[Bug 2746] IcedTea-Web Plugin 1.6.1: net.sourceforge.jnlp.LaunchException

[bugzilla-daemon at icedtea.classpath.org]

http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=2746

--- Comment #3 from JiriVanek <jvanek at redhat.com> ---
I digged into it a bit more, because by luck I got ir once working and was
wondering why.

the why this works with oracle plugin and not with ITW is, that all resources
onthis server are duplicated.  And obviously, onse set of them is long time
unmintined. Unluckily ITW resolves always to the old ones, but oracles one to
maintained ones.

so maintained one (last times February 2015):
http://www.java.com/ga/applet/verify/JavaDetection_applet.jnlp
http://www.java.com/ga/applet/verify/JavaDetection.jar

legacy one (alst update October 2013):
https://java.com/en/download/JavaDetection_applet.jnlp
https://java.com/en/download/JavaDetection.jar

Now JNLP signature is valid on both legacy among them and also among new ones,
but not across them.
Now the new ones have one huge error - missing codebase. If this is true, then
for apple tITW takes as codebase the html page, but ORacle's takes the location
of delegated jnlphref-ed jnlp. None is right. According to spec  both should
died as codebase is mandatory.



Now whta is happening. the applet is specified as:
var appletHTML = "<applet code='JavaDetection.class' width='500' height='150'> 
<param name='image' value='/ga/im/applet/verify_anim.gif'/>  <param
name='centerimage' value='true'/>  <param name='boxborder' value='false'/> 
<param name='jnlp_href'
value='/ga/applet/verify/JavaDetection_applet.jnlp'/></applet>";

>From it, the <param name='jnlp_href'
value='/ga/applet/verify/JavaDetection_applet.jnlp'/ is the important one.

In this point, bot Oracle and ITW plugin reads
http://www.java.com/ga/applet/verify/JavaDetection_applet.jnlp and are going to
lunch appelt according to it.
But .. codebase is missing in this jnlp file. So we both guess.
ITW guess http://www.java.com/en/download/ (as we come from
http://www.java.com/en/download/installed.jsp)
But Oracles guess http://www.java.com/ga/applet/verify/ (because we used
http://www.java.com/ga/applet/verify/JavaDetection_applet.jnlp to access it)

So ITW gets 
https://java.com/en/download/JavaDetection.jar
but oracles gets 
http://www.java.com/ga/applet/verify/JavaDetection.jar

So itw signing verification fails, because jnlp file in
https://java.com/en/download/JavaDetection.jar is different then used
http://www.java.com/ga/applet/verify/JavaDetection.jar

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.openjdk.java.net/pipermail/distro-pkg-dev/attachments/20160106/32459e5b/attachment.html>