What’s new in 1.0.6 and 1.1.4:

• RH742515, CVE-2011-3377: IcedTea-Web: second-level domain subdomains and suffix domain SOP bypass

The following people helped with this release:
Omair Majid

Checksums:
44a770da85fd2e342ab09e065798a07d04601ea51879df4a5e88f804e4f02eba icedtea-web-1.0.6.tar.gz
b17a742af0153b7887cf667a160f8519afad125bc515b0f4783c66e7ee1a7f26 icedtea-web-1.1.4.tar.gz

Download links:
http://icedtea.classpath.org/download/source/icedtea-web-1.0.6.tar.gz
http://icedtea.classpath.org/download/source/icedtea-web-1.1.4.tar.gz

After extracting, it can be built as per instructions here:
http://icedtea.classpath.org/wiki/IcedTea-Web#Building_IcedTea-Web

IcedTea-Web 1.0.5
IcedTea-Web 1.1.3

These are maintenance releases and the main motivation for pushing the releases is to make the Elluminate Web Start application work again.

Fixes in 1.0.5:

• Plug-in:
• PR749: sun.applet.PluginStreamHandler#handleMessage(String) really slow
• Common:
• PR768: Signed applets/Web Start apps don’t work with OpenJDK7 and up
• PR794: IcedTea-Web does not work if a Web Start app jar has a Class-Path element in the manifest (e.g. Elluminate)

Fixes in 1.1.3:

• Plug-in:
• PR782: Support building against npapi-sdk as well
• Common:
• PR794: IcedTea-Web does not work if a Web Start app jar has a Class-Path element in the manifest (e.g. Elluminate)

Build instructions are here:
http://icedtea.classpath.org/wiki/IcedTea-Web#Building_IcedTea-Web

SHA256 sums:
ccfed2fc6fadf6ce42df43558252b0f02a8f5ed99c24e3eb64b4ca0e0d82a6c2 icedtea-web-1.0.5.tar.gz
012390dfa8bb9a4b17b30640dfc21011c848f5017d2a21d945e933f5d514edb3 icedtea-web-1.1.3.tar.gz

Thanks to Omair Majid for help with this release!

This is a maintenance release and contains bug fixes. Furthermore, this release also adds support for use with Java 7 (IcedTea7).

Fixes include:

• Plug-in:
• PR749: sun.applet.PluginStreamHandler#handleMessage(String) really slow
• RH718693: MindTerm SSH Applet doesn’t work
• Common:
• PR768: Signed applets/Web Start apps don’t work with OpenJDK7 and up
• PR769: IcedTea-Web does not work with some ssl sites with OpenJDK7
• RH734081: Javaws cannot use proxy settings from Firefox
• New (--with-jre-home=) option to allow use with only JRE installed

Available for download here:
http://icedtea.classpath.org/download/source/icedtea-web-1.1.2.tar.gz

Build instructions are here:
http://icedtea.classpath.org/wiki/IcedTea-Web#Building_IcedTea-Web

SHA256 sum:
3051f3bf1e1d07ad7aaa28b204821a7c0631848d20ba7942fc23440e774649e4 icedtea-web-1.1.2.tar.gz

Thanks to Omair Majid for help with this release!

What’s new in 1.0.4 and 1.1.1:

RH718164, CVE-2011-2513: Home directory path disclosure to untrusted applications
RH718170, CVE-2011-2514: Java Web Start security warning dialog manipulation

The following people helped with this release:
Omair Majid

Checksums:
d3e841be0cca8daef70404df5fdfe678559e1b12cd0ae3d658da68f61ab888e1 icedtea-web-1.0.4.tar.gz
0051005302e698f2468e6cae275b8c58869c85be04c269f2f266389a4e6a66c7 icedtea-web-1.1.1.tar.gz

Download links:
http://icedtea.classpath.org/download/source/icedtea-web-1.0.4.tar.gz
http://icedtea.classpath.org/download/source/icedtea-web-1.1.1.tar.gz

After extracting, it can be built as per instructions here:
http://icedtea.classpath.org/wiki/IcedTea-Web#Building_IcedTea-Web

This is a regular maintenance release and contains some nice-to-have plugin bug fixes:

• PR721: IcedTeaPlugin.so cannot run g_main_context_iteration on a different thread unless a different GMainContext *context is used
• PR735: Firefox 4 sometimes freezes if the applet calls showDocument()
• RH691259: Midori sends a SIGSEGV with the IcedTea NP Plugin

If you are using IcedTea-Web 1.0.x with Firefox, it is recommended that you update to 1.0.3 as it is significantly more stable on Firefox 4.

Available for download here:
http://icedtea.classpath.org/download/source/icedtea-web-1.0.3.tar.gz

Build instructions are here:
http://icedtea.classpath.org/wiki/IcedTea-Web#Building_IcedTea-Web

SHA256 sum:
2a3b907b471a67fdbae4ecc80b8425dfc7533e91f63f622d91501d4a64f07581 icedtea-web-1.0.3.tar.gz

Thanks to Omair Majid for helping with this release (patch reviews)!

New features:

• IcedTea-Web now installs to a FHS-compliant location
• Binary launchers have been replaced with simple shell scripts
• Proxy Auto Config files are now usable
• Applications using jnlp.versionEnabled and jnlp.packEnabled are now supported
• Can now use codebase_lookup=false with applets
• itweb-settings now supports clearing cache

Fixes:

• Common:
• Mercurial revision detection (when building) is now more reliable
• Apps calling loadClass get a proper a ClassNotFoundException if class is not found, rather than a null value
• Applets and JNLP apps using SSL/TLS now function correctly

• Web Start implementation (javaws):
• The Web Start implementation can now use proxy settings from Firefox
• Web Start applications now use the correct default browser set by the user
• Closing javaws -about no longer throws exceptions
• Cache files are removed properly

• Plug-in:
• Applets from the same page to use the same classloader (MS LiveMeeting, www.uk.map24.com, etc.)
• NetDania banking application now works
• Sound now works with runescape.com
• Firefox 4 no longer freezes if the applet calls showDocument()
• Firefox 4 and chromium stability has been vastly improved with a rewrite of the plug-in threading model

Full notes with bug ids are available in the NEWS file:
http://icedtea.classpath.org/hg/release/icedtea-web-1.1/file/ff05275397ca/NEWS

Available for download here:
http://icedtea.classpath.org/download/source/icedtea-web-1.1.tar.gz

Build instructions are here:
http://icedtea.classpath.org/wiki/IcedTea-Web#Building_IcedTea-Web

SHA256 sum:
9ab60926f5d455d51e8e62120f71a12b1f18b20f599477d55dd71282a8055675 icedtea-web-1.1.tar.gz

Thanks to everyone who helped with this release:
Andrew Hughes
Matthias Klose
Denis Lila
Omair Majid
Andrew Su
Jiri Vanek
Mark Wielaard

At the time of writing this, the latest version of JDK6 (the proprietary Oracle version) is u25. The latest OpenJDK6 release right now is b22. So what is going on? Why is OpenJDK6 so far behind JDK6? Well, it is not.

The uXX numbering for the proprietary JDK is completely unrelated to the bYY releases of OpenJDK and any comparison of the two is meaningless. This image (taken from my RedHat Summit 2011 slides) explains how OpenJDK6 came into being:

The filled arrows going between JDK7 and OpenJDK7 indicate that the two sources are very similar (about 95% according to the last heard count). The empty arrows between OpenJDK7 and OpenJDK6 indicate backports.

OpenJDK6 was created from OpenJDK7 by removing Java 7 specific items from the code. Development of OpenJDK6 today largely consists of backporting fixes from OpenJDK7 and keeping security fixes up-to-date.

In terms of bug fixes, a comparison is not easily possible because the code bases differ and a bug that manifests in JDK6 may not manifest in OpenJDK6 and vice versa. OpenJDK6 bugs are fixed as they are encountered/reported.

In terms of features, JDK6 is in maintenance mode and therefore does not add features in its updates. The same applies to OpenJDK6. If any feature/API change were to be made to JDK6 in the future, OpenJDK6 would follow suite accordingly.

So the next time you see a higher update number of _either_ of JDK6 or OpenJDK6, promptly ignore it because it is like comparing apples and oranges

The slides are available on-line here.

As mentioned on slide 3 there, the slides were designed to be used in an audio-heavy presentation (with less text, more images). For guidance, they have draft quality notes at the end.

If you are the adventurous type and would like to help us try/test it, checkout, build and usage instructions are here:
http://icedtea.classpath.org/wiki/?title=IcedTea-Web#Getting_IcedTea-Web

Instead of checking out from http://icedtea.classpath.org/hg/icedtea-web (trunk), just use http://icedtea.classpath.org/hg/release/icedtea-web-1.1/

The 1.1 release is tentatively scheduled for May 6th 2011 and we will be fixing any major issues found, until then.

IcedTea-Web 1.0.2 has been released! This is a maintenance release that contains some important bug fixes.

What’s new in 1.0.2:

• PR638: JNLPClassLoader.loadClass(String name) can return null
• RH677772: NoSuchAlgorithmException using SSL/TLS in javaws
• PR612: NetDania application ends on java.security.AccessControlException: access denied (java.util.PropertyPermission browser read)
• Binary PDF documentation has been replaced with an editable HTML vesion

The following people helped with this release:
Mark Greenwood <mark _at_ dcs.shef.ac.uk> (code), Andrew John Hughes (code), Omair Majid (code)

SHA256 Checksum:
aa836e4c350eaaf3a3f474522ec47069f9b71c02ce59e8dd3d79881edb15115c  icedtea-web-1.0.2.tar.gz

Download link:
http://icedtea.classpath.org/download/source/icedtea-web-1.0.2.tar.gz

After extracting (tar xzf icedtea-web-1.0.2.tar.gz),  it can be built as per instructions here:
http://icedtea.classpath.org/wiki/IcedTea-Web#Building_IcedTea-Web