Netscape signtool 1.3 problem

[Sruli Ganor]

Hi Netscape gurus,

I'ne just installed Netscape 7.0 to my Windows PC and I'm trying to
sign JavaScripts, but get errors right on the beginning. Can anyone
tell me what am I doing wrong?

I went to Edit->Preferences->Software Security Device->Change Password
and set my password. Then I copied the updated cert7.db and key3.db to
my folder signdir. Now I do:

cd signdir
signtool -L

Alas, I get this:

using certificate directory: .
S Certificates
- ------------
You don't appear to have any object signing certificates.

Please help.

Thanks in advance
Sruli Ganor

 

[Grant Wagner]

Hi Netscape gurus,

I'ne just installed Netscape 7.0 to my Windows PC and I'm trying to
sign JavaScripts, but get errors right on the beginning. Can anyone
tell me what am I doing wrong?

I went to Edit->Preferences->Software Security Device->Change Password
and set my password. Then I copied the updated cert7.db and key3.db to
my folder signdir. Now I do:


Alas, I get this:

using certificate directory: .
S Certificates
- ------------
You don't appear to have any object signing certificates.

Please help.

Thanks in advance
Sruli Ganor

If I had to guess I'd say that "You don't appear to have any object
signing certificates".

Have you purchased a signing certificate from VeriSign or Thawte (or any
other signing authority)?

--
| Grant Wagner <[email protected]>

* Client-side Javascript and Netscape 4 DOM Reference available at:
*
http://devedge.netscape.com/library/manuals/2000/javascript/1.3/reference/frames.html

* Internet Explorer DOM Reference available at:
*
http://msdn.microsoft.com/workshop/author/dhtml/reference/dhtml_reference_entry.asp

* Netscape 6/7 DOM Reference available at:
* http://www.mozilla.org/docs/dom/domref/
* Tips for upgrading JavaScript for Netscape 6/7 and Mozilla
* http://www.mozilla.org/docs/web-developer/upgrade_2.html

 

[Sruli Ganor]

If I had to guess I'd say that "You don't appear to have any object
signing certificates".

Have you purchased a signing certificate from VeriSign or Thawte (or any
other signing authority)?

I have not purchased such a certificate yet, but the point is the
signtool -L is supposed to show me all the installed certificates,
including CA certificates, and only mark with '*' the object signing
certificates. I was worried that signtool didn't even show me the CA
certificates.

After generating a self-signed certificate, signtool -L worked
correctly and showed me all the CA certificates. This still seems like
a misbehaviour of signtool.

Our major target is to sign HTML pages containing JavaScript functions
that call Java functions included in a jar. The Java functions access
local resources (e.g., getProperties()) and therefore the JavaScript
must be signed (a burden that does not exist in Internet Explorer,
thanks God and MicroSoft).
We have read dozens of articles and examples how to do it, and
signtool apperas to sign correctly but still the JavaScript functions
fails with Access Denied exceptions. Do you know of a working example
or instructions how to do it?

Thanks in advance
Sruli Ganor

 

[Sruli Ganor]

You might want to try IBM's tool. see
http://mindprod.com/jgloss/keyman.html

I tried it but in vain. It appears that there is a bug in the current
mozilla/netscape and java combination. The bug is registered in the
bugzilla. It does not look like it will be solved soon.
http://developer.java.sun.com/developer/bugParade/bugs/4857726.html

This means that I cannot sign Netscape JavaScripts at all.
Why does Netscape require to sign scripts that call privileges Java
jar functions, while Microsoft Explorer only requires to sign the jar?

Is this one of the reasons why Microsoft Explorer is more popular?

Sruli Ganor

 

[Michel Gallant]

This means that I cannot sign Netscape JavaScripts at all.
Why does Netscape require to sign scripts that call privileges Java
jar functions, while Microsoft Explorer only requires to sign the jar?

Actually, if there are privileged operations performed within a public
method of a Java applet signed into a cab file, and that public method
is accessed by IE JScript/VBScript, then the developer must explicit
assert the permission within his public method .. which effectively means
that the code-author vouches that a malicious script cannot leverage his/her
applet for mal-use.

Netscape JVM does not have such a model, and thus requires that the script itself
be signed.
I agree, scripted acces of priviled NN java methods is not working properly in
recent releases.
- Michel Gallant
http://pages.istar.ca/~neutron/Thawte

 

[Sruli Ganor]

Actually, if there are privileged operations performed within a public
method of a Java applet signed into a cab file, and that public method
is accessed by IE JScript/VBScript, then the developer must explicit
assert the permission within his public method.

My Java applet is signed into a jar file, and the scripts are
JavaScript.
In this case signing the applet is sufficient, and no permission
assertion is required for running in IE. Does this expose any security
hole?

Sruli Ganor