For the main JNLP launch file for an application, I can include JNLP-INF/APPLICATION.JNLP or APPLICATION_TEMPLATE.JNLP in a signed JAR referenced by the resources of that main JNLP. And if the actual JNLP does not match or validate, I correctly get an exception:
ExitException[ 3]JNLPSigningException[Failed to validate signing of launch file. The signed version does not match the downloaded version.]
at sun.plugin2.applet.JNLP2Manager.prepareLaunchFile(Unknown Source)
at sun.plugin2.applet.JNLP2Manager.loadJarFiles(Unknown Source)
at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
However, if I do something similar for the JNLP file of a component extension referenced by the main application extension, it appears the Java Plugin JNLP client does not validate it, i.e., the component extension JNLP can differ from the JNLP-INF/APPLICATION.JNLP or APPLICATION_TEMPLATE.JNLP in the resource JAR loaded by the component with no errors or complaints from the Java Plugin JNLP client.