Thank you for the pointers. I've submitted a bug to oracle here: http://bugs.java.com/bugdatabase/view_bug?bug_id=JDK-8306977 I was able to get past this problem though. First, I had to remove a jar from my distribution that contained an unsigned native library (sqlite was the offending jar specifically). I then notarized my app based on the instruction here: https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/customizing_the_notarization_workflow#3087734 Once notarized I was able to download the dmg from a web site and access the application. The gatekeeper is still invoked, but opening the application is an option that the gatekeeper gives you.