Karakun Support Forums

We are happy to announce the release of OpenWebStart v1.14.0

https://github.com/karakun/OpenWebStart/releases

- OpenWebStart Team at Karakun

OWS does not work with Java 23+ : please see https://github.com/karakun/OpenWebStart/issues/621 .

With Java23, URLJarFileCallBack was removed and with Java 24 the SecurityManager has been removed. for the former a workaround implementation can be found but for the latter an option is to run OWS ...

Release 1.14.0 should happen by mid June.

I had a look at https://www.uscourts.cavc.gov/documents/Web_Start_Configure-Win10.pdf.

The applet does not run in a browser (Edge or Chrome). In the browser you can download the k2ajnlp.jsp which is associated with Oracle Java Web Start to run the applet as a stand alone Java application using ...

Your Jnlp file specifies that your Java application is an applet : <applet-desc...

OWS does not support applet. Browsers have stopped supporting Java plugin that would run applets.

You say the it is working with Oracle Java. In which browser are you running the applet?

I was able to run snyk test locally on OWS and ITW codebase and it has generated reports. Will try to fix the vulnerabilities.

@Janak - I have a similar concerns as John above. Based on my own experience, these seem to be consistent with the results I see for OpenWebStart using Snyk as the SAST. Would you be still be willing to verify and fix the findings, as offered above? Would love to have these issues resolved ...

We will include this in the next release, scheduled for the end of May,

1. So you were able to install OWS successfully.

2. Then you launched your Jnlp file with OWS.

3. OWS downloads resources and verifies the signing certificate and show the Security Dialog asking to trust the application.

4. You choose "Always Trust" and click on the Run button.

5. Your ...

Hi,

Just to clarify:

1. You installed OWS by running the installer OpenWebStart_windows-x64-x64_1_13_0.exe

2. Your are saying that during the last step of installation " it says that a page will open so it can be marked as trusted and so on"
I am not clear about this. The last screen of installer ...

Thanks for suggesting Snyk. We will verify and fix.

In addition to the VM arguments specified in the JNLP file, you can provide additional arguments through the environment variable JAVAWS_VM_ARGS. If any argument you add is not included in the list of valid VM arguments recognized by OWS, it must first be added to the JVM argument whitelist in the ...

You can pass a JVM argument to the JVM that starts the App specified in the Jnlp file in the following ways:

1. In the Jnlp file:


<<j2se version="1.8*" java-vm-args="-Dawt.useSystemAAFontSettings=lcd"/>


2. In the env var JAVAWS_VM_ARGS

3. You can specify JVM args for a particular Jnlp file ...

When OWS is run for the first time it creates C:\Users\USERNAME.config\icedtea-web and C:\Users\USERNAME.cache\icedtea-web directories and files under them. So, when OWS has never been executed before on a machine and two Jnlps are started simultaneously with OWS, race conditions can occur when the ...

Happy that it works. Thanks for letting us know.

There seems to be a race condition. Trying to reproduce and fix.

Firstly, this is a public forum, so any log files you attach can be seen by others. Make sure they don’t include anything sensitive before posting. You get a private forum when you buy support: https://openwebstart.com/support/

OWS downloads jar files specified in the Jnlp file. However, some jar ...

To make OWS compatible with Java 25 is going to be a major effort as some classes on which OWS depends have been removed from Java 23 and 24. Given our limited resources, we will undertake the effort only if we have adequate sponsorship from the users of OWS.

Can you please tell me which company do ...

Hi John,

Can you please tell me which SAST tool was used So that I can also check for myself, do the fixes and verify them by running the tool again?

Thanks

Sure we can provide a statement.

Can you please tell me :

Which company do you belong to?
Which company/group is interested in the vulnerability report?
Which tool was used to produce the report? Is the tool available in github?
Was the tool run from within github on the codebase in github?
Was ...