Test - trust in JNLP exntensions

[Andrew Thompson]

I am having a problem with launching a trusted app., and
was wondering if I could get some more test results.

It is at http://pscode.org/lib/dukebox-all.jnlp

(for further details on DukeBox, see http://pscode.org/dukebox/)

The problem is as follows. Parts of the app. require all-permissions,
but others can be sandboxed. I supply each package as JNLP
extensions, and the JNLP file is where the trust level for that
package
is declared.

The main JNLP declares all-permissions, as does the class that
opens a PlayList. Using Ubuntu/Java 1.6, I get prompted to
trust DukeBox, yet no prompt for the PlayList, and when I go
to open a playlist (any M3U file), it throws an exception reporting
'access denied (java.io.FilePermission filename read) ...'

That exception is dumped to the console, but also popped
in a JOptionPane.

Can anyone else open an M3U file using the app.?
(If you don't have any M3U files handy, try downloading
http://pscode.org/media/mp3.m3u )

 

[Knute Johnson]

I am having a problem with launching a trusted app., and
was wondering if I could get some more test results.

It is at http://pscode.org/lib/dukebox-all.jnlp

(for further details on DukeBox, see http://pscode.org/dukebox/)

The problem is as follows. Parts of the app. require all-permissions,
but others can be sandboxed. I supply each package as JNLP
extensions, and the JNLP file is where the trust level for that
package
is declared.

The main JNLP declares all-permissions, as does the class that
opens a PlayList. Using Ubuntu/Java 1.6, I get prompted to
trust DukeBox, yet no prompt for the PlayList, and when I go
to open a playlist (any M3U file), it throws an exception reporting
'access denied (java.io.FilePermission filename read) ...'

That exception is dumped to the console, but also popped
in a JOptionPane.

Can anyone else open an M3U file using the app.?
(If you don't have any M3U files handy, try downloading
http://pscode.org/media/mp3.m3u )

Andrew:

I'm getting the same result as you, a dialog that says "access denied
(java.io.FilePermission ..."

Windows XP SP3 Sun Java 1.6.0_16.

 

[Knute Johnson]

Just to confirm, the file mp3.m3u is 215 bytes long? Should I be able
to play it with Windows Media Player?

 

[Andrew Thompson]

Just to confirm, the file mp3.m3u is 215 bytes long?
Correct.

.. Should I be able
to play it with Windows Media Player?

No. It refers to MP3s back at pscode.org using
relative paths. I am not entirely sure if M3U
playlists can refer to (fully qualified) URLs,
but that M3U does not.

So it is definitely not a 'JRE on Ubuntu' problem
(judging by your mention of Windows Media Player).
I'm going to have to put some more thought into
possible causes..

Thanks much for your reports.

 

[Roedy Green]

It is at http://pscode.org/lib/dukebox-all.jnlp

One piece of info:

according to the mimecheck utility at
http://mindprod.com/jgloss/mime.html

you served that JNLP file correctly with the mime type:
application/x-java-jnlp-file
--
Roedy Green Canadian Mind Products
http://mindprod.com

There is one brain organ that is optimised for understanding and articulating logical processes, and that is the outer layer of the brain, called the cerebral cortex. Unlike the rest of the brain, this relatively recent evolutionary development is rather flat, only about 0.32 cm (0.12 in) thick, and includes a mere 6 million neurons. This elaborately folded organ provides us with what little competence we do possess for understanding what we do and who we do it.
~ Ray Kurzweil (born: 1948-02-12 age: 61)

 

[Roedy Green]

Can anyone else open an M3U file using the app.?
(If you don't have any M3U files handy, try downloading
http://pscode.org/media/mp3.m3u )

I get access denied (java.io.FilePermission C:\temp\mp3.m3u read)
/C:/\temp/mp3.m3u

What is the disadvantage of requesting all permissions for everything
and signing with the same cert?
--
Roedy Green Canadian Mind Products
http://mindprod.com

There is one brain organ that is optimised for understanding and articulating logical processes, and that is the outer layer of the brain, called the cerebral cortex. Unlike the rest of the brain, this relatively recent evolutionary development is rather flat, only about 0.32 cm (0.12 in) thick, and includes a mere 6 million neurons. This elaborately folded organ provides us with what little competence we do possess for understanding what we do and who we do it.
~ Ray Kurzweil (born: 1948-02-12 age: 61)

 

[Andrew Thompson]

On Oct 1, 2:24 pm, Roedy Green <[email protected]>
wrote:
....

What is the disadvantage of requesting all permissions for everything
and signing with the same cert?

In theory, none. (All Jars are actually signed
with the same certificate).

The thing is, I might want to use one of the Jars in
two apps. One that requires all-permissions, and
another that only requires j2ee-application-client-permissions
(JACP) or can be sandboxed.

Further, a free floating element such as a dialog
might be supplied with either no or JACP permissions.

Since I was also playing with lazy downloads, I
decided it might be easier to have each package in
it's own extension, declaring the permissions
and download strategy...

...actually I am having a hard time justifying my
decision to have every package referred to in its
own JNLP(s), since most of that stuff I was talking
about can be done in the main JNLP, and the rest
is of little relevance.

Stuff it. I have now directly imported all Jars
into the main JNLP, and it works as expected.

I may revisit this topic later (with a possible
view to raising a bug report), but for the moment
I just want it working.

DukeBox still needs some further honing, and
much more testing, but I'll leave that for
later posts.

Thanks all, for your attention and help.