On Sat, 23 May 2026 at 10:52, Michael Bien <[email protected]> wrote: > > Yes, this looks like fallout from Temurin using JEP493 and NBPackage's deep > > resigning of the bundled JDK on macOS. > https://github.com/adoptium/temurin-build/issues/4057#issuecomment-2503352308 > > i suppose signing on mac would append something to the dylib's metadata which > jlink notices when it doesnt match the sha anymore?
Yes, pretty much this, although NBPackage replaces the existing signature rather than appending. Which as you say, changes the sha that jlink is verifying against. I don't think those can be easily updated. AFAIK, Temurin had this issue itself with JEP493 until they changed where signing was in their build order. I'm not sure what the answer is here - there are more factors in play than when this was first written. It might be to update NBPackage with an option to keep the JDK's existing signatures, and do a bunch of testing around runtime permissions and notarization in those cases. The other is to just point people to downloading Temurin's JMods or using an external JDK for use with jlink. Best wishes, Neil --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected] For further information about the NetBeans mailing lists, visit: https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
