It seems that Apple treats the jnlp file, and not the jar, as the “app” that needs to be trusted, and can’t see how to sign just one file. The workarounds to disable Gatekeeper, or right-click and open the jnlp, and then it’s allowed.

But for our app, download a new version every time for login credentials, and get Discover-1.jnlp, incremented every time, so that option won’t help. Either way, going around security is not a great option for most users.

With the Mavericks install, the setting is restricted to "Trusted developers and Appstore apps" if you had it on “Anywhere" before, and shows that Apple is pushing this feature. For our app to work now, have to tell users to disable Gatekeeper to run.

When search for the best current way to ship Java client side, the foremost answer is Web Start. Is there a better system for deploying, and still be able to update on the fly? (We update on a monthly cycle, so this is critical.)