openmicroscopy/openmicroscopy — pull request #2121 by manics (2014-02-24 10:05:28+00:00)
Title: Insight manifest changes for webstart #11772 (rebased onto develop)

This is the same as gh-2069 but rebased onto develop.

----

Add Permissions tag (required for webstart) and a couple others to the insight manifest.

Testing: not easy, you'll either need to create your own root CA, or use an existing one (the latter is probably better since it more closely reflects the situation if we obtain an official code-signing cert)... instructions below. At the very least non-webstart Insight should build and work normally.

```
./build.py

./build.py release-webstart \
-Djarsign.keystore=/Volumes/ome/team/simon/code-signing/store.jks \
-Djarsign.alias=testcodesign \
-Djarsign.storepassfile=/Volumes/ome/team/simon/code-signing/store.passwd
```

Import the root CA certificate into the Java certificate store:
Open the Java Control Panel (via System Preferences on OS X), Security, Manage Certificates. Select Signer CA, User, Import, Select `/Volumes/ome/team/simon/code-signing/ca.p12`

Now start the server and web, and attempt to launch Insight webstart. You should get one or more dialogs, they should show OMERO.Insight instead of an unfriendly classname and the Publisher should not be Unknown.

Note the code-signing certificate should **not** be imported, if the root CA has been imported and the jar signing succeeded there should be a certificate chain leading up to the root.

Timestamping uses http://time.certum.pl by default. It involves one request per signed jar, http://www.certum.eu/certum/cert,offer_time_stamp.xml (non-qualified) doesn't say anything about limits.

This of course assumes you haven't already added a workaround/exception for Java, if you're unsure try running webstart without this PR and/or without signing the jars and/or without importing the root CA, and compare the dialogs. On the latest Java (`1.7.0_51`) with default security settings you should not be allowed to run webstart at all without this PR and signing, on older versions you should get a warning.

This will not work if the Java security settings have been changed to the highest level as there isn't an OCSP responder for checking whether the certificate has been revoked.

It's also worth seeing whether this can be built on one server and deployed on another. `Codebase=*` which in theory means it can run anywhere.

/cc @stick