Java 7 u45 Web Start application won't launch

Question

I maintain an Eclipse RCP application launched with WebStart. Java 7 u45 made some security changes, and now my application crashes on startup.
I've added to the manifest:
Permissions: all-permissions
Codebase: *
Trusted-Library: true
This removed all of the warning messages from the Control Panel. But I still have a classloader issue when trying to load the first necessary class from my jar.  This is new to update 45. To add to the complication, my application uses Eclipse RCP, so the classloading is through OSGi.

Answer 1

This likely won't answer your question, but this update has messed up quite a bit with the way applet security is handled.
There are a laundry list of "known issues" in the release notes and they don't make sense.
For example, I use JavaScript to communicate to my applet and I have several trusted signed jars on it's class path. To permit JavaScript calls, a new parameter "Caller-Allowable-Codebase: http://*.mysite.etc" must be provided.  To permit my applet to communicate with other jars I had previously used "Trusted-Library: true", but that setting now displays a false warning.  Here's the KNOWN ISSUE from Oracle:
KNOWN ISSUE
Area: Deployment/Plugin
Synopsis: Caller-Allowable-Codebase may be ignored when used with Trusted-Library.
If a trusted, signed JAR file is using the Caller-Allowable-Codebase manifest attribute along with Trusted-Library then the Caller-Allowable-Codebase manifest entry will be ignored and, as a result, a JavaScript -> Java call will show the native LiveConnect warning. The workaround is to remove the Trusted-Library manifest entry.
Next, I generally test my applet by running a sample.html from my desktop.  With Java 7 u45, this fails with an InvocationTargetException.
java.lang.RuntimeException: java.lang.reflect.InvocationTargetException ...
Caused by: java.lang.NullPointerException
  at sun.plugin2.applet.Plugin2ClassLoader.loadAllowedCodebases(Unknown Source)
Is this a KNOWN ISSUE too?  Hard to tell.. here's the snippet from the release notes...
KNOWN ISSUE
Area: Deployment/Plugin
Synopsis: Applet could fail to load by throwing NPE if pack compression is used with deployment caching disabled.
If a JAR file is using pack compression with manifest entries Permissions and Caller-Allowable-Codebase while deployment caching is disabled, then:
The Permissions manifest entry will be ignored. (This can be seen from the fact that yellow warning is there on security dialog even though the Permissions attribute is there.) This only happens if Caller-Allowable-Codebase attribute is present along with the Permissionsattribute.
The Caller-Allowable-Codebase attribute will cause the applet to fail to load by throwing ajava.lang.NullPointerException.
I don't use deployment caching because it started causing problems with Java 7 u21.  Adding the cache_jar parameter back in doesn't fix this.  But the irony is this exception is only raised with the Trusted Godaddy Certificate and only when being launched from file:/// url.  The Self-Signed version actually works (although some dialogs appear, but no NPE).  This doesn't make any sense. Furthermore, when the trusted-signed version is launched from http:// it works fine.   Should I turn off compression (and why would anyone do this?)
But what's worse than all of this listed above is when I finally choose the right combination of settings that permits the applet to load, it completely fails on older versions such as Java 7 u40 and Java 7 u21.  My applet is compiled using JDK 5 for backwards compatibility with Mac PPC Java 1.5 and Mac Intel Java 1.6 (the sun one has compatibility issues on Mac only), but now does every client need to update to Java 7 u45?  What about the scenarios where the upgrade isn't possible due to compatibility or availability?  I wish I could answer this.
I'm struggling with this and so is my open source project.  Any expert insight advice is appreciated.  I'd happily compensate someone for assistance.
-Tres Finocchiaro