Is the warning message about an update being unsigned a bug in Eclipse or is it just that Genuitec hasn't taken the trouble to get an SSL code signing certificate to sign the updates?

If its the latter, please do so. It just doesn't come off as very professional to the PHBs when messages like this pop up! Certs cost about $150 from Thawte, which should be sufficient.

Thanks!

Actually, we already have SSL certs, it's simply a matter of not incrementing the signing into our build process yet due to resource constraints.

I would also like to encourage your company to put signing into the build process for your updates as soon as you can. The update facility of eclipse is an easy way to allow developers to keep up-to-date. However, warning dialogs raise concerns for both the developer and people from corporate security about the integrity of the update package.

I think understand your point, but I don't believe the Eclipse platform updates are signed either. Do these raise the same concerns, or are we different somehow?

Yes, I have the same security/integrity concerns with the eclipse updates. However, you are different as a commercial vendor of a product. As your customers, we can express our desired features and changes for you product and you can decide if its worth doing. I was merely letting you know that at least two of your customers would like to see your updates signed for the reasons stated above.

I've added an enhancement request for the MyEclipse 5.0 timeline for signed updates. Thanks for the feedback!