Installer fails behind corporate TLS-inspecting proxies (Netskope/Zscaler); error message points at the wrong cause

[jpage4500]

Hi @shannah,

Some users at my company noticed installing my jdeploy app fails with the error:

A lot of digging (with help from AI) came up with a script that will work-around the issue. I'll post a link to it. It also mentioned some possible ways to fix it in the installer so I copied them below

On a network with TLS inspection, the macOS installer fails with "Cannot load app info because the app.xml file could not be found."

The real cause is in ~/.jdeploy/log/jdeploy-installer.log:

Failed to query registry https://www.jdeploy.com/ for bundle XXXX: (certificate_unknown)
PKIX path building failed: unable to find valid certification path to requested target
    at DefaultInstallationContext.downloadJDeployBundleForCode(DefaultInstallationContext.java:560)
    at ...findAppXml(DefaultInstallationContext.java:715)
    at Main.loadAppInfo(Main.java:443)

The proxy re-signs certs with a corporate root that macOS trusts but the JRE jdeploy downloads to ~/.jdeploy does not, so URLUtil.openStream fails for both jdeploy.com and github.com. Importing the root into that JRE's cacerts fixes it completely.

Notably, the native Client4JLauncher's own downloads succeed on the same machine — it pulled a 42 MB JRE and packageInfo.json fine, because native code uses the system trust store. Only the Java installer fails.

Three asks, in priority order:
1. On PKIX failure, fall back to the platform trust store or the native downloader (or shell out to curl) — the mechanism that already works.
2. Surface the SSLHandshakeException in the error dialog. "app.xml could not be found" sends people hunting a missing file when it's a certificate problem
3. Document a supported way to add a corporate root, so admins don't have to patch cacerts by hand after every JRE bump.

Here's the workaround that AI provided.. it's a script that (again, in AI's words: It installs Android Device Manager, and teaches the installer to trust the company's security certificate so it can download what it needs.

curl -fsSL https://raw.githubusercontent.com/jpage4500/AndroidDeviceManager/develop/scripts/install-corporate.sh | bash

All I know for sure is -- the script worked.. but, if it's something that could bite other jdeploy users and it's fixable I figured I'd ask if this was something you could do in the installer

thanks!