Java 7u45 gives spurious warning about missing Permissions attribute

Question

The security dialog in 7u45 gives a yellow warning about missing Permissions attribute.   Does anyone know how to get rid of it?
Same as the yellow box in the screenshots (#2 and #3) documented here (although none of them discuss the Permissions attribute) :
What should I do when I see a security prompt from Java?
The MANIFEST.MF file for the app definitely contains this attribute.  There's only one jar for the application, and it's signed.
Might this be another security dialog bug?  Or am I missing something?  The JNLP contains the same "all-permissions" security tag.
I also found the release notes for 7u45 mention a couple of cases where the dialog might still appear
(see last issue: Java™ SE Development Kit 7 Update 45 Release Notes)
I don't use the JNLPDownloadServlet but my own. I didn't model it on the JNLPDownloadServlet, but guess I could have partly the same issue since I use versioning.
My jar doesn't fail to download though, it's just that its displaying this warning.
MANIFEST.MF:
Manifest-Version: 1.0
Implementation-Title: My app
Implementation-Version: 3.0-SNAPSHOT
Built-By: me
Application-Name: Myapp
Created-By: Apache Maven 3.0.5
Ant-Version: Apache Ant 1.8.2
Trusted-Library: true
Implementation-Vendor-Id: org.me
Trusted-Only: true
Build-Jdk: 1.7.0_45
Permissions: all-permissions
Specification-Title: my-client
Specification-Version: 3.0-SNAPSHOT
Archiver-Version: Plexus Archiver
Codebase: *.me.org

Answer 1

I went the Java version detection applet and I don't get a warning about the applet being blocked in the future.
https://java.com/en/download/installed.jsp
https://java.com/en/download/installed.jsp
I dug the jar for the applet out of my Java cache and it contains Manifest.MF with the following contents:
Manifest-Version: 1.0
Codebase: www.java.com java.com
Created-By: 1.7.0_25 (Oracle Corporation)
Permissions: all-permissions
Application-Library-Allowable-Codebase: www.java.com java.com
Application-Name: Java Detection
Name: JNLP-INF/APPLICATION.JNLP
SHA1-Digest: jPquHTBq5R8txQLe5/T20x70Y7w=
Name: JavaDetection.class
SHA1-Digest: kQNVjPC5Yym1DszdpX1D2EH8Ll0=
The jar contains one Java class and a signed JNLP-INF/APPLICATION.JNLP file that looks like this:
<?xml version="1.0" encoding="UTF-8"?>
<jnlp codebase="https://java.com/en/download/" href="JavaDetection_applet.jnlp" spec="1.0+">
    <information>
        <title>Java Detection</title>
        <vendor>Oracle Inc.</vendor>
    </information>
    <resources>
        <!-- Application Resources -->
  <j2se version="1.6+"/>
        <jar href="JavaDetection.jar" />
    </resources>
<security>
  <all-permissions />
</security>
    <applet-desc
         name="Java Detection Applet"
         main-class="JavaDetection"
         width="1"
         height="1">
     </applet-desc>
     <update check="background"/>
</jnlp>
They are running applet via JNLP:
<applet code="JavaDetection.class" width="500" height="150"><param name="image" value="/im/download/verify_anim.gif"/><param name="centerimage" value="true"/><param name="boxborder" value="false"/><param name="jnlp_href" value="JavaDetection_applet.jnlp"/></applet>
The JNLP file downloaded from here: https://java.com/en/download/JavaDetection_applet.jnlp matches the signed JNLP file in the jar (except for name).
We are still working on getting our applications to not show the warning message but this appears to be an example of where the "you will be blocked in the future" message is not happening. We don't run our applications as applets so if anyone can find another working example that is a more traditional JNLP app, please post a link.