search

WISE-Community / WISE-DEPRECATED

Web-based Inquiry Science Environment (WISE).
http://wise.berkeley.edu
Other
32 stars 24 forks source link

Brace for Java Update Jan. 14 #319

Closed hirokiterashima closed 10 years ago

hirokiterashima commented 10 years ago

Brace Yourself. Java 7 update 51 (7u51) is coming

https://blogs.oracle.com/java-platform-group/entry/new_security_requirements_for_rias

This will affect netlogo, mw, and jnlp servlet...maybe others.

We most-likely need to sign the jars, which means buying a certificate.

hirokiterashima commented 10 years ago

This would affect our satellite WISE instances too, so we need to make an announcement to the devlist once we figure out what needs to be done.

hirokiterashima commented 10 years ago

Update:

  1. got a certificate that we can use to sign the jars
  2. learned how to sign the jars
  3. the message "unsigned jars won't work after next update.." we used to see is no longer shown when trying to view applets, but now we get a new message: " This application will be blocked in a future Java security update because the JAR file manifest does not contain the Permissions attribute. Please contact the Publisher for more information "
hirokiterashima commented 10 years ago

We made some good progress, so here's an update: To solve the "...Permissions attribute..." message, we need to do these things:

  1. Add "Permissions: sandbox" to manifest
  2. Add extra param in the <applet>...</applet> in html to make sandbox work
<applet>...
            <param name="permissions" value="sandbox">
...</applet>

Then sign the jars with the certificate and we're good to go!

Now we need to do these things:

  1. Write a script to find all the jars and replace them with the signed jars.
  2. Write a script that finds existing html files that have the <applet>...</applet> tag and add <param name="permissions" value="sandbox">
  3. Update nodes that spits out the <applet>...</applet> code (like NetlogoNode, MWNode, SensorNode, etc), and add <param name="permissions" value="sandbox"> within the <applet> tag.

All the existing WISE satellites can run the scripts in 1 and 2, and they can update the node files by pulling the changes from git.

hirokiterashima commented 10 years ago

Done, for good, we hope. Wrote to devlist with instructions to update their instance of WISE https://groups.google.com/forum/#!topic/wise4-dev/SMsrbu0hlTs