deploying JOGL application with webstart

Hi.  I don't know much about Java deployment.  But I've got a program I've written on my own, as hobby, and I'd like to make it available.  Is this tutorial still a good example?  http://jogamp.org/wiki/index.php/Using_JOGL_in_Java_Web_Start

I'm trying to get JOGL from jogamp.org, so I don't have to include it.  I'm at the step where I try to test it with javaws myproj.jnlp, and I get an exception in a popup:

com.sun.deploy.net.FailedDownloadException: Unable to load resource: http://jogamp.org/deployment/jogamp-current/jogl-all-awt.jnlp
        at com.sun.deploy.net.DownloadEngine.actionDownload(Unknown Source)
        at com.sun.deploy.net.DownloadEngine.downloadResource(Unknown Source)
. . .

and in another tab there is a wrapped exception:
java.net.ConnectException: Connection timed out: connect
        at java.net.DualStackPlainSocketImpl.connect0(Native Method)
        at java.net.DualStackPlainSocketImpl.socketConnect(Unknown Source)
        at java.net.AbstractPlainSocketImpl.doConnect(Unknown Source)
        at java.net.AbstractPlainSocketImpl.connectToAddress(Unknown Source)
. . .

I'll admit to not using the app in the tutorial, but just trying to get my own to work, but I've done things the way the tutorial says, following the conditions for using jogl hosted on jogamp.org.

Do you know what this is likely to be?

I've got to go learn about signing as well.  Might this be related?

thanks
andy

Hi

Yes it is a good example and according to your stack trace, there was a temporary problem which prevented Java Web Start from downloading jogl-all-awt.

On 03/15/2014 05:02 PM, andyskinner [via jogamp] wrote:
> Hi.  I don't know much about Java deployment.  But I've got a program I've
> written on my own, as hobby, and I'd like to make it available.  Is this
> tutorial still a good example?
>  http://jogamp.org/wiki/index.php/Using_JOGL_in_Java_Web_Start

Yes .. they are up-to-date,
however do not reflect Oracle's latest 7u51 constraints .. :(

These errors usually occur due to rejection by the SecurityManager,
you should be able to see something in the log files.

In general .. if using Oracle's Plugin,
you need to sign all jar files by yourself:
  - GlueGen, JOGL _and_ your own code / demo
  - Apply all those magic manifest entries .. (duh .. PIA!)

<https://blogs.oracle.com/java-platform-group/entry/upcoming_exception_site_list_in>
<https://blogs.oracle.com/java-platform-group/entry/new_security_requirements_for_rias>
<http://www.ietf.org/rfc/rfc3161.txt> (don't ask ..)

However .. it still works, as you can see on our applet test page
  <http://jogamp.org/deployment/jogamp-current/jogl-test-applets.html>

+++

In short, Oracle almost accomplished the task to remove these deployment
facilities from non cooperated devs .. b/c they think snakeoil [1]
will help mitigating security holes in the sandbox (via obscurity).

[1] <https://en.wikipedia.org/wiki/Snake_oil_%28cryptography%29>

+++

See following git commits:

http://jogamp.org/git/?p=jogl.git;a=commit;h=5e8361d84078568d54b9561315151e2c5e287147

Adaption of Oracle's Deployment changes, i.e. >= 7u51

Sadly, due to Oracle's Java Applet Plugin update 7u51,
unsigned applets are no more allowed and effectively
lower the bar to create user applets with raised privileges.<br/>
Hence JogAmp Community <b>signs</b> jogl-all.jar and gluegen-rt.jar, which contain the
JOGL's supporting classes as well as jogl-test.jar, which contains the applet class.<br/>
jogl-test.jar's manifest file uses <i>Permissions: sandbox</i>
to <b>not raise privileges</b>.


+++

http://jogamp.org/git/?p=jogl.git;a=commit;h=59bde64e57125f8a8624018b9b4e224c757ee39b

Fix jogl-*-version.jnlp: Needs 'all-permissions' to match jogl-all.jar's manifest (Oracle's >= 7u51 constraints)

+++

On 03/15/2014 07:13 PM, andyskinner [via jogamp] wrote:
> Also, is there a difference between an application and an applet, relevant to
> this issue?

applet ~= jnlp-application != local-application

So, applet and jnlp-application need to match the mentioned constraints :(
Note: An applet can also use JNLP mechanism ..

A local application ofc does not need any of this.

If you test on GNU/Linux you may test w/ IcedTea-Web,
which may not have those snake-oil constraints applied.

On 03/15/2014 07:12 PM, andyskinner [via jogamp] wrote:> Does that mean I
won't be able to get the jar files from jogamp.org, and will
> have to include them in order to sign them?
>

Yes, you have to sign them all w/ your signature.

Maybe it still works using our jar files loaded from our jogamp URL,
however your demo-jars must be signed (with your cert).

~Sven

Thanks.  I tried signing my jar file and getting JOGL from jogamp.org, but got the same error.

I'll have to do some more experiments.  Maybe I should follow through the tutorial mentioned above, all with the demo from that tutorial rather than trying to apply it to my application, and copying all the jar files as it says.

Then, if that works, do it again with JOGL jar files from jogamp.org.  Then, if that works, go back and try mine again.  Seems like once I get that far, it should work.

thanks
andy