[External] : Re: MacOS bundles using jpackage

[Alexey Semenyuk]

Hi Abhinay,

Thank you for evaluating the issue! I've updated JDK-8358723 CR with you 
finding.

Can you try another fix? Instead of removing `.entitlements(null)` from 
`signingCfgWithoutEntitlements` object, can you replace
---
final var codesignDir = 
Codesign.build(signingCfgWithoutEntitlements::toCodesignArgs).force(true).create().asConsumer();
---

with
---
final var codesignDir = 
Codesign.build(signingCfg::toCodesignArgs).force(true).create().asConsumer();
---
  at [1]?

[1] 
https://github.com/openjdk/jdk25u/blame/e90d54198d4310830c3a970dbe2bc883c67867f8/src/jdk.jpackage/macosx/classes/jdk/jpackage/internal/AppImageSigner.java#L232

- Alexey

On 9/24/2025 3:02 AM, Abhinay Agarwal wrote:
> Hi Alexey,
>
> I have tried jpackge from JDK 17/21/24 and applications generated from 
> all of them work fine.
>
> Removing `.entitlements(null)` from this particular line fixes the 
> issue in JDK25:
> https://github.com/openjdk/jdk25u/blame/master/src/jdk.jpackage/macosx/classes/jdk/jpackage/internal/AppImageSigner.java#L228 
> <https://urldefense.com/v3/__https://github.com/openjdk/jdk25u/blame/master/src/jdk.jpackage/macosx/classes/jdk/jpackage/internal/AppImageSigner.java*L228__;Iw!!ACWV5N9M2RV99hQ!PC580bqSgm0DSEYJIWVtP1JJyEyRCV2cXpzKR-a_Z3CZmjEdtg0FAGGm1NC8ILpr4ds6xWIifHfQqdsp_uy5Yi-xfcGAxi5gvw$>
>
> - Abhinay
>
>> On 23 Sep 2025, at 21:46, Alexey Semenyuk 
>> <alexey.semenyuk at oracle.com> wrote:
>>
>> Hi Abhinay,
>>
>> On 9/23/2025 4:22 AM, Abhinay Agarwal wrote:
>>> We created a DMG package for Scene Builder [1] using jpackage in JDK 25.
>>> After installing the app, we found that with the recent changes [2] 
>>> introduced in jpackage,
>>> it no longer adds the default entitlements to the macOS builds. As a 
>>> result, SceneBuilder.app crashes during startup.
>>> We even tried adding explicit entitlements using 
>>> `--mac-entitlements`, but to no avail.
>> This is likely to be the issue [1]. I believe it is not JDK 
>> 25-specific, though; it should affect all versions of jpackage 
>> starting from JDK 17. Can you try a jpackage from jdk21 or jdk17 to 
>> prove me wrong?
>>
>>>
>>> Furthermore, we discovered that the `--mac-package-signing-prefix` 
>>> flag now requires the prefix to end with a `.`,
>>> which wasn’t the case earlier.
>> The prefix value should end with a `.`. See [2]. Prior to jdk25 
>> jpackage didn't validate the value of the prefix.
>>
>> [1] https://bugs.openjdk.org/browse/JDK-8358723
>> [2] 
>> https://docs.oracle.com/en/java/javase/17/jpackage/support-application-features.html#GUID-8D9F0607-91F4-4070-8823-02FCAB12238D
>>
>> - Alexey
>>
>>>
>>> - Abhinay
>>>
>>> [1] https://github.com/gluonhq/scenebuilder 
>>> <https://urldefense.com/v3/__https://github.com/gluonhq/scenebuilder__;!!ACWV5N9M2RV99hQ!PC580bqSgm0DSEYJIWVtP1JJyEyRCV2cXpzKR-a_Z3CZmjEdtg0FAGGm1NC8ILpr4ds6xWIifHfQqdsp_uy5Yi-xfcGTA486Qw$>
>>> [2] https://bugs.openjdk.org/browse/JDK-8333664
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mail.openjdk.org/pipermail/core-libs-dev/attachments/20250924/8d91d93d/attachment-0001.htm>