🚀 go-pugleaf

When I signed it with signtool 1.1 (not 1.3), it fixed a problem.
But now the problem is that it works coorectly (Grant dialog, no yellow
bar, etc.)
only on SOME PCs and not even one workstation (Solaris 2.6).

Someone suggested to install IE5.X on NT4SP6 on those PCs
where it does not work, but that looks very weird to me.
And what would you do on Solaris ?

Please help !

Oleg.



Oleg Konovalov wrote:

> Hi,
>
> I am trying to sign JDK1.2.2 applet with signtool 1.3 on Solaris 2.6
> with Verisign certificate.
> Seems to sign OK, doesn't complain at verification.
>
> but there are some problems with that:
> - still see yellow stripe "Warning: applet window";
> - it never prompts to grant privileges;
> - throws exceptions at copy-paste;
> - usually crashes at printing (on NT) or (on Solaris2.6) creates huge
> (2GB) files and
> goes through infinite (or very long) loop trying to print GIFs (graphic
> buttons)
> and prints a gray page at best.
>
> All that tells me that it is not signed correctly or Java plug-in
> doesn't treat
> it as signed.
>
> Here is how I sign it (works fine with JDK1.1.7A in Netscape JavaVM):
>  signtool -p"mypwd"  -k"my certificate name"
> -d"/export/home/dbasii/.netscape"
> -Z  Signed${JARFILE} $SIGN_DIR  >>  /tmp/webLog$$
> Does it look OK for you ?
>
> 1) Are you sure signtool allows to sign Java2 applets (which run with
> Java Plug-in) ?
>
> 2) I have imported certificate to the Netscape. Do I have to do
> something else
> (for Java Plug-in) ?
>
> 3) I have also tried to generate a certificate and sign with it, but
> getting exception:
> SecurityException: cannot verify signature block file META-INF/ZIGBERT
> Any ideas ?
>
> 4) I have tried to use jarsigner, but it always throws exception
> ZipException: invalid entry compressed size (expected <X> but got <X-3>
> bytes)
> (different entries for different applets).
>
> Any suggestions ?
>
> Thank you in advance,
> Oleg.
>
> P.S.: Please reply via e-mail also.

I have successfully signed many applets granting them universal connect.
There are two thing you should consider;
1. The code signing certificates from verisign are browser specific; for
Internet Explorer or for Netscape not either or.
2. When you grant the "privilege" it is only valid in that context and it
goes out of scope and the "privilege" is lost.
Keene Hammond
"Oleg Konovalov" <okonoval@telcordia.com> wrote in message
news:3A3A898E.6F90FEB7@telcordia.com...
> When I signed it with signtool 1.1 (not 1.3), it fixed a problem.
> But now the problem is that it works coorectly (Grant dialog, no yellow
> bar, etc.)
> only on SOME PCs and not even one workstation (Solaris 2.6).
>
> Someone suggested to install IE5.X on NT4SP6 on those PCs
> where it does not work, but that looks very weird to me.
> And what would you do on Solaris ?
>
> Please help !
>
> Oleg.
>
>
>
> Oleg Konovalov wrote:
>
> > Hi,
> >
> > I am trying to sign JDK1.2.2 applet with signtool 1.3 on Solaris 2.6
> > with Verisign certificate.
> > Seems to sign OK, doesn't complain at verification.
> >
> > but there are some problems with that:
> > - still see yellow stripe "Warning: applet window";
> > - it never prompts to grant privileges;
> > - throws exceptions at copy-paste;
> > - usually crashes at printing (on NT) or (on Solaris2.6) creates huge
> > (2GB) files and
> > goes through infinite (or very long) loop trying to print GIFs (graphic
> > buttons)
> > and prints a gray page at best.
> >
> > All that tells me that it is not signed correctly or Java plug-in
> > doesn't treat
> > it as signed.
> >
> > Here is how I sign it (works fine with JDK1.1.7A in Netscape JavaVM):
> >  signtool -p"mypwd"  -k"my certificate name"
> > -d"/export/home/dbasii/.netscape"
> > -Z  Signed${JARFILE} $SIGN_DIR  >>  /tmp/webLog$$
> > Does it look OK for you ?
> >
> > 1) Are you sure signtool allows to sign Java2 applets (which run with
> > Java Plug-in) ?
> >
> > 2) I have imported certificate to the Netscape. Do I have to do
> > something else
> > (for Java Plug-in) ?
> >
> > 3) I have also tried to generate a certificate and sign with it, but
> > getting exception:
> > SecurityException: cannot verify signature block file META-INF/ZIGBERT
> > Any ideas ?
> >
> > 4) I have tried to use jarsigner, but it always throws exception
> > ZipException: invalid entry compressed size (expected <X> but got <X-3>
> > bytes)
> > (different entries for different applets).
> >
> > Any suggestions ?
> >
> > Thank you in advance,
> > Oleg.
> >
> > P.S.: Please reply via e-mail also.
>

Keene Hammond wrote:

> I have successfully signed many applets granting them universal connect.
> There are two thing you should consider;
> 1. The code signing certificates from verisign are browser specific; for
> Internet Explorer or for Netscape not either or.

Not exactly ... depending on the code-signing certificate issuer, the
SAME certificate may be used for BOTH browsers; Thawte offers
such a certificate (or used to). The idea is you import the cert into
IE, export it as a pkcs#12 secure file object (containing your public
certificate AND private key, password protected), and then import
it into your Netscape browser security manager interface. Then, you
can sign code with IE (using signcode etc..) or Netscape (using signtool).
Examples of this are at:
  http://home.istar.ca/~neutron/java.html
Cheers,
 -- Mitch


>
> 2. When you grant the "privilege" it is only valid in that context and it
> goes out of scope and the "privilege" is lost.