is OWS ignoring the certificate chain of code-signing-certificates?

[AlBundy33]

since our code-signing certificate expired this month (see #610) we bought a now one and signed our app with it.
But even we got our cert from a "real" root CA OWS complains about the certifiace.

same check as in the referenced issue but this time with a still valid cert:

jarsigner -verbose  -verify -certs org.ehcache_3.9.6.jar
....
sm       390 Tue Aug 24 21:34:48 CEST 2021 OSGI-INF/org.ehcache.impl.internal.store.disk.OffHeapDiskStoreProviderFactory.xml

      [entry was signed on 20.12.24 02:26]
      >>> Signer
      X.509, CN=...our certificate...
      [certificate is valid from 26.11.24 01:00 to 30.12.27 00:59]
      X.509, CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
      [certificate is valid from 22.03.21 01:00 to 22.03.36 00:59]
      X.509, CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB
      [certificate is valid from 22.03.21 01:00 to 19.01.38 00:59]
      >>> TSA
      X.509, CN=DigiCert Timestamp 2024, O=DigiCert, C=US
      [certificate is valid from 26.09.24 02:00 to 26.11.35 00:59]
      X.509, CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA, O="DigiCert, Inc.", C=US
      [certificate is valid from 23.03.22 01:00 to 23.03.37 00:59]
      X.509, CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US
      [certificate is valid from 01.08.22 02:00 to 10.11.31 00:59]


  s = signature was verified
  m = entry is listed in manifest
  k = at least one certificate was found in keystore
  i = at least one certificate was found in identity scope

- Signed by "...our certificate..."
    Digest algorithm: SHA-256
    Signature algorithm: SHA256withRSA, 4096-bit key
  Timestamped by "CN=DigiCert Timestamp 2024, O=DigiCert, C=US" on Fr Dez 20 01:26:19 UTC 2024
    Timestamp digest algorithm: SHA-256
    Timestamp signature algorithm: SHA256withRSA, 4096-bit key

jar verified.

The signer certificate will expire on 2027-12-30.
The timestamp will expire on 2031-11-10.

unzip -p org.ehcache_3.9.6.jar META-INF/*.RSA | openssl pkcs7 -inform DER -noout -print_certs
subject=C = GB, O = Sectigo Limited, CN = Sectigo Public Code Signing CA R36

issuer=C = GB, O = Sectigo Limited, CN = Sectigo Public Code Signing Root R46


subject=...our certificate...

issuer=C = GB, O = Sectigo Limited, CN = Sectigo Public Code Signing CA R36


subject=C = GB, O = Sectigo Limited, CN = Sectigo Public Code Signing Root R46

issuer=C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority