Definitely something wrong with creating manifests.

Apache Ant is DEFINITELY generating or reading manifest files incorrectly.

To prove this, create a jar with a manifest.
Immediately after creating the jar and manifest, attempt to update the manifest with a permission.

Simple test case:

<jar destfile="${build.lib.dir}/myjar.jar">
<fileset dir="${build.bin.dir}/my-code">
<include name="*/*" />
</fileset>
<fileset dir="${src.dir}" >
<include name="net/*/.gif"/>
<include name="application/*/.xml"/>
<include name="application/*/.xslt"/>
<include name="config/**"/>
</fileset>
<manifest>
<attribute name="Built-By" value="bodewig"/>
<section name="common">
<attribute name="Specification-Title" value="Example"/>
<attribute name="Specification-Version" value="1.2"/>
<attribute name="Specification-Vendor" value="Example Organization"/>
<attribute name="Implementation-Title" value="common"/>
<attribute name="Implementation-Version" value="1.2 September 10, 2013"/>
<attribute name="Implementation-Vendor" value="Example Corp."/>
</section>
<section name="common/class1.class">
<attribute name="Sealed" value="false"/>
</section>
</manifest>
</jar>

<manifest file="${build.lib.dir}/jxntm-admin.jar" mode="update">
<attribute name="Trusted-Only" value="true"/>
<attribute name="Permissions" value="all-permissions"/>
<attribute name="Codebase" value="*"/>
</manifest>