jpackage signs additional launchers and all executables in the runtime: "Contents/Home/bin/java", "Contents/Home/bin/keytool", "Contents/Home/lib/libnet.dylib" (all dll-s in "Contents/Home/lib" folder). Why is that? These executables are supposed to be signed by a JDK vendor and should not be signed with the user's certificate.

Data collected from running the "SigningAppImageTest.test(true, true, UNICODE_INDEX)" test.

The observed behavior is not a regression; jpackage has been like this for a long time.