Is the source code to the com.sun.deploy package publicly available?
I think there has been a change to, perhaps, class com.sun.deploy.security.DeployURLClassPath for Java 7 update 6 which is causing us problems. I'm wondering whether to change our code to cater for the Web Start change, or if it's a change that's likely to be reverted in a future Java update. Viewing the source for DeployURLClassPath might be useful in making that decision.
OpenJDK is the open source version of Java, that's where you can find the parts of the Oracle JDK distribution that actually are open source (which are not all, for example the browser plugins are not open source).
So yeah, download the source and see if the package is in there somewhere (might take some scouting...). If not, I'm pretty sure a google for 'com.sun.deploy source' will give you some results. I'm pretty positive about that actually.
We're getting a "mixed code" warning dialog. Our code tries to load a properties file via Class.getResourceAsStream() and if that fails tries to load the resource via the code base URL. Under 7u6, or rather when using 7u6 Web Start / plug-in, the Class.getResourceAsStream() gives the mixed code dialog. I think this happens because the resource actually is available naked via the code base.
I debugged with a breakpoint on Socket.connect(), and it looked like the 7u6 JNLP classloader was checking the code base URL itself for the resource where the 7u5 one was not (presumably just looking in the jars specified by the JNLP).
If your app did no thing unusual in terms of resource declaration and access, and it works for 7u5 but for 7u6, then it is likely a bug some where. The best way to solve this is file a bug to provide application details, test cases.