4 ms·
Interesting project. We build and maintain a significant cross-platform JavaFX app, and use a combination of JLink (to create a smaller executable with bundled
by alex_suzuki 5y ago
Interesting project. We build and maintain a significant cross-platform JavaFX app, and use a combination of JLink (to create a smaller executable with bundled JRE), install4j (for the native .app/.exe wrapper) and Packages (macOS)/InnoSetup (Windows) for the installer. The installer has a non-trivial amount of scripting under the hood so being able to customize that is really important, at least for us.
I wonder if you won't run into trouble because of the Mac codesigning/notarization though. I think this poses a significant legal risk to you, as you are now distributing potentially malicious software signed with your certificate. Also I'm pretty certain Apple doesn't like this "code signing as a service" approach.
But hats off, cool project!
- shannah78 5y ago> But hats off, cool project! Thanks!
- jdc22 5y agoIs the lack of notarization truly an issue? Aside from demonstrating that the creator has a paid subscription to the developer program, what does notarization accomplish that isn't already handled by XProtect (i.e. a YARA scan) and the Malware Removal Tool (MRT)? Are there any examples anywhere of malware that has slipped through the client-side XProtect pre-flight checks, but that the server-side notarization checks have caught? Most independent macOS security literature I've read implies that notarization and code-signing is more about retaining centralized control of the app distribution process, but does not actually contribute anything to the malware mitigation tools that have been built into macOS for a very long time.
- alex_suzuki 5y agoCustomers don’t want notarization prompts for their expensive, custom-built software packages… So even if the security benefit is negligible (I agree), if you want to play, you have to play by their rules.
- deleted 5y ago[deleted]