In previous release of Java Plug-in, it recognized the RSA signed applet using Netscape signtool. However, in Merlin, loading any applet signed by Netscape signtool will result in the following exception:

java.lang.SecurityException: cannot verify signature block file META-INF/ZIGBERT

at sun.security.util.SignatureFileVerifier.process(SignatureFileVerifier.java:151)

at java.util.jar.JarVerifier.processEntry(JarVerifier.java:284)

at java.util.jar.JarVerifier.update(JarVerifier.java:197)

at java.util.jar.JarFile.initializeVerifier(JarFile.java:258)

at java.util.jar.JarFile.getInputStream(JarFile.java:320)

at sun.misc.URLClassPath$4.getInputStream(URLClassPath.java:535)

at sun.misc.Resource.getBytes(Resource.java:60)

at java.net.URLClassLoader.defineClass(URLClassLoader.java:245)

at java.net.URLClassLoader.access$100(URLClassLoader.java:56)

at java.net.URLClassLoader$1.run(URLClassLoader.java:195)

at java.security.AccessController.doPrivileged(Native Method)

at java.net.URLClassLoader.findClass(URLClassLoader.java:188)

at sun.applet.AppletClassLoader.findClass(AppletClassLoader.java:128)

at sun.plugin.security.PluginClassLoader.access$201(PluginClassLoader.java:47)

at sun.plugin.security.PluginClassLoader$2.run(PluginClassLoader.java:262)

at java.security.AccessController.doPrivileged(Native Method)

at sun.plugin.security.PluginClassLoader.findClass(PluginClassLoader.java:250)

at java.lang.ClassLoader.loadClass(ClassLoader.java:304)

at sun.applet.AppletClassLoader.loadClass(AppletClassLoader.java:108)

at java.lang.ClassLoader.loadClass(ClassLoader.java:260)

at sun.applet.AppletClassLoader.loadCode(AppletClassLoader.java:366)

at sun.applet.AppletPanel.createApplet(AppletPanel.java:542)

at sun.plugin.AppletViewer.createApplet(AppletViewer.java:1159)

at sun.applet.AppletPanel.runLoader(AppletPanel.java:478)

at sun.applet.AppletPanel.run(AppletPanel.java:293)

at java.lang.Thread.run(Thread.java:579)


Switching the JRE to Kestrel/Firefly with the Merlin plug-in solve the problem, so the bug is apparently in the Merlin JRE itself rather than in the plug-in.