javajava-8javafx-8signed-applet

JavaFX - Do I need to buy a license and get my software passed to share it online?


Ok, so I noticed that(I'm assuming due to security holes) Java has decided to force people to get their java software signed and the license is rumored to cost between $100 - $300 or something like that. This is supposed to depend on which authorized licensee you go through. I however am learning JavaFX and if I can't share my software for free with the world, then what is the point in learning it?

The question is whether this is true for online or the offline javafx apps as well? It bothers me that I may have to pay cash out of pocket and have my software tested and passed in order to get it verified in order for anyone to even be able to run it off their computer. I started thinking about this because I just started on my first real JavaFX project. It's a poker game and is going to have various style of poker and maybe even blackjack included in it. It has really been bumming me out that there is a possibility that no one will ever get to play it but me. Could someone please explain this drastic change and what it means for developers just getting started?


Solution

  • Short Advice

    1. License your software for use by others, for example apply a 2-clause BSD license to it.
    2. If you distribute 3rd party libraries or runtimes, then ensure you are in compliance with the licenses of those runtimes.
    3. Choose a distribution execution mode for your application (for example a self-contained application).
    4. Depending on how you intend to distribute your software, signing the software using a certificate may or may not be required.
    5. If you wish your users to verify your identity with a 3rd party certificate authority, then buy a certificate from the authority, otherwise use a self-signed certificate.

    For the specific use case you defined in your question:

    1. There is no fee required to license your own software.
    2. There is no fee to distribute the unmodified Java 8 runtime with your software.
    3. Not signing the software or using a (free) self-signed certificate is probably fine.

    Deployment Modes

    How you deploy your application will impact the signing requirements for application.

    Applications deployed via webstart or the Java browser plugin should be signed using a self-signed or 3rd party certificate. Standard Java deployment tools (and IDEs such as NetBeans) can be used for this.

    Applications deployed through a store such as the Mac App Store, will need to obtain a developer certificate for that store from the store owner (e.g. Apple). Although the digital signature concept for stores is similar to signing for browser embedded content, the signing process is different and requires using 3rd party tools provided by the store owner.

    If you want Mac users to use your standalone application with the greatest of ease, then you might also need an Apple Developer ID, though educated users will still be able to use your software even if you don't have such an ID.

    Certificates

    What you refer to as a license is not a license, it is a certificate issued by a certificate authority. Certificates are issued in compliance with a certificate policy to help establish trust relationships (e.g. users of your software can know it came from John Conner and not the Terminator or some other malicious being bent on infecting the cybernet).

    You do not need to obtain a software signing certificate from a well known certificate authority. You can be your own authority and create a self-signed certificate. When you use a self-signed certificate, the user will see a different security prompt than if you used a certificate from a well-known certificate authority. In essence, with a self-signed certificate you are vouching for your own identity; users do not validate with a 3rd party that whoever provided the software is who they claim to be.

    The choice of whether to use a self-signed certificate or to pay a certificate authority to authorize your identity depends on how you want to present your application to your users. If you are just distributing your application to a few friends who know you, then a self-signed certificate is good. If you want to distribute your application to thousands of people who don't know you, then signing the application is recommended. Also, some deployment modes mandate the use of a certificate.

    If you use an IDE such as NetBeans, it will automatically create and use a self-signed certificate if necessary. You can use command line tools like the java keytool in conjunction with the javafxpackager or 3rd party tools to sign your application with a self-signed or third party issued certificate.

    Licenses

    A software license imposes legal parameters on the use and redistribution of software (think copyright law rather than a cryptographic instrument), so it is something quite different from a certificate used in establishing trust.

    If you distribute 3rd party software with your application, you must comply with a license granted to you from the 3rd party. It is your responsibility to read and understand the license for that software and ensure you are in compliance.

    You should also license the software you write for use by others. As you are the one issuing the license for your own software, you don't buy the license, you just choose the license you wish and include it's text file with your software somewhere where somebody can see it.

    Let's say that i want to make a distribution of my Javafx program, which file do i give them?

    For the application described in your question, I recommend using the self-contained deployment mode, which packages the application as a native platform installer (dmg file for OS X, msi or exe for Windows, rpm or deb for Linux, etc). That way users can download a single file specific to their machine and install and uninstall your application in exactly the same way they would any other software.

    With self contained packaging:

    1. A Java runtime is included in the packaging, so you don't need to rely on your application users installing that runtime themselves.
    2. Currently, signing with a certificate is not necessary for this deployment mode.
    3. The user does not see unusual java specific warning dialogs on installation.
    4. There is no dependency a separate Java runtime installed on the machine which may be upgraded or removed, potentially breaking your application.

    Distribution of your application as a jnlp so that it can be deployed within a browser may sound like an enticing option, but historically many people have had issues getting their application reliably deployed that way, your experience may vary.

    Just building your application as a jar and providing that to somebody (or as a zip if there are additional libraries and resources you want to bundle) is an option too. It will work fine for developers who already have a java runtime installed on their machine, but for general users, asking them to find and install the correct java runtime on their machine so that you can run your application is probably an inadvisable thing to do.

    As you are just learning JavaFX, concentrate on writing a good application that is worth distributing, then worry about how to license and distribute it.

    You will only be technically limited if you will be deploying to iOS or Android or low feature devices like the Raspberry Pi as the runtime environments there are quite different from what you would find on a desktop. Targeting iOS or Android is currently not something which I would advise for somebody learning JavaFX (due to the present immature state of JavaFX runtimes on those platforms). If you are targeting iOS or Android, then review the information at javafxports before doing significant work on your application as it may place restrictions on what Java language features or 3rd party libraries you may choose to use with your application.