This looks extremely scary to me, they say you can avoid having to noterize your apps with apple and microsoft because their installers are already approved. What happens when someone publishes some malware application using their wrapped and noterized installer? Apple and microsoft will then flag all other applications that used jdeploy as malware as well since they are all relying on the same noterized installer ap…
I considered that. The approach I'm taking was inspired by the way that Chrome creates app bundles for PWAs. > What happens when someone publishes some malware application using their wrapped and noterized installer The installer application simply installs the app. It doesn't in itself run any of the app's code. The installed app doesn't need to be codesigned and notarized like it would if you had just downloaded it…
Wait, then doesn't that mean Apple's intent there is broken? I mean if you can bypass its controls on installing unsigned apps by merely wrapping an unsigned (possibly malicious) app in a signed installer, then what's the point?