When running the following testcase for mixed code, using old JRE 1.4.2_26 in 6u19 b02:

http://eltanin.east.sun.com:8000/dennis/bug/dolphin/6.0update/signjar_secu/case2-dgu-B/142/jws-original.jnlp

I did see the mix code security popup.

But click on "No" button and still want to run the app, I got the following exception:

security: Saved certificates in Deployment session certificate store
basic: exception: null.
java.lang.NullPointerException
   at com.sun.deploy.cache.CachedJarFile14.findMatchingSignerIndices(Unknown Source)
   at com.sun.deploy.cache.CachedJarFile14.entryNames(Unknown Source)
   at com.sun.deploy.cache.DeployCacheJarAccessImpl.entryNames(Unknown Source)
   at com.sun.deploy.security.CPCallbackHandler.assertTrust(Unknown Source)
   at com.sun.deploy.security.CPCallbackHandler.access$700(Unknown Source)
   at com.sun.deploy.security.CPCallbackHandler$ParentCallback.strategy(Unknown Source)
   at com.sun.deploy.security.CPCallbackHandler$ParentCallback.openClassPathElement(Unknown Source)
   at com.sun.deploy.security.DeployURLClassPath$JarLoader.getJarFile(Unknown Source)
   at com.sun.deploy.security.DeployURLClassPath$JarLoader.access$700(Unknown Source)
   at com.sun.deploy.security.DeployURLClassPath$JarLoader$1.run(Unknown Source)
   at java.security.AccessController.doPrivileged(Native Method)
   at com.sun.deploy.security.DeployURLClassPath$JarLoader.ensureOpen(Unknown Source)
   at com.sun.deploy.security.DeployURLClassPath$JarLoader.<init>(Unknown Source)
   at com.sun.deploy.security.DeployURLClassPath$3.run(Unknown Source)
   at java.security.AccessController.doPrivileged(Native Method)
   at com.sun.deploy.security.DeployURLClassPath.getLoader(Unknown Source)
   at com.sun.deploy.security.DeployURLClassPath.getLoader(Unknown Source)
   at com.sun.deploy.security.DeployURLClassPath.getResource(Unknown Source)
   at sun.plugin2.applet.Plugin2ClassLoader$2.run(Unknown Source)
   at java.security.AccessController.doPrivileged(Native Method)
   at sun.plugin2.applet.Plugin2ClassLoader.findClassHelper(Unknown Source)
   at sun.plugin2.applet.JNLP2ClassLoader.findClass(Unknown Source)
   at java.lang.ClassLoader.loadClass(Unknown Source)
   at java.lang.ClassLoader.loadClass(Unknown Source)
   at java.lang.ClassLoader.loadClass(Unknown Source)
   at sun.plugin2.applet.Plugin2ClassLoader.loadCode(Unknown Source)
   at sun.plugin2.applet.Plugin2Manager.createApplet(Unknown Source)
   at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Unknown Source)
   at java.lang.Thread.run(Unknown Source)
Exception: java.lang.NullPointerException

Running old JRE 1.5.0_24 with the following application:

http://eltanin.east.sun.com:8000/dennis/bug/dolphin/6.0update/signjar_secu/case2-dgu-B/150/jws-original.jnlp

the mixed code security dialog box popup, and it works fine, but I see this exception in Java console, even application still runs OK:

basic: Removed progress listener: null
java.lang.SecurityException: class "dk.signaturgruppen.demo.io.net.FileDownloader" does not match trust level of other classes in the same package
   at com.sun.deploy.security.CPCallbackHandler$ChildElement.checkResource(Unknown Source)
   at com.sun.deploy.security.DeployURLClassPath$JarLoader.checkResource(Unknown Source)
   at com.sun.deploy.security.DeployURLClassPath$JarLoader.getResource(Unknown Source)
   at com.sun.deploy.security.DeployURLClassPath.getResource(Unknown Source)
   at sun.plugin2.applet.Plugin2ClassLoader$2.run(Unknown Source)
   at java.security.AccessController.doPrivileged(Native Method)
   at sun.plugin2.applet.Plugin2ClassLoader.findClassHelper(Unknown Source)
   at sun.plugin2.applet.JNLP2ClassLoader.findClass(Unknown Source)
   at java.lang.ClassLoader.loadClass(Unknown Source)
   at java.lang.ClassLoader.loadClass(Unknown Source)
   at java.lang.ClassLoader.loadClassInternal(Unknown Source)
   at dk.signaturgruppen.demo.applet.DemoApplet.init(DemoApplet.java:36)
   at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Unknown Source)
   at java.lang.Thread.run(Unknown Source)
Exception: java.lang.SecurityException: class "dk.signaturgruppen.demo.io.net.FileDownloader" does not match trust level of other classes in the same package
basic: Applet initialized