From hs at tagtraum.com  Tue Sep  2 07:58:10 2014
From: hs at tagtraum.com (Hendrik Schreiber)
Date: Tue, 2 Sep 2014 09:58:10 +0200
Subject: Crashes in Java_sun_lwawt_macosx_LWCToolkit_stopAWTRunLoop
	(called with NULL argument)
In-Reply-To: <85DFF7C4-F266-4938-8458-78DC1299C3F7@gmail.com>
References: <16CCD64E-E5F6-4503-B9CF-33B67471B028@tagtraum.com>
	<53FF7215.3070105@oracle.com>
	<A36ACA60-CB34-44F5-B34E-5F2097EFD639@tagtraum.com>
	<85DFF7C4-F266-4938-8458-78DC1299C3F7@gmail.com>
Message-ID: <12633CD1-62D2-49F1-98E0-762C0BB4D911@tagtraum.com>

On Aug 29, 2014, at 23:39, Michael Hall <mik3hall at gmail.com> wrote:

> On Aug 29, 2014, at 7:45 AM, Hendrik Schreiber <hs at tagtraum.com> wrote:
> 
>>   public void exit() {
>>       if (!isOwned()) {
>>           throw new IllegalMonitorStateException();
>>       }
>>       LWCToolkit.stopAWTRunLoop(awtRunLoopMediator);
>>       awtRunLoopMediator = 0;
>>   }
> 
> What does isOwned() do?

It's defined in the superclass, Mutex.

> Doesn't it ensure that clearing the loop mediator is only done by the owning thread? If some other thread successfully runs through exit doesn't it mean this is not working correctly?
> 
[...]

> Wouldn't it be simpler and safer to fix it in the JNI?
> if (mediatorObject) CFRelease(mediatorObject);

That's certainly also possible, but it also does not solve the issue completely.
The underlying problem is that exit() shouldn't be called more than once in the first place. My suggestion for improving the sun.lwawt.macosx.CToolkitThreadBlockedHandler code were only aimed at programmatically enforcing the implicit contract. It does not solve the problem that causes the issue.

I have created a test case and tried to explain what the problem is in http://mail.openjdk.java.net/pipermail/awt-dev/2014-September/008425.html hoping that AWT folks provide some input. AWT, because the class that calls exit() twice is a class shared between all platforms. It would be shortsighted to try to "fix" this only for OS X.

-hendrik

From hs at tagtraum.com  Tue Sep  2 08:00:24 2014
From: hs at tagtraum.com (Hendrik Schreiber)
Date: Tue, 2 Sep 2014 10:00:24 +0200
Subject: Application name in About, Hide, and Quit menu items
In-Reply-To: <072D6774-10B3-427E-BCCF-6B6581C92A1D@seanreilly.com>
References: <072D6774-10B3-427E-BCCF-6B6581C92A1D@seanreilly.com>
Message-ID: <ECE14D72-7D51-480A-B9CC-4C378DADF037@tagtraum.com>

On Aug 1, 2014, at 18:29, Sean Reilly <sreilly at seanreilly.com> wrote:

> In my app bundle ant file I?ve set a few options with the <bundleapp> tag including these:
>          <option value="-Dcom.apple.mrj.application.apple.menu.about.name=${bundle.name}"/>
>          <option value="-Dapple.awt.application.name=${bundle.name}"/>
> 
> Maybe they will help in your case?

Sorry for the late reply - this definitely helped me very much.
Thank you again.

> I agree that it would make sense to use the bundle name, at least as a default.  If you get a chance to correct it, please feel free to fork it and send a pull request: http://bitbucket.org/infinitekind/appbundler

I'd be glad to do this, once I have the time.

Cheers,

-hendrik

From mik3hall at gmail.com  Tue Sep  2 08:24:53 2014
From: mik3hall at gmail.com (Michael Hall)
Date: Tue, 2 Sep 2014 03:24:53 -0500
Subject: Crashes in Java_sun_lwawt_macosx_LWCToolkit_stopAWTRunLoop
	(called with NULL argument)
In-Reply-To: <12633CD1-62D2-49F1-98E0-762C0BB4D911@tagtraum.com>
References: <16CCD64E-E5F6-4503-B9CF-33B67471B028@tagtraum.com>
	<53FF7215.3070105@oracle.com>
	<A36ACA60-CB34-44F5-B34E-5F2097EFD639@tagtraum.com>
	<85DFF7C4-F266-4938-8458-78DC1299C3F7@gmail.com>
	<12633CD1-62D2-49F1-98E0-762C0BB4D911@tagtraum.com>
Message-ID: <86244080-749C-4534-8B3E-D2840255ECBD@gmail.com>

On Sep 2, 2014, at 2:58 AM, Hendrik Schreiber <hs at tagtraum.com> wrote:

> That's certainly also possible, but it also does not solve the issue completely.

True. Another work around really. But your crash appeared to be on a nil passed to CFRelease in the native method. As long as it wasn't a problem until you got to that CFRelease, just not doing the CFRelease should avoid the crash.

Michael Hall

trz nio.2 for OS X http://www195.pair.com/mik3hall/index.html#trz

HalfPipe Java 6/7 shell app http://www195.pair.com/mik3hall/index.html#halfpipe

AppConverter convert Apple jvm to openjdk apps http://www195.pair.com/mik3hall/index.html#appconverter






From mik3hall at gmail.com  Tue Sep  2 08:28:55 2014
From: mik3hall at gmail.com (Michael Hall)
Date: Tue, 2 Sep 2014 03:28:55 -0500
Subject: Application name in About, Hide, and Quit menu items
In-Reply-To: <ECE14D72-7D51-480A-B9CC-4C378DADF037@tagtraum.com>
References: <072D6774-10B3-427E-BCCF-6B6581C92A1D@seanreilly.com>
	<ECE14D72-7D51-480A-B9CC-4C378DADF037@tagtraum.com>
Message-ID: <67307F78-7CA0-4430-83FC-32E963A0011F@gmail.com>

On Sep 2, 2014, at 3:00 AM, Hendrik Schreiber <hs at tagtraum.com> wrote:

> Sorry for the late reply - this definitely helped me very much.
> Thank you again.

My looking at this was pretty late too, sorry. But again the System property did not work for me (10.7 reasonably current java 1.7). -Xdock:name=whatever did work. Having both might not be a bad idea. For a old Apple app I was uploading last night just changing the plist bundle name seemed to work. So it seems like covering as many bases as possible might be best for this.
bundle name + property + -Xdock:name

Michael Hall

trz nio.2 for OS X http://www195.pair.com/mik3hall/index.html#trz

HalfPipe Java 6/7 shell app http://www195.pair.com/mik3hall/index.html#halfpipe

AppConverter convert Apple jvm to openjdk apps http://www195.pair.com/mik3hall/index.html#appconverter






From hs at tagtraum.com  Tue Sep  2 08:29:25 2014
From: hs at tagtraum.com (Hendrik Schreiber)
Date: Tue, 2 Sep 2014 10:29:25 +0200
Subject: Crashes in Java_sun_lwawt_macosx_LWCToolkit_stopAWTRunLoop
	(called with NULL argument)
In-Reply-To: <86244080-749C-4534-8B3E-D2840255ECBD@gmail.com>
References: <16CCD64E-E5F6-4503-B9CF-33B67471B028@tagtraum.com>
	<53FF7215.3070105@oracle.com>
	<A36ACA60-CB34-44F5-B34E-5F2097EFD639@tagtraum.com>
	<85DFF7C4-F266-4938-8458-78DC1299C3F7@gmail.com>
	<12633CD1-62D2-49F1-98E0-762C0BB4D911@tagtraum.com>
	<86244080-749C-4534-8B3E-D2840255ECBD@gmail.com>
Message-ID: <56ED2648-1A81-4B07-B11B-AD1E23F4B8BE@tagtraum.com>

On Sep 2, 2014, at 10:24, Michael Hall <mik3hall at gmail.com> wrote:

> On Sep 2, 2014, at 2:58 AM, Hendrik Schreiber <hs at tagtraum.com> wrote:
> 
>> That's certainly also possible, but it also does not solve the issue completely.
> 
> True. Another work around really. But your crash appeared to be on a nil passed to CFRelease in the native method. As long as it wasn't a problem until you got to that CFRelease, just not doing the CFRelease should avoid the crash.

Yes, indeed. But logic in other placed would not necessarily work as intended.

-hendrik

From mik3hall at gmail.com  Tue Sep  2 08:45:06 2014
From: mik3hall at gmail.com (Michael Hall)
Date: Tue, 2 Sep 2014 03:45:06 -0500
Subject: Crashes in Java_sun_lwawt_macosx_LWCToolkit_stopAWTRunLoop
	(called with NULL argument)
In-Reply-To: <56ED2648-1A81-4B07-B11B-AD1E23F4B8BE@tagtraum.com>
References: <16CCD64E-E5F6-4503-B9CF-33B67471B028@tagtraum.com>
	<53FF7215.3070105@oracle.com>
	<A36ACA60-CB34-44F5-B34E-5F2097EFD639@tagtraum.com>
	<85DFF7C4-F266-4938-8458-78DC1299C3F7@gmail.com>
	<12633CD1-62D2-49F1-98E0-762C0BB4D911@tagtraum.com>
	<86244080-749C-4534-8B3E-D2840255ECBD@gmail.com>
	<56ED2648-1A81-4B07-B11B-AD1E23F4B8BE@tagtraum.com>
Message-ID: <046B13FA-2C38-4EEA-B79E-A3DE0EC5949E@gmail.com>

On Sep 2, 2014, at 3:29 AM, Hendrik Schreiber <hs at tagtraum.com> wrote:

> Yes, indeed. But logic in other placed would not necessarily work as intended.

I can think of no side effects on that one. All you're doing is avoiding the crash by avoiding the CFRelease on nil. If keeping the code running has side effects they would have to be from the original bug that you get to the code somehow where the value ends up nil.

Michael Hall

trz nio.2 for OS X http://www195.pair.com/mik3hall/index.html#trz

HalfPipe Java 6/7 shell app http://www195.pair.com/mik3hall/index.html#halfpipe

AppConverter convert Apple jvm to openjdk apps http://www195.pair.com/mik3hall/index.html#appconverter






From hs at tagtraum.com  Tue Sep  2 08:51:41 2014
From: hs at tagtraum.com (Hendrik Schreiber)
Date: Tue, 2 Sep 2014 10:51:41 +0200
Subject: Crashes in Java_sun_lwawt_macosx_LWCToolkit_stopAWTRunLoop
	(called with NULL argument)
In-Reply-To: <046B13FA-2C38-4EEA-B79E-A3DE0EC5949E@gmail.com>
References: <16CCD64E-E5F6-4503-B9CF-33B67471B028@tagtraum.com>
	<53FF7215.3070105@oracle.com>
	<A36ACA60-CB34-44F5-B34E-5F2097EFD639@tagtraum.com>
	<85DFF7C4-F266-4938-8458-78DC1299C3F7@gmail.com>
	<12633CD1-62D2-49F1-98E0-762C0BB4D911@tagtraum.com>
	<86244080-749C-4534-8B3E-D2840255ECBD@gmail.com>
	<56ED2648-1A81-4B07-B11B-AD1E23F4B8BE@tagtraum.com>
	<046B13FA-2C38-4EEA-B79E-A3DE0EC5949E@gmail.com>
Message-ID: <6BD45E98-20B6-403E-81A5-2A3A61FC66D7@tagtraum.com>

On Sep 2, 2014, at 10:45, Michael Hall <mik3hall at gmail.com> wrote:

> On Sep 2, 2014, at 3:29 AM, Hendrik Schreiber <hs at tagtraum.com> wrote:
> 
>> Yes, indeed. But logic in other placed would not necessarily work as intended.
> 
> I can think of no side effects on that one. All you're doing is avoiding the crash by avoiding the CFRelease on nil. If keeping the code running has side effects they would have to be from the original bug that you get to the code somehow where the value ends up nil.

Exactly.
I'm looking for the "real fix", not just for the fix of the symptom (that nil value we call release on).
The calling code is obviously buggy, but in a non-trivial way.

-hendrik

From hs at tagtraum.com  Tue Sep  2 14:56:52 2014
From: hs at tagtraum.com (Hendrik Schreiber)
Date: Tue, 2 Sep 2014 16:56:52 +0200
Subject: Crash in Java2D Queue Flusher, OGLSD_SetScratchSurface
Message-ID: <C702858D-64B0-4156-9B9F-115E7F37AF71@tagtraum.com>

Hey Anthony,

could you please check whether bug report with review id JI-9014446 was also closed, because nobody was able to reproduce it?
If so, the bug also re-appeared in the final Java 8_u20.

It seems to be connected to a message in standard error:

exception in QueueFlusher:
java.lang.RuntimeException: Non-Java exception raised, not handled! (Original problem: -[__NSTaggedDate view]: unrecognized selector sent to instance 0xbadd9a48d2ccbead)
	at sun.java2d.opengl.OGLRenderQueue.flushBuffer(Native Method)
	at sun.java2d.opengl.OGLRenderQueue.flushBuffer(OGLRenderQueue.java:148)
	at sun.java2d.opengl.OGLRenderQueue.access$100(OGLRenderQueue.java:41)
	at sun.java2d.opengl.OGLRenderQueue$QueueFlusher.run(OGLRenderQueue.java:226)

A new, corresponding crash log for OS X 10.9.4 can be found at http://www.beatunes.com/download/oglflusher.crash
The key part being:

Thread 23 Crashed:: Java: Java2D Queue Flusher
0   libsystem_kernel.dylib        	0x00007fff8cddf866 __pthread_kill + 10
1   libsystem_pthread.dylib       	0x00007fff8778335c pthread_kill + 92
2   libsystem_c.dylib             	0x00007fff8e272b1a abort + 125
3   libjvm.dylib                  	0x0000000107720b07 os::abort(bool) + 25
4   libjvm.dylib                  	0x000000010783cd26 VMError::report_and_die() + 2260
5   libjvm.dylib                  	0x000000010772267a JVM_handle_bsd_signal + 1131
6   libjvm.dylib                  	0x000000010771eb3b signalHandler(int, __siginfo*, void*) + 47
7   libsystem_platform.dylib      	0x00007fff8e1555aa _sigtramp + 26
8   libawt_lwawt.dylib            	0x000000017f99d4cc OGLSD_SetScratchSurface + 51
9   libawt_lwawt.dylib            	0x000000017f9bd5ae Java_sun_java2d_opengl_OGLRenderQueue_flushBuffer + 1594
10  ???                           	0x0000000109530a6a 0 + 4451404394
11  ???                           	0x0000000108afac44 0 + 4440697924

To the untrained eye, the stacktrace combined with the crash log seem to indicate that the call 

    if ([ctxinfo->context view] == nil) {

in OGLContext * OGLSD_SetScratchSurface(JNIEnv *env, jlong pConfigInfo) of macosx/native/libawt_lwawt/sun/java2d/opengl/CGLSurfaceData.m somehow calls "view" on a bad pointer. Perhaps some more sanity checks are in order before calling "view".

In any case, I would appreciate it, if you attached this info to the original bug, and if it was closed already, re-opened it.

Thank you,

-hendrik


From hs at tagtraum.com  Thu Sep  4 09:26:17 2014
From: hs at tagtraum.com (Hendrik Schreiber)
Date: Thu, 4 Sep 2014 11:26:17 +0200
Subject: Crash in Java2D Queue Flusher, OGLSD_SetScratchSurface
In-Reply-To: <C702858D-64B0-4156-9B9F-115E7F37AF71@tagtraum.com>
References: <C702858D-64B0-4156-9B9F-115E7F37AF71@tagtraum.com>
Message-ID: <C1C4CBF9-8409-408D-9AD0-E203FBA75073@tagtraum.com>

On Sep 2, 2014, at 16:56, Hendrik Schreiber <hs at tagtraum.com> wrote:

> Hey Anthony,

... or actually anyone else with access to the bug database ...

> could you please check whether bug report with review id JI-9014446 was also closed, because nobody was able to reproduce it?

Any chance you can you check this out and append the information from my last email.

Thank you!

-hendrik


From krueger at lesspain.de  Sun Sep  7 11:23:24 2014
From: krueger at lesspain.de (=?UTF-8?Q?Robert_Kr=C3=BCger?=)
Date: Sun, 7 Sep 2014 13:23:24 +0200
Subject: java2d performance java7 / java8
In-Reply-To: <023FA89F-A112-49A8-B234-18F97785969F@tagtraum.com>
References: <53DFA95C.6040507@3kraft.com> <53E0DE0F.5070507@oracle.com>
	<53F20819.2020300@3kraft.com>
	<023FA89F-A112-49A8-B234-18F97785969F@tagtraum.com>
Message-ID: <CAEnqZEUhz+mSxD5eSOQbeUS6Mc3-FmrB9UAKRGH79BcV0SuU-A@mail.gmail.com>

Would the effect described here also affect performance of JFXPanel? I
noticed that scrolling smoothness degrades visibly when putting a tree or a
table into a JFXPanel, while the same controls scroll as smoothly as native
ones when part of a JFX stage.
Am 22.08.2014 12:10 schrieb "Hendrik Schreiber" <hs at tagtraum.com>:
>
> On Aug 18, 2014, at 16:05, Florian Bruckner (3kraft) <
florian.bruckner at 3kraft.com> wrote:
>
> > I have built a minimalistic test case that exposes the problem. It
creates a JFrame with an editor pane in it to show some HTML content (a
javadoc page). The test is to just scroll from the bottom to the top and
back to the bottom by mouse wheel as quickly as possible, I did 5
iterations in each test run.
> >
> > Wall clock timing was approx. 15 seconds with Java 6 and approx 45
seconds with java 8. As the problem worsens with increased screen
resolutions I decided to use the full resolution of my new UHD display
(which is 3840x2160), the machine is a
>
> [...]
>
> Thanks for coming up with some sort of test.
>
> Hopefully the folks at Oracle find the time to look into this, perhaps do
their own performance testing, and find ways to improve the 2D pipeline.
>
> Cheers,
>
> -hendrik

From Sergey.Bylokhov at oracle.com  Mon Sep  8 18:08:40 2014
From: Sergey.Bylokhov at oracle.com (Sergey Bylokhov)
Date: Mon, 08 Sep 2014 22:08:40 +0400
Subject: Crash in Java2D Queue Flusher, OGLSD_SetScratchSurface
In-Reply-To: <C1C4CBF9-8409-408D-9AD0-E203FBA75073@tagtraum.com>
References: <C702858D-64B0-4156-9B9F-115E7F37AF71@tagtraum.com>
	<C1C4CBF9-8409-408D-9AD0-E203FBA75073@tagtraum.com>
Message-ID: <540DF0A8.4030007@oracle.com>

Hi, Hendrik.
The request was reopened and additional information was added.
Thanks for your report!

On 04.09.2014 13:26, Hendrik Schreiber wrote:
> On Sep 2, 2014, at 16:56, Hendrik Schreiber <hs at tagtraum.com> wrote:
>
>> Hey Anthony,
> ... or actually anyone else with access to the bug database ...
>
>> could you please check whether bug report with review id JI-9014446 was also closed, because nobody was able to reproduce it?
> Any chance you can you check this out and append the information from my last email.
>
> Thank you!
>
> -hendrik
>


-- 
Best regards, Sergey.


From hs at tagtraum.com  Mon Sep  8 18:21:43 2014
From: hs at tagtraum.com (Hendrik Schreiber)
Date: Mon, 8 Sep 2014 20:21:43 +0200
Subject: Crash in Java2D Queue Flusher, OGLSD_SetScratchSurface
In-Reply-To: <540DF0A8.4030007@oracle.com>
References: <C702858D-64B0-4156-9B9F-115E7F37AF71@tagtraum.com>
	<C1C4CBF9-8409-408D-9AD0-E203FBA75073@tagtraum.com>
	<540DF0A8.4030007@oracle.com>
Message-ID: <E288F96D-C6DC-406D-939A-DB8E5DA24B9F@tagtraum.com>

On Sep 8, 2014, at 20:08, Sergey Bylokhov <Sergey.Bylokhov at oracle.com> wrote:

> The request was reopened and additional information was added.

Found the ticket: https://bugs.openjdk.java.net/browse/JDK-8057830

> Thanks for your report!

Thank you, Sergey.
Very much appreciated.

This bug and the one mentioned in http://mail.openjdk.java.net/pipermail/awt-dev/2014-September/008425.html are the only ones I do get crash reports for from customers fairly regularly. Any progress on them would make me happy :-)

Cheers,

-hendrik

From david at code.davidpcaldwell.com  Mon Sep 15 10:53:35 2014
From: david at code.davidpcaldwell.com (David P. Caldwell)
Date: Mon, 15 Sep 2014 06:53:35 -0400
Subject: Mac OS X JVMCapabilities
In-Reply-To: <CABBxOKksGM3Rj_RLmAAJ21bMMs9XJc7kYCMNaV1heMT9PvRpPw@mail.gmail.com>
References: <CABBxOKm74xrByz5_TbL3abFZSW3mFywAQ2nAR2+Hvi7Mcc+hdg@mail.gmail.com>
	<6FE06651-880C-40AC-AF5D-84D5A815DAD2@oracle.com>
	<CABBxOKksGM3Rj_RLmAAJ21bMMs9XJc7kYCMNaV1heMT9PvRpPw@mail.gmail.com>
Message-ID: <CABBxOK=MgUOZZHPa7L7SH2mCxT++uOhvPnGQFhMcRtiPz53iMA@mail.gmail.com>

I'm re-asking this question after a few months of being away from it
-- doing a fresh Mac OS X install and the same question jumps to mind
(I am now modifying my installer to overwrite the Info.plist file,
which unfortunately means it will now require sudo).

Is there a reason this "capability" is not declared in the JDK's
Info.plist by default?

-- David P. Caldwell
http://www.davidpcaldwell.com/

On Fri, Apr 11, 2014 at 3:37 PM, David P. Caldwell
<david at code.davidpcaldwell.com> wrote:
> Petr, Thanks for sending me to the right list.
>
> I have an application that has a native wrapper that launches a Java
> virtual machine. It essentially is a shell language like Python that
> provides an embedding of the Rhino script engine (perhaps Nashorn at
> some point) so that one can write "shell scripts" in JavaScript.
>
> The native wrapper provides mostly a convenience, but it is very
> helpful. When invoking the shell, you can do:
>
> /usr/local/jsh/jsh [script]
>
> You can also use the hashbang:
>
> #!/usr/local/jsh/jsh
>
> So it's a nice feature to have.
>
> On other UNIXes, and even Cygwin, I am able to easily build the native
> wrapper from source. On Mac OS X, the build succeeds, but at least
> with JDK 8 on Mac OS X 10.9, I get a failure when I attempt to launch
> the shell, claiming I need a Java SE 6 installation to proceed and
> prompting me to install one.
>
> I was able to get rid of this issue by modifying the JDK's Info.plist
> to include the JNI "capability."
>
> I can see the "capability" has been limited to just command-line ever
> since the initial commit of the Mac OS X port into OpenJDK. However,
> it is clear the port *has* the "capability" as everything worked fine
> as soon as I added that capability to the manifest.
>
> So my question is, is there a reason that we ship with that capability
> disabled by default?
>
> -- David P. Caldwell
> http://www.davidpcaldwell.com/
>
> On Fri, Apr 11, 2014 at 3:16 PM, Petr Pchelko <petr.pchelko at oracle.com> wrote:
>> Hello, David.
>>
>> A better alias to ask this is a macosx port alias.
>> Could you please clarify your question:
>> Are you using a native bundle?
>> Are you writing a UI application?
>> How do you get an Info.plist you talk about? just JDK has no info.plist..
>>
>> With best regards. Petr.
>>
>> 11 ???. 2014 ?., ? 5:50 ????? ???????, David P. Caldwell <david at code.davidpcaldwell.com> ???????(?):
>>
>>> Is there a reason that JDK 8 does not declare the full set of
>>> "capabilities" (from the OS X point of view) in the OS-specific
>>> Info.plist file?
>>>
>>> I just discovered that my JNI application broke because it uses native
>>> code to launch a JVM, but was able to fix it simply by adding the JNI
>>> "capability." So clearly it *has* that capability.
>>>
>>> -- David P. Caldwell
>>> http://www.davidpcaldwell.com/
>>

From paul_t100 at fastmail.fm  Thu Sep 18 16:19:51 2014
From: paul_t100 at fastmail.fm (Paul Taylor)
Date: Thu, 18 Sep 2014 17:19:51 +0100
Subject: What do we need to change to sign java appbundle since updating from
	10.9.4 to 10.9.5
Message-ID: <541B0627.8010805@fastmail.fm>

Can somebody help me with this please I just updated from OSX 10.9.4 to 
10.9.5, and it  looks like I have to change how I sign Java application 
after updating because Im now getting this output after signing with

     export 
CODESIGN_ALLOCATE="/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/codesign_allocate"
     /usr/bin/codesign --sign "Developer ID Application: P Taylor" 
--force --deep --verbose /Applications/SongKong.app

Im getting:

     /Applications/SongKong.app: the main executable or Info.plist must 
be a regular file (no symlinks, etc.)
     In subcomponent: 
/Applications/SongKong.app/Contents/PlugIns/jdk1.8.0_20.jdk

and verification with

     /usr/bin/codesign --verify --deep  --verbose /Applications/SongKong.app

gives me

     /Applications/SongKong.app: code object is not signed at all
     In architecture: x86_64

What do I have to change to fix this ?

Paul


From danno.ferrin at oracle.com  Thu Sep 18 17:16:41 2014
From: danno.ferrin at oracle.com (Danno Ferrin)
Date: Thu, 18 Sep 2014 11:16:41 -0600
Subject: What do we need to change to sign java appbundle since updating
	from 10.9.4 to 10.9.5
In-Reply-To: <541B0627.8010805@fastmail.fm>
References: <541B0627.8010805@fastmail.fm>
Message-ID: <90814AAE-A3DE-4FA5-B2B0-F7513C4D64CA@oracle.com>

On the javapacakger (javafxpackager) side of the house we dodge this by not using the symlinked JLI.

The JDK as it is installed installs a symlink to the libjli.dylib in ...app/Contents/MacOS is actually a symlink.  I don't know if you copy it if it will still work, it may want to live in ...app/Contents/Home/jre/lib/jli/libjli.dylib.  This is referenced in the default info.plist

The way we dodge this for the javapackager is we create our own launch native that opens up the libjli from the location deep in the JRE.  And we don't ship the symlink.

I can confirm that javapackager 8u20 signs and launchers with 10.9.5, but I haven't tried to submit it to the app store since the signing requirements changes.

So I don't know how you launch, but the info.plist cannot refer to the symlinked libjli.dylib if it is symlinked, and it may not even be allowed to exist as a symlink in ...app/Contents/MacOS.  So if you can remove the symlink before signing that may help.

On Sep 18, 2014, at 10:19 AM, Paul Taylor <paul_t100 at fastmail.fm> wrote:

> Can somebody help me with this please I just updated from OSX 10.9.4 to 10.9.5, and it  looks like I have to change how I sign Java application after updating because Im now getting this output after signing with
> 
>    export CODESIGN_ALLOCATE="/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/codesign_allocate"
>    /usr/bin/codesign --sign "Developer ID Application: P Taylor" --force --deep --verbose /Applications/SongKong.app
> 
> Im getting:
> 
>    /Applications/SongKong.app: the main executable or Info.plist must be a regular file (no symlinks, etc.)
>    In subcomponent: /Applications/SongKong.app/Contents/PlugIns/jdk1.8.0_20.jdk
> 
> and verification with
> 
>    /usr/bin/codesign --verify --deep  --verbose /Applications/SongKong.app
> 
> gives me
> 
>    /Applications/SongKong.app: code object is not signed at all
>    In architecture: x86_64
> 
> What do I have to change to fix this ?
> 
> Paul
> 


From paul_t100 at fastmail.fm  Thu Sep 18 18:49:25 2014
From: paul_t100 at fastmail.fm (Paul Taylor)
Date: Thu, 18 Sep 2014 19:49:25 +0100
Subject: What do we need to change to sign java appbundle since updating
	from 10.9.4 to 10.9.5
In-Reply-To: <90814AAE-A3DE-4FA5-B2B0-F7513C4D64CA@oracle.com>
References: <541B0627.8010805@fastmail.fm>
	<90814AAE-A3DE-4FA5-B2B0-F7513C4D64CA@oracle.com>
Message-ID: <541B2935.6080500@fastmail.fm>

On 18/09/2014 18:16, Danno Ferrin wrote:
> On the javapacakger (javafxpackager) side of the house we dodge this by not using the symlinked JLI.
>
> The JDK as it is installed installs a symlink to the libjli.dylib in ...app/Contents/MacOS is actually a symlink.  I don't know if you copy it if it will still work, it may want to live in ...app/Contents/Home/jre/lib/jli/libjli.dylib.  This is referenced in the default info.plist
>
> The way we dodge this for the javapackager is we create our own launch native that opens up the libjli from the location deep in the JRE.  And we don't ship the symlink.
>
> I can confirm that javapackager 8u20 signs and launchers with 10.9.5, but I haven't tried to submit it to the app store since the signing requirements changes.
>
> So I don't know how you launch, but the info.plist cannot refer to the symlinked libjli.dylib if it is symlinked, and it may not even be allowed to exist as a symlink in ...app/Contents/MacOS.  So if you can remove the symlink before signing that may help.
Im using a fork of Java Application Bundler from InfiniteKind - 
https://bitbucket.org/infinitekind/appbundler -Im not deploying to the 
appstore its just uploaded to my website.

So following your advice  I found that libjli.dylib in 
Contents/PlugsIns/jdk1.8.0_20.jdk/Contents/MacOS pointed to 
../Home/jre/lib/jli - replacing the symbolic link with a copy of the 
file has allowed the signing to work, and when installed the application 
stills seem to work, thankyou :)
'
I assume if it doesn't work then you'll have a problem with 
javafxpackager applications as well.

Any thoughts from dev team about removing this symbolic link in the jdk ?

Paul

From hs at tagtraum.com  Thu Sep 18 19:22:38 2014
From: hs at tagtraum.com (Hendrik Schreiber)
Date: Thu, 18 Sep 2014 21:22:38 +0200
Subject: What do we need to change to sign java appbundle since updating
	from 10.9.4 to 10.9.5
In-Reply-To: <541B2935.6080500@fastmail.fm>
References: <541B0627.8010805@fastmail.fm>
	<90814AAE-A3DE-4FA5-B2B0-F7513C4D64CA@oracle.com>
	<541B2935.6080500@fastmail.fm>
Message-ID: <E6ADD3BD-6296-42E1-9FE1-6C70568F8978@tagtraum.com>

On Sep 18, 2014, at 20:49, Paul Taylor <paul_t100 at fastmail.fm> wrote:

> On 18/09/2014 18:16, Danno Ferrin wrote:
>> On the javapacakger (javafxpackager) side of the house we dodge this by not using the symlinked JLI.
>> 
>> The JDK as it is installed installs a symlink to the libjli.dylib in ...app/Contents/MacOS is actually a symlink.  I don't know if you copy it if it will still work, it may want to live in ...app/Contents/Home/jre/lib/jli/libjli.dylib.  This is referenced in the default info.plist
>> 
>> The way we dodge this for the javapackager is we create our own launch native that opens up the libjli from the location deep in the JRE.  And we don't ship the symlink.
>> 
>> I can confirm that javapackager 8u20 signs and launchers with 10.9.5, but I haven't tried to submit it to the app store since the signing requirements changes.
>> 
>> So I don't know how you launch, but the info.plist cannot refer to the symlinked libjli.dylib if it is symlinked, and it may not even be allowed to exist as a symlink in ...app/Contents/MacOS.  So if you can remove the symlink before signing that may help.
> Im using a fork of Java Application Bundler from InfiniteKind - https://bitbucket.org/infinitekind/appbundler -Im not deploying to the appstore its just uploaded to my website.
> 
> So following your advice  I found that libjli.dylib in Contents/PlugsIns/jdk1.8.0_20.jdk/Contents/MacOS pointed to ../Home/jre/lib/jli - replacing the symbolic link with a copy of the file has allowed the signing to work, and when installed the application stills seem to work, thankyou :)
> '
> I assume if it doesn't work then you'll have a problem with javafxpackager applications as well.
> 
> Any thoughts from dev team about removing this symbolic link in the jdk ?

Perhaps AppBundler should simply not copy the MacOS folder.
I don't see how it's needed when bundle the JRE as plugin and launch with the AppBundler stub.

-hendrik


From paul_t100 at fastmail.fm  Fri Sep 19 13:33:38 2014
From: paul_t100 at fastmail.fm (Paul Taylor)
Date: Fri, 19 Sep 2014 14:33:38 +0100
Subject: What do we need to change to sign java appbundle since updating
	from 10.9.4 to 10.9.5
In-Reply-To: <E6ADD3BD-6296-42E1-9FE1-6C70568F8978@tagtraum.com>
References: <541B0627.8010805@fastmail.fm>	<90814AAE-A3DE-4FA5-B2B0-F7513C4D64CA@oracle.com>	<541B2935.6080500@fastmail.fm>
	<E6ADD3BD-6296-42E1-9FE1-6C70568F8978@tagtraum.com>
Message-ID: <541C30B2.2040109@fastmail.fm>

On 18/09/2014 20:22, Hendrik Schreiber wrote:
> On Sep 18, 2014, at 20:49, Paul Taylor <paul_t100 at fastmail.fm> wrote:
>
>> On 18/09/2014 18:16, Danno Ferrin wrote:
>>> On the javapacakger (javafxpackager) side of the house we dodge this by not using the symlinked JLI.
>>>
>>> The JDK as it is installed installs a symlink to the libjli.dylib in ...app/Contents/MacOS is actually a symlink.  I don't know if you copy it if it will still work, it may want to live in ...app/Contents/Home/jre/lib/jli/libjli.dylib.  This is referenced in the default info.plist
>>>
>>> The way we dodge this for the javapackager is we create our own launch native that opens up the libjli from the location deep in the JRE.  And we don't ship the symlink.
>>>
>>> I can confirm that javapackager 8u20 signs and launchers with 10.9.5, but I haven't tried to submit it to the app store since the signing requirements changes.
>>>
>>> So I don't know how you launch, but the info.plist cannot refer to the symlinked libjli.dylib if it is symlinked, and it may not even be allowed to exist as a symlink in ...app/Contents/MacOS.  So if you can remove the symlink before signing that may help.
>> Im using a fork of Java Application Bundler from InfiniteKind - https://bitbucket.org/infinitekind/appbundler -Im not deploying to the appstore its just uploaded to my website.
>>
>> So following your advice  I found that libjli.dylib in Contents/PlugsIns/jdk1.8.0_20.jdk/Contents/MacOS pointed to ../Home/jre/lib/jli - replacing the symbolic link with a copy of the file has allowed the signing to work, and when installed the application stills seem to work, thankyou :)
>> '
>> I assume if it doesn't work then you'll have a problem with javafxpackager applications as well.
>>
>> Any thoughts from dev team about removing this symbolic link in the jdk ?
> Perhaps AppBundler should simply not copy the MacOS folder.
> I don't see how it's needed when bundle the JRE as plugin and launch with the AppBundler stub.
>
> -hendrik
>
>
Ive raised this issue on AppBundler 
https://bitbucket.org/infinitekind/appbundler/issue/1/appbundle-built-on-mac-osx-1095-cannot-be

Paul

From paul_t100 at fastmail.fm  Mon Sep 22 11:10:36 2014
From: paul_t100 at fastmail.fm (Paul Taylor)
Date: Mon, 22 Sep 2014 12:10:36 +0100
Subject: OSX failing to get a url for image even though it is a supported
	dataflavour for the transferable
Message-ID: <542003AC.70103@fastmail.fm>

Customer reporting this error when trying to copy and paste an image 
from amazon, although we check the transferable object support a 
particular dataflavor, it fails when try and use that data flavour to 
get a url. Ive not seen this error before and recently moved to Java 
1.8.0_20 so I'm assuming the issues lies with Java 8 ?

java.net.MalformedURLException: no protocol: <?xml version="1.0" 
encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" 
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<array>
<string>http://ecx.images-amazon.com/images/I/41NTPXC8EHL.jpg</string>
     <string></string>
</array>
</plist>

     at java.net.URL.<init>(URL.java:586)
     at java.net.URL.<init>(URL.java:483)
     at java.net.URL.<init>(URL.java:432)
     at 
sun.lwawt.macosx.CDataTransferer.translateBytes(CDataTransferer.java:135)
     at 
sun.awt.datatransfer.ClipboardTransferable$DataFactory.getTransferData(ClipboardTransferable.java:71)
     at 
sun.awt.datatransfer.ClipboardTransferable.getTransferData(ClipboardTransferable.java:168)

Code Extract

public static DataFlavor imageUrlFlavor =  new 
DataFlavor("application/x-java-url;class=java.net.URL");
public void getImage(Transferable trans)

if(trans.isDataFlavorSupported(FileDropTarget.imageUrlFlavor))
             {
                 imageUrl  = (URL) 
trans.getTransferData(FileDropTarget.imageUrlFlavor);
             }



From swpalmer at gmail.com  Mon Sep 22 13:03:03 2014
From: swpalmer at gmail.com (Scott Palmer)
Date: Mon, 22 Sep 2014 09:03:03 -0400
Subject: OSX failing to get a url for image even though it is a supported
	dataflavour for the transferable
In-Reply-To: <542003AC.70103@fastmail.fm>
References: <542003AC.70103@fastmail.fm>
Message-ID: <CAL3e5iF5wGoFe_MC+XQPXBFLkazY3CzXOdq9PAosjmD75e8ikQ@mail.gmail.com>

The XML has an array of two strings.  Are you sure you aren't getting
the error from the second blank string?

Scott

On Mon, Sep 22, 2014 at 7:10 AM, Paul Taylor <paul_t100 at fastmail.fm> wrote:
> Customer reporting this error when trying to copy and paste an image from
> amazon, although we check the transferable object support a particular
> dataflavor, it fails when try and use that data flavour to get a url. Ive
> not seen this error before and recently moved to Java 1.8.0_20 so I'm
> assuming the issues lies with Java 8 ?
>
> java.net.MalformedURLException: no protocol: <?xml version="1.0"
> encoding="UTF-8"?>
> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
> "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
> <plist version="1.0">
> <array>
> <string>http://ecx.images-amazon.com/images/I/41NTPXC8EHL.jpg</string>
>     <string></string>
> </array>
> </plist>
>
>     at java.net.URL.<init>(URL.java:586)
>     at java.net.URL.<init>(URL.java:483)
>     at java.net.URL.<init>(URL.java:432)
>     at
> sun.lwawt.macosx.CDataTransferer.translateBytes(CDataTransferer.java:135)
>     at
> sun.awt.datatransfer.ClipboardTransferable$DataFactory.getTransferData(ClipboardTransferable.java:71)
>     at
> sun.awt.datatransfer.ClipboardTransferable.getTransferData(ClipboardTransferable.java:168)
>
> Code Extract
>
> public static DataFlavor imageUrlFlavor =  new
> DataFlavor("application/x-java-url;class=java.net.URL");
> public void getImage(Transferable trans)
>
> if(trans.isDataFlavorSupported(FileDropTarget.imageUrlFlavor))
>             {
>                 imageUrl  = (URL)
> trans.getTransferData(FileDropTarget.imageUrlFlavor);
>             }
>
>

From paul_t100 at fastmail.fm  Tue Sep 23 07:55:42 2014
From: paul_t100 at fastmail.fm (Paul Taylor)
Date: Tue, 23 Sep 2014 08:55:42 +0100
Subject: OSX failing to get a url for image even though it is a supported
	dataflavour for the transferable
In-Reply-To: <CAL3e5iF5wGoFe_MC+XQPXBFLkazY3CzXOdq9PAosjmD75e8ikQ@mail.gmail.com>
References: <542003AC.70103@fastmail.fm>
	<CAL3e5iF5wGoFe_MC+XQPXBFLkazY3CzXOdq9PAosjmD75e8ikQ@mail.gmail.com>
Message-ID: <5421277E.20406@fastmail.fm>

On 22/09/2014 14:03, Scott Palmer wrote:
> The XML has an array of two strings.  Are you sure you aren't getting
> the error from the second blank string?
>
> Scott
Ah, good point BUT why would getTransferData() return an empty value, I 
dont see I have any control over that ?

Paul

From mik3hall at gmail.com  Sun Sep 28 00:04:31 2014
From: mik3hall at gmail.com (Michael Hall)
Date: Sat, 27 Sep 2014 19:04:31 -0500
Subject: Java 1.8 jnlp on OS X
Message-ID: <9D9B3470-F612-47E3-AD20-DAEA9A0E705D@gmail.com>

Not sure this is a proper list for much anymore except discussion but that might be all this really calls for right now.
I?m trying to figure out how to run some jnlp with java 1.8. That now seems to set the default security setting to High. 
So you need to sign with a valid certificate. 
Why not the Apple Developer ID one? 
I exported that and got it into a keystore?
Your keystore contains 1 entry

michael hall , Sep 27, 2014, PrivateKeyEntry, 

that I?m trying to use to sign but I get this?

jarsigner: Certificate chain not found for: eg.  eg must reference a valid KeyStore key entry containing a private key and corresponding public key certificate chain.

I?m not sure if the problem is that there is no public key entry in the keystore. Or no CA cert for Apple in the cacerts file - there doesn?t appear to be one. Assuming I can figure out how to get the public key entry for the developer ID cert in the keystore the problem is the Apple CA cert.
Is there any way to get one?
Is there any reason not to get one?

If this isn?t the way to go I?ve heard that signing certs are reasonably priced. Any suggestions where to get one in this ?cheap' category?

Is JWS just not the way to go anymore? Go with JavaFX, or??

Michael Hall

trz nio.2 for OS X http://www195.pair.com/mik3hall/index.html#trz

HalfPipe Java 6/7 shell app http://www195.pair.com/mik3hall/index.html#halfpipe

AppConverter convert Apple jvm to openjdk apps http://www195.pair.com/mik3hall/index.html#appconverter





From david.dehaven at oracle.com  Mon Sep 29 15:56:44 2014
From: david.dehaven at oracle.com (David DeHaven)
Date: Mon, 29 Sep 2014 08:56:44 -0700
Subject: Java 1.8 jnlp on OS X
In-Reply-To: <9D9B3470-F612-47E3-AD20-DAEA9A0E705D@gmail.com>
References: <9D9B3470-F612-47E3-AD20-DAEA9A0E705D@gmail.com>
Message-ID: <C70A0103-873E-4196-A402-063BA35788D9@oracle.com>


Java's code signer specifically needs a Java code signing cert. You can make one yourself for testing using "keytool", just be sure to import the private key as a "Signer CA" certificate in the Java Control Panel and it will treat it as a bona-fide CA signed certificate. I've never purchased one from a CA so I can't really comment on that or recommend any service.

As to using webstart or not, it depends on how you want to distribute your application. The primary purpose for webstart is application that are run directly from HTTP sources without needing to be installed. This is generally recommended for large and complex enterprise type applications where components may be updated frequently as webstart handled those updates for you. I don't recommend it for small applications as it's a bit of overkill (though it does work...)

With the changes recently made to Java Packager, there's little to no reason not to bundle it with a JRE and distribute it like a native application. When you bundle as a native app, you don't need to codesign your jar files, the entire bundle is signed with your Developer ID. We've got more features coming to Java Packager, including being able to share a JRE between a number of applications you create (think of something like MS Office or Adobe CS). You should also be able to distribute applications via Mac App Store, the packager has support specifically for that.

-DrD-

> Not sure this is a proper list for much anymore except discussion but that might be all this really calls for right now.
> I?m trying to figure out how to run some jnlp with java 1.8. That now seems to set the default security setting to High. 
> So you need to sign with a valid certificate. 
> Why not the Apple Developer ID one? 
> I exported that and got it into a keystore?
> Your keystore contains 1 entry
> 
> michael hall , Sep 27, 2014, PrivateKeyEntry, 
> 
> that I?m trying to use to sign but I get this?
> 
> jarsigner: Certificate chain not found for: eg.  eg must reference a valid KeyStore key entry containing a private key and corresponding public key certificate chain.
> 
> I?m not sure if the problem is that there is no public key entry in the keystore. Or no CA cert for Apple in the cacerts file - there doesn?t appear to be one. Assuming I can figure out how to get the public key entry for the developer ID cert in the keystore the problem is the Apple CA cert.
> Is there any way to get one?
> Is there any reason not to get one?
> 
> If this isn?t the way to go I?ve heard that signing certs are reasonably priced. Any suggestions where to get one in this ?cheap' category?
> 
> Is JWS just not the way to go anymore? Go with JavaFX, or??
> 
> Michael Hall
> 
> trz nio.2 for OS X http://www195.pair.com/mik3hall/index.html#trz
> 
> HalfPipe Java 6/7 shell app http://www195.pair.com/mik3hall/index.html#halfpipe
> 
> AppConverter convert Apple jvm to openjdk apps http://www195.pair.com/mik3hall/index.html#appconverter
> 
> 
> 
> 


From danno.ferrin at oracle.com  Mon Sep 29 16:55:29 2014
From: danno.ferrin at oracle.com (Danno Ferrin)
Date: Mon, 29 Sep 2014 09:55:29 -0700
Subject: Java 1.8 jnlp on OS X
In-Reply-To: <C70A0103-873E-4196-A402-063BA35788D9@oracle.com>
References: <9D9B3470-F612-47E3-AD20-DAEA9A0E705D@gmail.com>
	<C70A0103-873E-4196-A402-063BA35788D9@oracle.com>
Message-ID: <6CD36E06-B484-4E64-ADB1-BEF801EF8E35@oracle.com>


On Sep 29, 2014, at 8:56 AM, David DeHaven <david.dehaven at oracle.com> wrote:

> 
> Java's code signer specifically needs a Java code signing cert. You can make one yourself for testing using "keytool", just be sure to import the private key as a "Signer CA" certificate in the Java Control Panel and it will treat it as a bona-fide CA signed certificate. I've never purchased one from a CA so I can't really comment on that or recommend any service.
> 
> As to using webstart or not, it depends on how you want to distribute your application. The primary purpose for webstart is application that are run directly from HTTP sources without needing to be installed. This is generally recommended for large and complex enterprise type applications where components may be updated frequently as webstart handled those updates for you. I don't recommend it for small applications as it's a bit of overkill (though it does work...)
> 
> With the changes recently made to Java Packager, there's little to no reason not to bundle it with a JRE and distribute it like a native application. When you bundle as a native app, you don't need to codesign your jar files, the entire bundle is signed with your Developer ID. We've got more features coming to Java Packager, including being able to share a JRE between a number of applications you create (think of something like MS Office or Adobe CS). You should also be able to distribute applications via Mac App Store, the packager has support specifically for that.

JRE Sharing will be no sooner than 8u60, 8u40's features are pretty much locked and this didn't make the boat.

> 
> -DrD-
> 
>> Not sure this is a proper list for much anymore except discussion but that might be all this really calls for right now.
>> I?m trying to figure out how to run some jnlp with java 1.8. That now seems to set the default security setting to High. 
>> So you need to sign with a valid certificate. 
>> Why not the Apple Developer ID one? 
>> I exported that and got it into a keystore?
>> Your keystore contains 1 entry
>> 
>> michael hall , Sep 27, 2014, PrivateKeyEntry, 
>> 
>> that I?m trying to use to sign but I get this?
>> 
>> jarsigner: Certificate chain not found for: eg.  eg must reference a valid KeyStore key entry containing a private key and corresponding public key certificate chain.
>> 
>> I?m not sure if the problem is that there is no public key entry in the keystore. Or no CA cert for Apple in the cacerts file - there doesn?t appear to be one. Assuming I can figure out how to get the public key entry for the developer ID cert in the keystore the problem is the Apple CA cert.
>> Is there any way to get one?
>> Is there any reason not to get one?
>> 
>> If this isn?t the way to go I?ve heard that signing certs are reasonably priced. Any suggestions where to get one in this ?cheap' category?
>> 
>> Is JWS just not the way to go anymore? Go with JavaFX, or??
>> 
>> Michael Hall
>> 
>> trz nio.2 for OS X http://www195.pair.com/mik3hall/index.html#trz
>> 
>> HalfPipe Java 6/7 shell app http://www195.pair.com/mik3hall/index.html#halfpipe
>> 
>> AppConverter convert Apple jvm to openjdk apps http://www195.pair.com/mik3hall/index.html#appconverter
>> 
>> 
>> 
>> 
> 


From mik3hall at gmail.com  Mon Sep 29 20:18:11 2014
From: mik3hall at gmail.com (Michael Hall)
Date: Mon, 29 Sep 2014 15:18:11 -0500
Subject: Java 1.8 jnlp on OS X
In-Reply-To: <C70A0103-873E-4196-A402-063BA35788D9@oracle.com>
References: <9D9B3470-F612-47E3-AD20-DAEA9A0E705D@gmail.com>
	<C70A0103-873E-4196-A402-063BA35788D9@oracle.com>
Message-ID: <9414F36A-C29C-4099-A1D3-EB96A962CF70@gmail.com>

On Sep 29, 2014, at 10:56 AM, David DeHaven <david.dehaven at oracle.com> wrote:

> Java's code signer specifically needs a Java code signing cert. You can make one yourself for testing using "keytool",

Testing would be good enough to continue development support for JWS deployment for anyone on older releases that still allow it with self-signed.

I did find?.
jarsigner -certchain ?
https://community.oracle.com/thread/3559250

Which almost seemed like it would be possible with a pieced together Mac Developer ID certificate setup.
Exporting one from keychain to p12 and turning it into a keystore seemed to get a single private key entry. From what I saw this keystore should also have a public key certificate as well, that I wasn?t sure yet how?d you?d get yet when I decided to drop this. But putting the key store together manually by code with Apple certs if you could figure the public key one out might just be possible. 
I did see some code where you took the Apple root + intermediate + Developer ID certificates to p12 format and then somehow used that to sign an app. It then suggested that you could use codesign to verify it worked. This seems odd since my understanding is you can just use codesign as-is to sign an app - which will probably be my main OS X deployment option for Java 8+ from now on. 
Finally though, my main interest in JWS was for cross-platform and of course this wouldn?t be. I decided I could come up with some other way to support old jws. Point to an old JDK 7 version of the javaws command or something.  Your suggestion would probably be better for this - thanks.


Michael Hall

trz nio.2 for OS X http://www195.pair.com/mik3hall/index.html#trz

HalfPipe Java 6/7 shell app http://www195.pair.com/mik3hall/index.html#halfpipe

AppConverter convert Apple jvm to openjdk apps http://www195.pair.com/mik3hall/index.html#appconverter