Replace Java Web Start with alternative app deployment platform

[Kevin Milner]

Oracle has slowly crippled Java Web Start as a delivery platform for full featured applications. The final straw is that the latest Java 8 releases require users to manually enter our domain (opensha.usc.edu) as a whitelisted software source in their Java control panel for any of our applications to run.

There are apparently some new deployment capabilities with JavaFX which I will investigate, and someone recommended Getdown to me.

[Kevin Milner]

I have tested JavaFX deployment and found the following:

Pros:

• Easily integrated with existing application structure
• Can easily create native launchers/installers
  • These bundle the JRE with the application so users don't even have to install Java
  • Much larger than jar only distributions (as the JRE is about 60 MB zipped)
• Can work with java web start/create JNLP files

Cons:

• Requires either additional library or standardizing on Java 8
• Requires that builds for a specific platform be done on that platform. So if we want to build OSX DMG files, the build has to be done on an OSX machine. Not easily automated in our build process (which runs on linux)
• Same certificate issues if we use the web start/JNLP functionality

So, this could be a valid deployment strategy if we are willing to manually build apps for each platform on each release. We would then just supply jar files for nightly builds. It's a bit of a headache though compared to java web start which could be deployed automatically.

An alternative might just be to get a valid, recognized certificate and use that to sign our applications. Then Java Web Start should begin to work again.

[Kevin Milner]

So I'm thinking that the easiest solution might be to just get an SSL certificate. John Yu says that we can get one that will work for $140/yr. This would keep our current build process working (with some minor adjustments), and should make Java Web Start workable again. Thoughts?

[Peter Powers]

When in doubt, throw a little money at the problem. ;-)
Could we also just revert to having people download double-clickable jars, much like they would do with nightly builds anyway?

[Kevin Milner]

Yeah that could work. We would loose the ability to set the memory allocation, but that might actually be a good thing now that systems have more memory and Java will default to using more of it. Back in the day the default would typically be too small. It certainly is the simplest option. Does double clicking jars work out of the box on Mac OSX?

[Peter Powers]

I'm not sure what happens on OS X if you don't have java installed; probably nothing. I'd imagine its the same for Win/Linux?. Ned is ambivalent; I'd get the certificate and see if that improves things. If it doesn't, we'll go back to jars, but that will require some time relearning and reconfiguring drupal to trigger file downloads.

[Kevin Milner]

Good news - John Yu just discovered that USC's umbrella certificate can sign any *.usc.edu certificate for free, so we'll do that. The app URLs are already opensha.usc.edu (as opposed to opensha.org) so this will be a somewhat easy change.