W:Blut

Robustness of geo­met­ric algo­rithms is a prime con­cern in my hemesh library. It is sur­pris­ing how fast the intri­ca­cies of floating-point cal­cu­la­tions crop up and ren­der your code fickle and buggy. It’s easy to for­get that com­puter math is not the same as reg­u­lar math. Rather, it is a dis­crete limited-domain sim­u­la­tion of real mathematics.

I’m cur­rently adding some new plumb­ing to hemesh using an arbi­trary pre­ci­sion library, Apfloat. because it’s a lot slower it is only called when nec­es­sary. Including it had an unex­pected side-effect. Apfloat requires infor­ma­tion about your sys­tem when it’s run­ning in a browser. It needs your machine’s inher­ent precision.

However, access­ing your com­puter is a big no-no for my code. So unless the applets are signed, they won’t run because of secu­rity restric­tions. In itself, this is not really a prob­lem, we can still share code and show each other images. But I’d rather keep shar­ing applets, these always include the cor­rect libraries and often rely on unre­leased alpha-level mod­i­fi­ca­tions of my library.

I can’t claim a proper under­stand­ing of Java secu­rity issues and all details about sign­ing. But I’ve been look­ing around and gath­ered masses of raw data, info-ore. I’ve smelted it down to an ingot of use­ful­ness. In short, this is how you sign a Processing applet with­out know­ing what you’re doing. On a Windows machine… (don’t be too dis­ap­pointed, the essen­tials are the same on hip­ster machines.)

Preparations

1) First locate your Java Development Kit (JDK) dis­tri­b­u­tion. If you’re using Eclipse, or pro­gram in JAVA, you prob­a­bly have one around some­where. If not, Processing has it included in its \java sub­di­rec­tory. Check out the con­tents of the \bin folder. See all those exe­cuta­bles, we’ll be using a few of those. Let’s say you traced your JDK to c:\processing\java. So any­where the text men­tions c:\processing\java\bin sub­sti­tute this with your own location.

2) Include the \bin sub­di­rec­tory in your system’s PATH. Check this if you aren’t sure how, of course use c:\processing\java\bin instead of the Matlab exam­ple. This’ll save you a lot of typ­ing. The exe­cuta­bles in the bin folder can now be called from any directory.

3) Create a folder to store your key­store, the repos­i­tory for your cer­tifi­cates. I’ll be using c:\keystore.

Creating your certificate

4) Open up a com­mand prompt (press windows+r, type cmd). If you set up the PATH prop­erly, you can access the com­mands we’ll be using any­where. Otherwise you’ll have to call them with their full path… We’ll cre­ate a key­store and a first cer­tifi­cate mykey now. Since our keys will be self-certified only (i.e. no cer­ti­fy­ing agency will vouch for your good inten­tions), we’ll give them a valid­ity of 100 years. That should be enough…

keytool -genkey -keystore c:\keystore\mykeystore.jks -alias mykey -validity 36500

Since this is the first time the key­store is accessed, you’ll need to input some impor­tant info. Just choose a decent key­store pass­word (let’s say passw0rd ;) ) and fill in the rest. After fill­ing in your data, key­tool will ask for the key pass­word. You can keep this the same as the key­store pass­word, just enter and fin­ish. You now have a key­store with a sin­gle cer­tifi­cate mykey in it.

5) Now we’ll make the cer­tifi­cate self-certified. It’s up to the end-user whether or not he’ll trust your applet.

keytool -selfcert -keystore c:\keystore\mykeystore.jks -alias mykey

Signing your applet

6) I now have an applet I want to share and that requires sign­ing:c:\sketchbook\condel. First export the applet. The /applet sub­di­rec­tory now con­tains all Java archives (JAR) asso­ci­ated with your sketch. We’ll need to sign all of them, even if only one requires authentication.

7) Re-open the com­mand win­dow if nec­es­sary and nav­i­gate to c:\sketchbook\condel\applet. For every JAR run this:
jarsigner -keystore c:\keystore\mykeystore.jks -storepass passw0rd -keypass passw0rd core.jar mykey

In my case, I have core.jar, hemesh.jar, apfloat.jar and sev­eral oth­ers I’ll need to sign.

8) Done! You can upload the applet. If some­body accesses the page she will be given the choice of trust­ing the applet. If yes, then the applet will run. If no, then it won’t.… I’ve cre­ated condel this way.