* Victor Denisov <vdenisov at redline.ru> [2006-03-07 19:40:39]: > > Nextgens has created a really nice GUI installer for Freenet using > > JavaWebStart. Unfortunately, it is not able to produce a desktop/start > > menu icon and is therefore a regression over the old wininstaller on > > Windows. He is now looking at other options; JWS can create an icon, but > > it points to itself, so we will probably make the node self-installing, > > with web config... > > There are a couple of issues why I'm hesitant about Java Web Start and > JNLP in general, as applied to Freenet. Below is just my IMHO, based on > recent experience developing a relatively large application launched via > JNLP (I haven't tested Freenets' installer, yet): > > 1. JNLP apps should be signed if they are to have total access to the > end user's system. Moreover, _all_ jars downloaded by the app should be > signed as well, or placed in the Java's lib directory manually by the > user. This applies _specifically_ to all native libraries. Unsigned JNLP > apps run in a sandbox similar to applets.
Yes, could be signed with a self-signed certificate as it's now. > > 2. There's no way to guarantee a certain application path (for example, > to keep the log file). The place where JNLP-installed application will > reside is entirely implementation-dependent and is (usually) not obvious > to the user. > agreed, that's the main issue > 3. JNLP insures that app files are up-to-date on each application > launch, and forces updates if necessary. If general, JNLP gives user > _absolutely_ no choice as to what version will be installed. What if in > the future, Freenet's site will become compromised and an "evilly" > modified version will silently get installed on _all_ of the users' > computers when Freenet is next launched? > well as they are signed :/ was the old wininstaller asking for a grant ? > 4. There's no simple way to transfer JVM parameters to a JNLP-launched > app, save for a very limited set. > There is a JvmArg parameter or something like that > What could be created is a JNLP installer/wrapper (such as the one from > http://www.duckcreeksoftware.com, which is freely available for > non-profit projects, BTW). It can then allow a choice between several > different versions, optional libraries, etc. But if we're going to do > this, why not use something like IzPack? Well, that's basically what ant-installer was supposed to do :) IzPack looks nicer :) NextGen$ -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 189 bytes Desc: Digital signature URL: <https://emu.freenetproject.org/pipermail/devl/attachments/20060307/f8cb8cf8/attachment.pgp>
