See JDK-8027821, which describes the same problem for plugin. When The signed main jar is missing the manifest attribute - The security dialog will still be shown before the app is blocked.