Signing apps for Mountain Lion without Xcode

>Unsigned binaries are really not an issue. People who know what they are doing can completely turn the check off, or you can leave it on simply 'command-click and choose open' once to add the app to the whitelist. I do this all the time.

Superficially, that makes it seem like not an issue. But it's sort of like when Sony added the "no class action" waiver to their TOS. Yes, you could opt out, but it still removes virtually any possibility of a class action suit since very few people did opt out. Similarly, it is possible to run apps that aren't signed, but most users won't, and that means that it isn't viable, from a developer's perspective, to produce unsigned apps.

Now, it's true that you don't have to go through the App Store review process just to sign an app, but that doesn't mean that Apple can't revoke your key on a whim (or in error).

The cost is also an issue. $99/year is a steep commitment for what used to be a pretty big segment of the Mac developer ecosystem. The common counterargument to this is "Really, you're going to complain about $99 when while working on a $2500 laptop?" But this is nonsense. If you're unemployed, in school, or working a low paying job while developing on the side, your computer likely isn't a $2500 laptop. It's probably a low end Mac and/or a hand-me-down, and you will keep riding that machine until it breathes its last gasp. $99/year is about the cost of your whole computer.

Now, maybe Apple doesn't care about a slew of small, cheap/free apps with low hardware requirements, but their users sure as hell should.

This is 100% correct.

If you Google Image search for "gatekeeper warning" https://www.google.com/search?q=gatekeeper+warning&hl=en...

all you see are dialogs telling you about unknown developers, or non-signed apps, or your settings keeping an application from being opened.

I have never seen the dialog being showing in this blog post ... except for a single time: XProtect binary file detection, built into OS X for defense against a few known malware attacks out there.

Pretty sure the reason that this "works" and that the author of the post is getting that dialog is that XProtect is getting a false positive on their Flash-based projects and signing the app either avoids XProtect (scary if true) or changes the signature enough that it doesn't register as a false positive any more.

This is not news. Xcode normally shells out to codesign.

That's true and probably by design. ;)

A workaround could perhaps be to use anti-virus software, at least Symantec has reputation based whitelisting.