I'm submitting an application to the Mac App Store. The application is based on Java, so the Java.runtime framework is embedded inside of the application bundle.
This worked fine with Java 8 and earlier, but Java 11 causes some issues. Apple requires you to sign all frameworks using your own certificate and entitlements file. I therefore sign all binaries and .dylib files as well as the framework itself, using the codesign tool with the --force option to replace the existing signature. Again, this was fine with older Java versions.
The problem is that as of Java 11 the CFBundleIdentifier is included in the executables. This CFBundleIdentifier is not replaced by codesign, and therefore remains "net.java.openjdk.cmd". Apple then rejects the application because this CFBundleIdentifier is already present in the Mac App Store.
The provided error message shows the issue:
CFBundleIdentifier Collision - The Info.plist CFBundleIdentifier value 'net.java.openjdk.cmd' of 'java' is already in use by another application.
So, my question is whether it is possible to replace the CFBundleIdentifier of an existing executable, either when using codesign or ad-hoc. The workaround would be to have my own OpenJDK build that sets a different CFBundleIdentifier, but this would be very impractical and lead to a time-consuming build.