Apps added via SelfService, dock icons going Question Mark

[rcookBSC]

I have both Chrome browser and Eclipse available via SelfService and per policy. Built up some new Macs running Sierra and joined them to the JSS. Updated via 'sudo jamf policy' and both Chrome and Eclipse are installed fine.

When you launch Chrome or Eclipse the first time all is normal, set the icons in the dock to 'keep'. Restart and the icons become ? also now, launching the same apps your presented with 'this was downloaded via Safari...' and you have to go through the first run dialog again.

The apps were packaged and uploaded to JSS on a machine running El Cap, could there be some issue because of that?

[Look]

I believe this is a function of a new security feature in the Sierra that allows vendors to sign the DMG the .app is delivered on, if you repackage the application (as you need to with Casper) something doesn't make sense to the OS during installation and it sandboxes the app for each user in some manner.
If you look at the dock plist file after adding it you will see it pointing off to some random temp location that then eventually gets deleted and the icon resorts back to a "?".
The only application I have encountered so far that does this is Chrome and my solution was far from friendly and involved delivering the original DMG inside a pkg then scripting mounting and copying the .app out, basically really annoying! Presumably the solution is for vendors to provide PKG files for enterprise deployment, or deployment tools to use original DMG files in some manner. Of course this is only my observations and it might be something else entirely going on, but you certainly don't get the same issue if you install directly from the original DMG.