When you launch this following test application
directly, it gives the proper error, i.e. "Unsigned application requesting unrestricted access to system"
${JRE_HOME}/bin/javaws http://nicole1.sfbay.sun.com:8080/JavawsMustangIntegTest/certificate/jar_after_signed_test.jnlp

But if you launch the same application after importing into the cache ie.
${JRE_HOME}/bin/javaws -import http://nicole1.sfbay.sun.com:8080/JavawsMustangIntegTest/certificate/jar_after_signed_test.jnlp

it launches with out any problem. Looks like when you have one signed
entry, javaws is not checking other cached resources while loading them, even though there is a unsigned entry residing in the jar.

I tried the same scenario with this BAT_security test, it's working fine
http://nicole1.sfbay.sun.com:8080/JavawsMustangIntegTest/hellojaws/BAT_security_negative.jnlp
But this test app has only one unsigned entry.

Build Info:
java version "1.6.0"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.6.0-b99)
Java HotSpot(TM) Client VM (build 20050218022006.et151817.baseline, mixed mode, sharing)

###@###.### 2005-2-24 19:33:58 GMT