Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Apple Temporarily Relaxes Notarization Requirements in macOS Catalina for Non Mac App Store Apps

MacRumors

MacRumors

macrumors bot
Original poster
Apr 12, 2001
63,558
30,889



Apple this afternoon reminded developers about upcoming notarization requirements for Mac apps created outside of the Mac App Store.

Apps that are distributed outside of the Mac App Store must be notarized by Apple in order to run on the macOS Catalina operating system set to be released this fall.

apple_mac_notarized.jpg

Apple says that to make the transition easier on both developers and Mac users, notarization prerequisites have been adjusted until January 2020.

Developers can now have apps notarized that do not meet certain previous requirements, such as an app that uses an older SDK or the inclusion of components not signed by a developer ID.

Apple has a full list of allowances on its developer website:
You can now notarize Mac software that:
- Doesn't have the Hardened Runtime capability enabled.
- Has components not signed with your Developer ID.
- Doesn't include a secure timestamp with your code-signing signature.
- Was built with an older SDK.
- Includes the com.apple.security.get-task-allow entitlement with the value set to any variation of true.
Click to expand...
Apple has been requiring new software distributed with a Developer ID outside of the Mac App Store to be notarized in order to run since macOS Mojave 10.14.5.

Apple introduced notarization in macOS Mojave as a way to further protect Mac users from malicious and harmful apps.

For the notarization process, Apple provides trusted non Mac App Store developers with Developer IDs that are required to allow the Gatekeeper function on macOS to install non Mac App Store apps.

Notarization is not required for apps that are distributed through the Mac App Store. More information on notarization can be found on Apple's developer site.

Article Link: Apple Temporarily Relaxes Notarization Requirements in macOS Catalina for Non Mac App Store Apps
 
Article Link
https://www.macrumors.com/2019/09/03/apple-macos-catalina-notarization-mac-apps/
RumorConsumer

RumorConsumer

macrumors 68000
Jun 16, 2016
1,608
1,085
I’m not a fan. Maybe the world has changed but as a kid running some random program from the web was a rare pleasure. Yeah as I’m thinking about it there is a ton of crap out there. I’m sure they thought about it. We’ll see the effects. What about apps that aren’t being developed anymore?
 
  • Like
Reactions: KazKam, mishaneah, compuguy1088 and 8 others
casperes1996

casperes1996

macrumors 604
Jan 26, 2014
7,425
5,542
Horsens, Denmark
macduke said:
I assume we'll be able to disable this since it's a Mac?
Click to expand...

RumorConsumer said:
I’m not a fan. Maybe the world has changed but as a kid running some random program from the web was a rare pleasure. Yeah as I’m thinking about it there is a ton of crap out there. I’m sure they thought about it. We’ll see the effects. What about apps that aren’t being developed anymore?
Click to expand...

nt5672 said:
Is there a way to turn this off in Catalina?

Like SIP there are times when this is not desired and to not be able to turn it off is a major reason not to use Apple hardware.
Click to expand...

Blkant said:
If there isn’t an option to disable this bs that’s the ultimate rubicon for any real desktop OS.
Click to expand...

Hey. I am a software developer, with a Catalina install.

"Disabling it" is a phrasing that I'd have to say, no you cannot to.
But you can ignore it. "Run anyway" so to speak. It's not that it blocks you, it just warns you and makes it more steps to run potentially harmful software. Anything executed from command line will execute like normal, and I believe also if you alt-click and select open.
Furthermore, it's not an app review process. To get notarised doesn't mean Apple needs to approve of what you do. It's an automated process that just checks for security, not content. And it only affects signed software; Thought I'd say software should be signed if intended for release these days.
 
  • Like
Reactions: yoyo kayak, macduke, compuguy1088 and 14 others
J

JoeCassara

macrumors member
Aug 16, 2018
48
220
>Apps that are distributed outside of the Mac App Store must be notarized by Apple
>in order to run on the macOS Catalina operating system set to be released this fall.

That's not true.

The situation is nuanced. Apple has stated that you will always be able to run any software of your choosing on macOS -- though you'll encounter some friction in Catalina and, speculatively, in future releases of the OS, requiring you to be explicit in your intentions. Notarization is required for apps signed with a Developer ID certificate, and there are caveats to this requirement depending on several cases.

Without getting mired in developer-speak: relax. This is not Apple cordoning off all unsigned, non-notarized software from macOS.

For the curious, check out these resources:
 
  • Like
Reactions: jhfenton, compuguy1088, Mascots and 16 others
im_to_hyper

im_to_hyper

macrumors 65816
Aug 25, 2004
1,366
375
Pasadena, California, USA
So for those of us who just use a Mac and want to run old software (64-bit, clearly) we can?

For those of us considered “users” all this means is we just click “allow” to allow something to run, as is the case in previous versions?

The overall wording makes it seem like Apple is only allowing “officially approved software” and that anything you bought in the past will not run.

JoeCassara said:
>Apps that are distributed outside of the Mac App Store must be notarized by Apple
>in order to run on the macOS Catalina operating system set to be released this fall.

That's not true.

The situation is nuanced. Apple has stated that you will always be able to run any software of your choosing on macOS -- though you'll encounter some friction in Catalina and, speculatively, in future releases of the OS, requiring you to be explicit in your intentions. Notarization is required for apps signed with a Developer ID certificate, and there are caveats to this requirement depending on several cases.

Without getting mired in developer-speak: relax. This is not Apple cordoning off all unsigned, non-notarized software from macOS.

For the curious, check out these resources:
Click to expand...
 
  • Like
Reactions: nerdherdster
xbjllb

xbjllb

macrumors 65816
Jan 4, 2008
1,365
254
One day, not so far off, Mac Users are going to have their "Network" moment, and it won't be quiet.
 
Appleman3546

Appleman3546

macrumors 6502
May 13, 2019
406
690
It is no coincidence that Apple is implementing this with the ability to port iOS apps to the Mac App Store. It used to be that Apple would allow downloads of Apps from browsers without Apple oversight in order to compete with Windows, but it appears that allowing Mac browser downloads of apps without some sort of Apple control was contrary to Apple’s valuable iPhone App Store monopoly excuse of security concerns. My my how valuable that App Store monopoly has become that Apple is willing to give Windows an easy dunk
 
casperes1996

casperes1996

macrumors 604
Jan 26, 2014
7,425
5,542
Horsens, Denmark
im_to_hyper said:
So for those of us who just use a Mac and want to run old software (64-bit, clearly) we can?

For those of us considered “users” all this means is we just click “allow” to allow something to run, as is the case in previous versions?

The overall wording makes it seem like Apple is only allowing “officially approved software” and that anything you bought in the past will not run.
Click to expand...


You can run anything you want to. Old software won't even give you the increased friction. Signed software is timestamped with when it was signed, and the extra warnings and steps to run un-notarized software only apply to software signed past a certain date. Old software will work the same as it always has.
 
casperes1996

casperes1996

macrumors 604
Jan 26, 2014
7,425
5,542
Horsens, Denmark
OriginalMacRat said:
I guess you haven't run into the Catalina message "App can't be opened because Apple cannot check it for malicious software."

Not even an old app. It was installed Aug 19.
Click to expand...


For one of the tech talks at WWDC when notarisation was announced, Apple explicitly said that before a certain date of signing notarisation wouldn't be necessary, but only apps signed after that threshold, at which point they knew to sign it and get it notarised. If you run software that hasn't been updated for years, it won't show that message, but it hasn't been notarised, obviously since it's years old. The software you're referring to must clearly be new enough that they had the chance to get it notarised. But you can still get around this by using the Open menu, opening through Terminal, or maybe through System Preferences.
 
jonblatho

jonblatho

macrumors 68030
Jan 20, 2014
2,509
6,193
Oklahoma
macduke said:
I assume we'll be able to disable this since it's a Mac?
Click to expand...

nt5672 said:
Is there a way to turn this off in Catalina?

Like SIP there are times when this is not desired and to not be able to turn it off is a major reason not to use Apple hardware.
Click to expand...

You can bypass it using the same method used for unsigned apps (right click > Open), which presents the same prompt but with a button that allows you to open the app. It’s not perfect, though, and it’s probably why Apple’s temporarily delayed this change.

An example: Firefox was completely broken on macOS Catalina because it was unable to launch the separate Firefox Software Update app at launch and the user could not launch it themselves, not even with the workaround. Had to reinstall Firefox from another browser to fix it. This definitely needs more time when it’s a showstopper bug for a major browser and God knows what else.
 
  • Like
Reactions: macduke and compuguy1088
casperes1996

casperes1996

macrumors 604
Jan 26, 2014
7,425
5,542
Horsens, Denmark
OriginalMacRat said:
And the average user isn't going to know that.

They'll only know that their Mac isn't working right.
Click to expand...

If you don't know how to open a non-notarised app, you probably shouldn't open it. A car that won't start if you don't wear your seatbelt, may have legit reasons for wanting to unbuckle your seatbelt after you've started it, but the average driver really shouldn't. All apps you'll need should be notarised by release of macOS Catalina
 
  • Like
Reactions: yoyo kayak, jhfenton and Xirian
I

ignatius345

macrumors 604
Aug 20, 2015
6,872
11,213
Ritsuka said:
Signed software *must* be notarised. Unsigned software runs just like before.

Reading comprehension fails a bit too much in this thread.
Click to expand...
Don’t get huffy at readers. The article says

Apps that are distributed outside of the Mac App Store must be notarized by Apple in order to run on the macOS Catalina operating system set to be released this fall.
​
which is apparently a bit misleading, or at least incomplete.
​
 
  • Like
Reactions: yoyo kayak, Shirasaki, Atomic Walrus and 4 others
J

Jerry Fritschle

macrumors regular
Mar 30, 2004
222
435
vipergts2207 said:
Where in the article does it mention unsigned software not needing to be notarized?
Click to expand...
Apple’s wording may be vague, but unsigned software may run as before by the normal method. “Signed” software (which itself is a prerequisite for notarization) must additionally be notarized.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom