--- old/src/jdk.incubator.jpackage/macosx/classes/jdk/incubator/jpackage/internal/MacAppImageBuilder.java	2020-03-23 12:55:40.061716800 -0400
+++ new/src/jdk.incubator.jpackage/macosx/classes/jdk/incubator/jpackage/internal/MacAppImageBuilder.java	2020-03-23 12:55:38.232745400 -0400
@@ -85,6 +85,11 @@
 
     private static List<String> keyChains;
 
+    private final static String DEFAULT_ENTITLEMENTS =
+            "Mac.entitlements";
+    private final static String DEFAULT_INHERIT_ENTITLEMENTS =
+            "Mac_Inherit.entitlements";
+
     public static final BundlerParamInfo<Boolean>
             MAC_CONFIGURE_LAUNCHER_IN_PLIST = new StandardBundlerParam<>(
                     "mac.configure-launcher-in-plist",
@@ -162,6 +167,22 @@
                     null : Boolean.valueOf(s)
         );
 
+/*
+    public static final StandardBundlerParam<File> MAC_ENTITLEMENTS  =
+            new StandardBundlerParam<>(
+            Arguments.CLIOptions.MAC_ENTITLEMENTS.getId(),
+            File.class,
+            params -> null,
+            (s, p) -> new File(s));
+
+    public static final StandardBundlerParam<File> MAC_INHERIT_ENTITLEMENTS  =
+            new StandardBundlerParam<>(
+            Arguments.CLIOptions.MAC_INHERIT_ENTITLEMENTS.getId(),
+            File.class,
+            params -> null,
+            (s, p) -> new File(s));
+*/
+
     public MacAppImageBuilder(Map<String, Object> params, Path imageOutDir)
             throws IOException {
         super(params, imageOutDir.resolve(APP_NAME.fetchFrom(params)
@@ -368,13 +389,42 @@
             String signingIdentity =
                     DEVELOPER_ID_APP_SIGNING_KEY.fetchFrom(params);
             if (signingIdentity != null) {
+                prepareEntitlements(params);
                 signAppBundle(params, root, signingIdentity,
-                        BUNDLE_ID_SIGNING_PREFIX.fetchFrom(params), null, null);
+                        BUNDLE_ID_SIGNING_PREFIX.fetchFrom(params),
+                        getConfig_Entitlements(params).toString(),
+                        getConfig_Inherit_Entitlements(params).toString());
             }
             restoreKeychainList(params);
         }
     }
 
+    private File getConfig_Entitlements(Map<String, ? super Object> params) {
+        return new File(CONFIG_ROOT.fetchFrom(params),
+                getLauncherName(params) + ".entitlements");
+    }
+
+    private File getConfig_Inherit_Entitlements(
+            Map<String, ? super Object> params) {
+        return new File(CONFIG_ROOT.fetchFrom(params), 
+                getLauncherName(params) + "_Inherit.entitlements");
+    }
+
+    private void prepareEntitlements(Map<String, ? super Object> params)
+            throws IOException {
+        createResource(DEFAULT_ENTITLEMENTS, params)
+                .setCategory(I18N.getString("resource.mac-entitlements"))
+                // .setExternal(MAC_ENTITLEMENTS.fetchFrom(params))
+                .saveToFile(getConfig_Entitlements(params));
+
+        createResource(DEFAULT_INHERIT_ENTITLEMENTS, params)
+                .setCategory(I18N.getString(
+                        "resource.mac-inherit-entitlements"))
+                // .setExternal(MAC_INHERIT_ENTITLEMENTS.fetchFrom(params))
+                .saveToFile(getConfig_Inherit_Entitlements(params));
+    }
+
+
     private String getLauncherName(Map<String, ? super Object> params) {
         if (APP_NAME.fetchFrom(params) != null) {
             return APP_NAME.fetchFrom(params);
@@ -762,7 +812,8 @@
                       && !(p.toString().contains("/Contents/MacOS/libjli.dylib")
                       || p.toString().endsWith(appExecutable)
                       || p.toString().contains("/Contents/runtime")
-                      || p.toString().contains("/Contents/Frameworks"))).forEach(p -> {
+                      || p.toString().contains("/Contents/Frameworks"))
+                     ).forEach(p -> {
                 //noinspection ThrowableResultOfMethodCallIgnored
                 if (toThrow.get() != null) return;
 
@@ -778,12 +829,14 @@
                             return;
                         }
                     }
-
                     List<String> args = new ArrayList<>();
                     args.addAll(Arrays.asList("codesign",
-                            "-s", signingIdentity, // sign with this key
+                            "--timestamp",
+                            "--options", "runtime",
+                            "--deep",
+                            "--force",
+                            "-s", signingIdentity,
                             "--prefix", identifierPrefix,
-                            // use the identifier as a prefix
                             "-vvvv"));
                     if (entitlementsFile != null &&
                             (p.toString().endsWith(".jar")
@@ -836,6 +889,19 @@
                         "--prefix", identifierPrefix,
                         // use the identifier as a prefix
                         "-vvvv"));
+
+                if (entitlementsFile != null &&
+                        (path.toString().endsWith(".jar")
+                        || path.toString().endsWith(".dylib"))) {
+                    args.add("--entitlements");
+                    args.add(entitlementsFile); // entitlements
+                } else if (inheritedEntitlements != null &&
+                        Files.isExecutable(path)) {
+                    args.add("--entitlements");
+                    args.add(inheritedEntitlements);
+                    // inherited entitlements for executable processes
+                }
+
                 if (keyChain != null && !keyChain.isEmpty()) {
                     args.add("--keychain");
                     args.add(keyChain);
@@ -844,11 +910,15 @@
                 ProcessBuilder pb = new ProcessBuilder(args);
                 IOUtils.exec(pb);
 
+
                 args = new ArrayList<>();
                 args.addAll(Arrays.asList("codesign",
-                        "-s", signingIdentity, // sign with this key
+                        "--timestamp",
+                        "--options", "runtime",
+                        "--deep",
+                        "--force",
+                        "-s", signingIdentity,
                         "--prefix", identifierPrefix,
-                        // use the identifier as a prefix
                         "-vvvv"));
                 if (keyChain != null && !keyChain.isEmpty()) {
                     args.add("--keychain");
@@ -886,8 +956,12 @@
         // sign the app itself
         List<String> args = new ArrayList<>();
         args.addAll(Arrays.asList("codesign",
-                "-s", signingIdentity, // sign with this key
-                "-vvvv")); // super verbose output
+                "--timestamp",
+                "--options", "runtime",
+                "--deep",
+                "--force",
+                "-s", signingIdentity,
+                "-vvvv"));
         if (entitlementsFile != null) {
             args.add("--entitlements");
             args.add(entitlementsFile); // entitlements