I can't sign my code. What will be the impact on end users?

Question

I've been looking into using Jar Bundler to create a .app from my .jar and I read that you should sign the code using a Developer ID certificate before bundling the application. However, I am not a member of the Mac Developer Program and cannot afford to be for now.

So how will not signing the Java application change the end-users experience, if at all? How badly do I need to find an alternative solution, if available?

Answer 1

well unsigned java is worse than unsigned cocoa from a usability standpoint, because you don't have access to the file system.

if you have a native cocoa app bundle you get different security warnings and safeguards depending on the end user's settings, but with java I am pretty sure unsigned means basically no Disk or network IO

Answer 2

It depends on their Security preferences. If a user has their "Allow applications downloaded from" security preference set to "Mac App Store and identified developers", then by default they will not be able to run your app (but see options below). This restriction has nothing to do with Java and would apply similarly to an unsigned Cocoa app.

If they changed the setting to "Anywhere", then they'd be able to run your app.

Another option is to tell your users to Control-click or right-click the app, then select Open. This will give them the option to bypass the default security setting for this app only. Once they run it, they won't get the warnings again.

Certainly the smoothest route is to sign your app, but I don't think unsigned apps are so uncommon either and you may find that many of your users are already educated to this procedure.