Skip to main content

Unsigned entry in j3dcore.jar

Please note these java.net forums are being decommissioned and use the new and improved forums at https://community.oracle.com/community/java.
23 replies [Last post]
mirajanata
Offline
Joined: 2004-10-21

Current version of Java3D fails to start through JavaWebStart because of unsigned jars!!!

Reply viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.
mikelizzi2
Offline
Joined: 2011-10-13

I managed to convert my java3d applet launching to use self-signed (uncertified) jar files. For some reason a class loader no longer worked and I had to write a workaround. Other than that it was just time consuming. I expect to get a certificate of my own soon.

You can download/view my xxx.jnlp file at this URL:

http://www.relativitysimulation.com/Applet.jnlp

Note:

Only the jar file named SimApp19.jar is mine.

Every other file is an unsigned Sun library jar that I was told at various forums I needed. Copies of them all are now self-signed in a directory structure on my web site. I verified the applet works on windows x86 machines but I still have to verify the other platforms.

Many thanks to the guys who brought this issue up on this forum. And Good luck to you all.

lew
Offline
Joined: 2005-04-15

#### Java Web Start Error:
#### Could not find main-class userInterface.Applet in http://relativitysimulation.com/Jars/gluegen-rt.jar

"Could not find main-class " - I can be wrong, but usually we deploy java applications, _not_ java applets via java web start...for me seems like "main-class" ("main() method") is missing).

mikelizzi2
Offline
Joined: 2011-10-13

Oh, right.

I started this thing as an applet and just left it that way. It appears to work exactly the same as an application.

So for an application, there must be an application description section in the xxx.jnlp file, something like the following:

<application-desc
name="Application Name"
main-class="path and name of class with the main method">
<application-desc/>

I'm not sure about the syntax. It's been a while since I did anything this way. If you can't get this to work, let me know and I will do some experimenting.

lew
Offline
Joined: 2005-04-15

..if you need syntax example, see example of working jnpl file below:

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<jnlp codebase="http://example.changeip.net/product/sue" href="launch.jnlp" spec="1.0+">
<information>
<title>SimpleUniverse.Explorer</title>
<vendor>example</vendor>
<homepage href="http://example.changeip.net"/>
<description>SimpleUniverse.Explorer</description>
<description kind="short">SimpleUniverse.Explorer</description>
<offline-allowed/>
</information>
<security>
<all-permissions/>
</security>
<resources>
<j2se version="1.6+"/>
<jar eager="true" href="sue10.jar" main="true"/>
<jar eager="true" href="lib/ojdbc6.jar"/>
<extension href="http://example.changeip.net/copy-of-j3d-ws/java3d/webstart/release/java3d-1.5.2.jnlp"/>
</resources>
<application-desc main-class="sue.sueMain">

</application-desc>

<update check="always" policy="prompt-update"/>

</jnlp>

mikelizzi2
Offline
Joined: 2011-10-13

Looks like you have your stuff working. I thought you had a problem. I don't. What I have is an Applet that runs using webstart. I was just offereing my jnpl to anyone who still had a problem. Now they have yours too.

kcr
Offline
Joined: 2004-03-17

It's been several years since Oracle (previously Sun) stopped providing support for the open source Java3D projects. It was decided that keeping binaries signed with old Sun signing certificates represented a potential security risk, and because of this, we have removed the old Sun signing certificates for the binaries on download.java.net.

The jar files are still there and can be used, but must now be signed by third party developer(s) who wish to run Java 3D apps as applets or as Java Webstart applications.

If you wish to use Java3D in these modes, we recommend you follow these steps:

1) Download the following files:

The JNLP file for the Java 3D extension:
http://download.java.net/media/java3d/webstart/release/java3d-1.5.2.jnlp

The vecmath jar file:
http://download.java.net/media/java3d/webstart/release/vecmath/1.5.2/vecmath.jar

All Java 3D jar files in this directory:
http://download.java.net/media/java3d/webstart/release/j3d/1.5.2/

2) sign all the jar files with your own signing certificate (or use self-signing).

3) host the jar files and jnlp file along with your application

4) update the jnlp file with the correct path name.

--
Kevin Rushforth
Oracle Corporation

dirkhoffmann
Offline
Joined: 2009-06-17

Factually you are right for my own application with your advice. Thank you for the detailed description. I have to redeploy my application on a couple of sites now.

But do you really ignore that there are hundreds if not thousands of existing applications relying on the J3D online JAR files? It is difficult to beleive that Oracle does not deliberately want to sabotage those by this irresponsible decision.

I wonder if it is legal to retract an existing offer (free hosting of compiled and signed open source libraries) without consulting nor any warning. For sure you will discourage people to trust your free offers in future. Many already drew the consequences for other products.

Your argument of safety issues is void. If you really care about only that point, then please make a new unsigned release according to your description, increase the version number and keep the old one for compatibility as every professional software provider needs to do. Every application programmer is able to judge by his own, if he needs to sign and host his own copies.

eindoofus
Offline
Joined: 2011-09-22

Wow, I was considering taking the Java route with my classes for my Grad degree but now I'm having serious second thoughts.

If Oracle were a bar, this would be the equivalent of them changing all the drinks on tap overnight. They've become too big to catch the little mistakes they make and will begin to fall apart just like a small business would if they were to make such irresponsible decisions. It'll just be a longer much more painful process with Oracle.

You don't gain new customers by mistreating your old ones Oracle.

mbien
Offline
Joined: 2007-04-29

why don't you put at least a warning on the project pages? Thats like acting in the hope that nobody will notice.

btw. signed jogl binaries are obtainable via http://jogamp.org/

sproketboy
Offline
Joined: 2006-08-07
sproketboy
Offline
Joined: 2006-08-07

Well well well... it made it to the front page....

darwinjob
Offline
Joined: 2004-11-16

Remove the download section too - there might be a security risk!!! We can compile the sources ourselves.

lew
Offline
Joined: 2005-04-15

imho, the best solution "open source Java3D project team" can do:
sign these jars again, but now with "open source Java3D project" sertificates (if such sertificates exists).

otherwise all existing java3d webstart examples will not work anymore without modification :(
(including samples on InteractiveMesh site - http://www.interactivemesh.org/testspace/j3dmeetsswing.html)

mirajanata
Offline
Joined: 2004-10-21

Thanks for explanation. I consider this decision to be mindless and irresponsible because it doesn't take into count existing web projects and solutions depending on Java3d/jnlp.

tmilard
Offline
Joined: 2004-03-25

Signing for us developers is just 99%-problems and 1%-usefull
I wish managers at Oracle could be as wise as Macromedi-Flash ones.
If so I believe strongly They would deliver a java-VM with no need for signing dlls.

I think Signing-jar was in the last 10 year has found to be a bad decision.

Example is thisthis Thread.

Operation Coin in java8 ?

Thi

darwinjob
Offline
Joined: 2004-11-16

What's the point to keep these files online? They are available in the archives.

IMHO Webstart becomes useless. I switch to installers.

What's going to happen with the examples and demos? Should we host them ourselves too?

lew
Offline
Joined: 2005-04-15

..seems somebody changed j3d files.
a few days ago it was ok and working,
but now I got error to:

#### Java Web Start Error:
#### Unsigned application requesting unrestricted access to system
Unsigned resource: http://download.java.net/media/java3d/webstart/release/j3d/1.5.2/windows-i586/j3dcore-d3d_dll.jar

mirajanata
Offline
Joined: 2004-10-21

Can anybody FIX this ridiculous bug?

darwinjob
Offline
Joined: 2004-11-16

No. Java3D is doomed.

emmanuelchauvin
Offline
Joined: 2008-09-14

Exact ! I have the same problem on my javawebstart program ...

darwinjob
Offline
Joined: 2004-11-16

com.sun.deploy.net.JARSigningException: Found unsigned entry in resource: http://download.java.net/media/java3d/webstart/release/j3d/1.5.2/j3dcore...

Confirmed.

http://java.net/jira/browse/JAVA3D-667

ricardo.kligman
Offline
Joined: 2011-09-19

Same problem here....has this important issue been taken into account?

darwinjob
Offline
Joined: 2004-11-16

JAI (Java Advanced Imaging) people are in trouble too. I guess everything related to Webstart is screwed. God bless Oracle.