More webstart code-signing changes #2193

manics · 2014-03-21T14:24:10Z

Add a Trusted-Only attribute to manifest. I think this helps avoids additional warnings in Insight webstart. When testing locally it didn't affect the running of the standard Insight client, but this should be tested more widely. Also disable automatic self-signing. See commit messages for more info.

Testing: check insight still fully works. Check the unsigned server works. Then we can try signing webstart with the proper certificate and redeploying.

@bpindelski Do you know anything about the impact (good or bad) of Trusted-Only?

See http://docs.oracle.com/javase/6/docs/technotes/guides/jweb/mixed_code.html#trusted_only

We're going to be code-signing in a separate process, so this prevents jars being double-signed, once with the self-signed cert and once with a proper one. The webstart-sign target is still there, so you can use `./build.py webstart-sign release-webstart`.

bpindelski · 2014-03-21T19:31:56Z

I've not used that manifest field, so can't say much. Reading through the Java doc, it looks sensible to use it.

bpindelski · 2014-03-24T11:23:37Z

The (now) unsigned Insight from gretzky doesn't work - the addition of Trusted-Only causes the JVM to throw an exception on the unsigned Insight JAR it is trying to run. Looking again at the two commits - they seem to contradict each other. This isn't a good place to be and I anticipate some confusion from developers for whom webstart stopped working. Will our OME key be also used to sign artefacts deployed to our test servers (gretzky, trout etc.)?

manics · 2014-03-24T11:44:50Z

I took webstart-sign out because it uses the self-signed cert included in the source tree: https://github.com/manics/openmicroscopy/blob/c6857e3d8e5ebc154e1bda81260582a37e33ab44/lib/keystore which I don't think is useful to anyone. I think the plan is to sign our releases in a separate manual step with the proper key which is kept under tight security, and to sign daily builds with a cert from a self-signed root CA (which can be distributed and installed by all OME developers), using an analagous but automated process.

Webstart hasn't worked for me for ages, I can revert Trusted-Only if you think it's going to cause too much trouble.

bpindelski · 2014-03-24T12:01:05Z

I fully understand why you took out the webstart-sign step out of the build, but I think we have to look again at the implications of that decision.

Today I cannot run webstart from gretzky at all (I can run webstart from trout, as I can add the URL to my Java security settings; that's probably the only positive side of the self-signed cert. This won't work for Trusted-Only though). In a hypothetical scenario where the team would need to work on an emergency release (which happened a couple of times in the past), testing webstart on gretzky would be blocked with this PR in.

I'd suggest coordinating with the team, so that downtime for the deployed systems is minimal and so that we don't slow down the daily testing process.

Summing up - changes here are OK and it's good to merge, but if I were in your place, I'd exclude this PR until the signing setup is in place and the switch can happen overnight.

joshmoore · 2014-03-24T12:59:30Z

build.xml

@@ -1022,7 +1022,6 @@ omero.version=${omero.version}
        </copy>
        <copy file="components/insight/OUT/dist/omero.insight.jar" tofile="${dist.dir}/lib/insight/omero.insight.jar"/>
        <copy file="components/insight/SRC/org/openmicroscopy/shoola/env/ui/graphx/omeabout-bk.png" tofile="${dist.dir}/lib/insight/ome.png"/>
-        <antcall target="webstart-sign" inheritAll="true" inheritRefs="true"/>


release-all will likely need to be updated with this change. What's the reasoning? Is this no longer supported?

If we're going to do the signing in a separate process the jars will end up with two signatures (jarsign doesn't remove an existing one).

webstart-sign was only called from release-webstart, so I don't think release-all needs changing.

manics · 2014-03-24T14:38:33Z

Another option would be to re-pack the jars into a single one during the external signing process, which would also get around the problems with timestamp server throttling.

sbesson · 2014-03-24T14:39:34Z

Labelled as breaking.

joshmoore · 2014-03-25T05:11:52Z

@manics: no real objection to an omero_webstart.jar or similar if that will solve further problems. Alternatives would be to call it omero_all.jar (maven-esque) or omero_package.jar (to match Bio-Formats) so that when we do proper shadowing, the jar is more widely usable than just webstart.

manics · 2014-03-30T17:43:15Z

As discussed on Friday I'll make the signing script run as part of the standard merge build, can someone remove the breaking label?

sbesson · 2014-03-30T18:05:00Z

Done

Automatically run this script with the existing self-signed certificate as part of the standard docs/hudson/OMERO.sh build

sbesson · 2014-03-31T07:44:23Z

Failed http://ci.openmicroscopy.org/job/OMERO-5.0-merge-daily/617/console. Excluding.

manics · 2014-03-31T08:51:34Z

zip isn't installed on gretzky. I've been meaning to get the Python zipfile module working to reduce external dependencies, especially in omego, but not right now.

manics · 2014-03-31T10:40:07Z

Unexclude and rebuild gretzky at some point?

manics · 2014-03-31T17:20:11Z

Since Gretzky runs from dist (and not by deploying the OMERO.server-*.zip artifact) the deployed server isn't signed, so I've added
docs/hudson/omero_insight_sign.py lib/keystore omedev dist -kp omedev -cp omedev -ts no
to http://ci.openmicroscopy.org/job/OMERO-5.0-merge-daily/

manics · 2014-04-01T08:47:42Z

@bpindelski Do you mind having a quick check of today's OMERO-5.0-merge server build? webstart should be using the original self-signed cert, but with Trusted-Only: true in the manifest.

bpindelski · 2014-04-01T09:34:32Z

@manics Webstart works fine today on gretzky, thanks.

More webstart code-signing changes (merging for `5.0.1`)

manics · 2014-04-01T13:22:13Z

--rebased-to #2238

manics · 2014-04-16T17:23:18Z

--rebased-to #2321

manics added 2 commits March 21, 2014 11:52

Add Trusted-Only:true to the Insight manifest.

c6857e3

See http://docs.oracle.com/javase/6/docs/technotes/guides/jweb/mixed_code.html#trusted_only

manics changed the title ~~More webstart codesigning tweaks~~ More webstart codesigning changes Mar 21, 2014

manics changed the title ~~More webstart codesigning changes~~ More webstart code-signing changes Mar 21, 2014

jburel added the dev_5_0 label Mar 21, 2014

joshmoore reviewed Mar 24, 2014
View reviewed changes

sbesson added the breaking label Mar 24, 2014

sbesson removed the breaking label Mar 30, 2014

Add an external webstart signing script

1849e54

Automatically run this script with the existing self-signed certificate as part of the standard docs/hudson/OMERO.sh build

sbesson added the exclude label Mar 31, 2014

sbesson removed the exclude label Mar 31, 2014

sbesson added this to the 5.0.1 milestone Apr 1, 2014

joshmoore added a commit that referenced this pull request Apr 1, 2014

Merge pull request #2193 from manics/more_webstart_codesigning_tweaks

221236a

More webstart code-signing changes (merging for `5.0.1`)

joshmoore merged commit 221236a into ome:dev_5_0 Apr 1, 2014

manics mentioned this pull request Apr 1, 2014

Webstart code-signing 4.4 #2238

Merged

manics deleted the more_webstart_codesigning_tweaks branch April 1, 2014 15:16

This was referenced Apr 1, 2014

Run the code-signing script from the target dir #2241

Merged

Even more webstart codesigning changes #2271

Merged

manics mentioned this pull request Apr 16, 2014

All other remaining webstart code-signing changes (rebased onto develop) #2321

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

More webstart code-signing changes #2193

More webstart code-signing changes #2193

manics commented Mar 21, 2014

bpindelski commented Mar 21, 2014

bpindelski commented Mar 24, 2014

manics commented Mar 24, 2014

bpindelski commented Mar 24, 2014

joshmoore Mar 24, 2014

manics Mar 24, 2014

manics commented Mar 24, 2014

sbesson commented Mar 24, 2014

joshmoore commented Mar 25, 2014

manics commented Mar 30, 2014

sbesson commented Mar 30, 2014

sbesson commented Mar 31, 2014

manics commented Mar 31, 2014

manics commented Mar 31, 2014

manics commented Mar 31, 2014

manics commented Apr 1, 2014

bpindelski commented Apr 1, 2014

manics commented Apr 1, 2014

manics commented Apr 16, 2014

More webstart code-signing changes #2193

More webstart code-signing changes #2193

Conversation

manics commented Mar 21, 2014

bpindelski commented Mar 21, 2014

bpindelski commented Mar 24, 2014

manics commented Mar 24, 2014

bpindelski commented Mar 24, 2014

joshmoore Mar 24, 2014

Choose a reason for hiding this comment

manics Mar 24, 2014

Choose a reason for hiding this comment

manics commented Mar 24, 2014

sbesson commented Mar 24, 2014

joshmoore commented Mar 25, 2014

manics commented Mar 30, 2014

sbesson commented Mar 30, 2014

sbesson commented Mar 31, 2014

manics commented Mar 31, 2014

manics commented Mar 31, 2014

manics commented Mar 31, 2014

manics commented Apr 1, 2014

bpindelski commented Apr 1, 2014

manics commented Apr 1, 2014

manics commented Apr 16, 2014