.

Cheers, Sven

I am seeing change but no fixes.
While checking around, I also found this problem over at LWJGL, although the change you made does get the load to continue on, it's still busted but good :(

Here is some more tests and clarifications:
To be more specific,

On Snow Leopard:

Open applet page with default Java security settings:
In Safari
     you get "Error. Click for details" in the applet and this in the Java console:
java.lang.reflect.InvocationTargetException
        at com.sun.deploy.util.DeployAWTUtil.invokeAndWait(DeployAWTUtil.java:116)
        at sun.plugin2.applet.Plugin2Manager.runOnEDT(Plugin2Manager.java:3415)
        at sun.plugin2.applet.Plugin2Manager.createApplet(Plugin2Manager.java:2967)
        at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Plugin2Manager.java:1444)
        at java.lang.Thread.run(Thread.java:637)
Caused by: java.lang.SecurityException: attempted to open sandboxed jar http://jogamp.org/deployment/webstart-next/jogl.all.jar as a Trusted-Library

In Chrome
    you just get the same error

In FireFox
    you get VALIDATE: libjogl_cg.jnilib
java.io.IOException: Cannot validate certificate for libjogl_cg.jnilib

If the Java Pref. security settings are disabled (labeled "insecure" in the UI :-():

In Safari and Chrome:
    You get no errors in console and even run-time output (frame rate, etc) but NO render, just blank white page.

In FireFox:
    Again you get VALIDATE: libjogl_cg.jnilib
java.io.IOException: Cannot validate certificate for libjogl_cg.jnilib

On Leopard + Safari
Exception in thread "thread applet-demos.applets.GearsApplet-1" java.lang.UnsatisfiedLinkError: /Users/skendall/Library/Caches/Java/cache/6.0/0/13f5bfc0-61c0887e-n/libgluegen-rt.jnilib:  no suitable image found.  Did find:  /Users/skendall/Library/Caches/Java/cache/6.0/0/13f5bfc0-61c0887e-n/libgluegen-rt.jnilib: unknown required load command 0x80000022
        at java.lang.ClassLoader$NativeLibrary.load(Native Method)

Are you guys not seeing these errors?

We are seeing (different) failures with different Java settings but try running with the Mac Java Preferences:

"Run Applets: [X] In their own process"

That has been the recommended setting for native apps, so us and our users have that set but also I suspect that this is why it fails in Chrome as well, Chrome tabs are all in separate processes anyway.

On Thursday, May 20, 2010 22:06:46 Shawn Kendall [via jogamp] wrote:
Ok .. I saw the same.

Appologies .. but right now there is little time of OSX,
hopefully this changes within the next weeks ..

But .. we will keep up with that platform soon.
Just keep looking at the git logs .. if OSX is mentioned ..

Cheers, Sven

--
health & wealth
mailto:[hidden email] ; www  : http://www.jausoft.com ; pgp: http://www.jausoft.com/gpg/
land : +49 (471) 4707742 ; cell: +49 (151) 28145941
Timezone CET: PST+9, EST+6, UTC+1

Hey thanks for looking into this, and no need for apologies, it's not really you guys' fault!

BTW this was brought to me by one of my devs.

The old(ish) Java.net link:
https://jogl-demos.dev.java.net/applettest-jnlp.html
Works just fine.

But the JogAmp link:
http://jogamp.org/jogl-demos/www/applettest-jnlp.html
Does this:
http://dl.dropbox.com/u/4880451/Screen%20shot%202010-06-02%20at%2012.26.00%20AM.jpg

Error: java.io.IOException: Cannot validate certificate for libjogl_cg.jnilib

On Wednesday, June 02, 2010 06:28:15 Shawn Kendall [via jogamp] wrote:
Thank you, yes I am aware of that problem.

~Sven

forgive me if this is old news, but I am still running into the problems this issue is describing.

I am using Java 1.6.0_24

In Firefox 3.6.16 on MacOS, I get this error:

java.io.IOException: Cannot validate certificate for libjogl_desktop.jnilib
        at org.jdesktop.applet.util.JNLPAppletLauncher.validateCertificates(JNLPAppletLauncher.java:1870)
        at org.jdesktop.applet.util.JNLPAppletLauncher.processNativeJar(JNLPAppletLauncher.java:1634)
        at org.jdesktop.applet.util.JNLPAppletLauncher.initResources(JNLPAppletLauncher.java:1405)
        at org.jdesktop.applet.util.JNLPAppletLauncher.initAndStartApplet(JNLPAppletLauncher.java:1309)
        at org.jdesktop.applet.util.JNLPAppletLauncher.access$000(JNLPAppletLauncher.java:661)
        at org.jdesktop.applet.util.JNLPAppletLauncher$1.run(JNLPAppletLauncher.java:910)
Apr 18, 2011 11:25:24 PM org.jdesktop.applet.util.JNLPAppletLauncher displayError
SEVERE: java.io.IOException: Cannot validate certificate for libjogl_desktop.jnilib

Did anyone figure out what is wrong with this?  I am actually creating my own jar files, and signing them.  Is there something in particular that I need to do when signing this jar file?  It seems to work on windows and linux, but not macOSX.  When I go to the http://jogamp.org/jogl-demos/www/applettest-jnlp.html it works, but I have my own dependent jar files that I need to use, so i put everything on my own web page.

In Chrome and Safari, my applet runs, but nothing is shown (I can even see that it captures mouse clicks and events).  This issue has been driving me crazy for the last week, so much that I re-wrapped my applet in LWJGL.  But that failed, since my applet only worked on OSX.  But the blank display is similar to a problem I saw with LWJGL in that all of the OpenGL context commands needed to be called from the same thread.  Could this be the problem, and is there a workaround for this?

Thanks in advance,

Blaine  

Hi Blaine,

I'll try building a simple JNLP this weekend and see if I get the same problem -- I've been wanting to put a tutorial about this on the wiki anyway. I can run the JOGL JNLP and applet demos on Mac OS X with no problem (just like you said), so I think you're right that the difficulty must somehow be in the packaging and signing process you're using.

Thanks a lot Wade!  Its good to know that it is probably a signing problem.  Could it be that I am using a temporary key to sign these Jar files?  Its strange that it would only prohibit me from running inside the browser on OSX, and not other platforms.

I am searching for our legit key, will try it out, and let you know.  Thanks for your response, let me know if you get anywhere.

Blaine

Well, I found keys that do not expire and it still gives me the error "Cannot validate certificate for libjogl_desktop.jnilib".

I am not sure what the next steps for this are.  Its strange that it complains about the file/library "libjogl_desktop.jnilib" and not the jar, which is signed.  I am resigning the jar, but that shouldn't matter, should it?

I also took the applettest-jnlp.html demo and put it into my jar file (took out the newt stuff since I am not packaging it).  I am still getting the same error, so it must have something to do with the way I package my jar files, but not sure what it is.

Blaine

On Tuesday, April 19, 2011 05:33:22 am blainebell [via jogamp] wrote:
>
> I am actually creating my
> own jar files, and signing them.  Is there something in particular that I
> need to do when signing this jar file?  It seems to work on windows and
> linux, but not macOSX.  When I go to the
> http://jogamp.org/jogl-demos/www/applettest-jnlp.html it works, but I have
> my own dependent jar files that I need to use, so i put everything on my own
> web page.

Since it works for our signed stuff .. why not check the delta ?

jogamp-scripting contains scripts we use to sign etc ..
  http://jogamp.org/git/?p=jogamp-scripting.git;a=summary

Hint: On OSX the source level of compiled code could be an issue as well,
we use 1.5

~Sven

Hi Blaine,

As a starting point, I tried a simple Java Web Start app (a JNLP without a wrapping applet) on Mac OS X just now, and it seems to work fine. I used the same procedure that I described at http://forum.jogamp.org/JOGL-Web-Start-Applet-in-a-Local-Net-td2278856.html#a2288671, running locally because I've been too lazy to set up a real web server yet. All 20 of the "natives" JARs, the 4 JOGL JARs, and my app's JAR are all signed by me and sitting on my hard drive (not referenced from jogamp.org).

Is it just the JNLP applet launcher that doesn't work for you, or is it Java Web Start too? Maybe that would help narrow things down.

> Is it just the JNLP applet launcher that doesn't work for you, or is it Java Web Start too? Maybe that would help
> narrow things down.

The only thing that doesn't work is running the applet inside the same process as the browser (i.e., setting in Java Preferences).

I have rebuilt the jogl/gluegen-rt source code, and used the jar files that the build process created, signed them.  

I was getting problems with MalformedURLExceptions, but I fixed those by changing some of the hrefs to fully qualified files (i.e., with http://....).  I am not sure why I need to do this, since it works just fine for every other platform and even with Safari/Chrome when the Applet is run in another process.

In any case, I fixed the MaformedURLExceptions, and now I *still* get this problem with Cannot validate certificate:

java.io.IOException: Cannot validate certificate for libgluegen-rt.jnilib
        at org.jdesktop.applet.util.JNLPAppletLauncher.validateCertificates(JNLPAppletLauncher.java:1870)
        at org.jdesktop.applet.util.JNLPAppletLauncher.processNativeJar(JNLPAppletLauncher.java:1634)
        at org.jdesktop.applet.util.JNLPAppletLauncher.initResources(JNLPAppletLauncher.java:1405)
        at org.jdesktop.applet.util.JNLPAppletLauncher.initAndStartApplet(JNLPAppletLauncher.java:1309)
        at org.jdesktop.applet.util.JNLPAppletLauncher.access$000(JNLPAppletLauncher.java:661)
        at org.jdesktop.applet.util.JNLPAppletLauncher$1.run(JNLPAppletLauncher.java:910)
Apr 21, 2011 4:09:35 PM org.jdesktop.applet.util.JNLPAppletLauncher displayError
SEVERE: java.io.IOException: Cannot validate certificate for libgluegen-rt.jnilib

how about the applet-launcher.jar file?  Where do you get that?  I resigned that, but can I build that as well?

Thanks a lot for your responses.  I *really* appreciate it.

Blaine