printing to CUPS fails on mac sandbox app

FULL PRODUCT VERSION :
java version "1.8.0_131"
Java(TM) SE Runtime Environment (build 1.8.0_131-b11)
Java HotSpot(TM) 64-Bit Server VM (build 25.131-b11, mixed mode)


ADDITIONAL OS VERSION INFORMATION :
OS X/macOS 10.12.4 and higher

EXTRA RELEVANT SYSTEM CONFIGURATION :
mac desktop and java app running within the mac sandbox (as required by the mac app store)

A DESCRIPTION OF THE PROBLEM :
There is a printing problem using recent JDKs when running within the macOS sandbox as of 10.12.4.

Looking at the jdk8 sources, CUPSfuncs.c seems to ignore the cupsServer by the system CUPS libraries if it returns a reference to a unix domain socket address:

 // Is this a local domain socket?
 if (strncmp(server, "/", 1) == 0) {
   cServer = JNU_NewStringPlatform(env, "localhost");
 } else {
   cServer = JNU_NewStringPlatform(env, server);
 }

This causes the CUPSPrinter.java and CUPSfunc code to connect to localhost via TCP port 631 instead of the advertised unix domain socket.

MacOS Sierra 10.12.4 had some security related changes to the sandbox which explicitly blocks connections from a sandboxed app to TCP localhost:631. This blockage (or at least a very long delay) applies even if the sandboxed app has network-client, network-server, and print entitlements, which means there's no way around the problem.

I've talked to Apple DTS and they aren't inclined to allow the connection to localhost:631, even if the network-client and print entitlements are enabled. It seems a bit stubborn of them but to be fair java is ignoring the advertised CUPS server string and assuming that a TCP/localhost:631 interface is available.

Is there a reason not to use the unix domain socket connection? The connection details seem to be encapsulated within the libcups code so I don't see why the java level needs to override the result returned by the call to `cupsServer`


STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
First you need to create an app bundle that is signed for use in the macOS sandbox. Once you do that, simply try the most basic use of any of the java print APIs.

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
The print API should show the print dialog and then print the specified job
ACTUAL -
When attempting the first connection to the printing system, the main thread will hang while attempting to connect to localhost TCP port 631. It does seem to occasionally connect, but if it does it is usually after about 20-40 minutes.

REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------

import javax.print.PrintService;
import javax.print.PrintServiceLookup;
import java.awt.*;
import java.awt.print.*;

public class TestPrint implements Printable {

  public static void main(String[] argv) throws Exception {
    TestPrint printTest = new TestPrint();
    PrinterJob pj = PrinterJob.getPrinterJob();
    pj.setJobName("Test Print");
    pj.setPrintable(printTest);
    if(pj.printDialog()) {
      pj.print();
    }
  }

  public int print(Graphics graphics, PageFormat pageFormat, int pageIndex)
                 throws PrinterException
  {
    graphics.drawString("Hello World", 50, 50);
    return pageIndex==0 ? PAGE_EXISTS : NO_SUCH_PAGE;
  }

}



---------- END SOURCE ----------

CUSTOMER SUBMITTED WORKAROUND :
I've searched, but have no workaround.

SUPPORT :
YES