On Mac OS X 10.9 signed Java Web Start applications are blocked by default with the message:
"application.jnlp" can't be opened because it is from an unidentified developer.
I know it’s possible to weaken the security checks to allow any application to run, but that requires a manual intervention of the end user.
Is it possible to “sign” a Java Web Start application such that it is recognized as originating from an identified developer?
Thank you
Advertisement
Answer
Apple does appear to support signing of webstart — but not directly. You have to bundle it in an archive. See the note at the bottom of this page:
You can use the codesign utility to sign the JNLP file, which will attach the code signature to the JNLP file as extended attributes. To preserve these attributes, package the JNLP file in a ZIP, XIP, or DMG file. Be careful using the ZIP format, as some third-party tools might not capture the required extended attributes correctly.
Also note that XIP isn’t supported for non-Apple developers anymore:
Important: Starting with macOS Sierra, only XIP archives signed by Apple will be expanded. Developers who have been using XIP archives will need to move to using signed installer packages or disk images.