macOS App Notarization: Apple's Security Checkpoint
Notarization is an automated security screening for macOS apps. You upload your app, Apple scans it for malware, and issues a ticket to attach to it. This is mandatory for apps distributed outside the Mac App Store.
WHY IT EXISTS: To protect users from malicious software distributed outside the curated Mac App Store. Before notarization, macOS Gatekeeper could only verify if an app was from a registered developer, not if the code itself was harmful. Notarization adds an automated malware scan by Apple as a prerequisite for launch.
THE MENTAL MODEL: Think of notarization as getting a passport for your app. You sign your app with your Developer ID (its birth certificate). You then submit it to Apple (the passport office), who verifies it's not on a watchlist (malware scan) and issues a notarization ticket (the passport). A user's Mac (border control) checks for this passport before letting the app run, giving the user confidence it's safe.
HOW IT WORKS: The process has three key steps. First, you must code sign your app with a Developer ID certificate. Second, you archive your app (e.g., into a .zip or .dmg) and upload it to Apple's notary service using a command-line tool like notarytool. Third, after Apple's service approves it, you receive a ticket. You must then "staple" this ticket to your app package using the stapler tool so Gatekeeper can verify it offline.
WHEN TO USE IT: It is mandatory for all software distributed for macOS outside the Mac App Store. This includes apps, plug-ins, kernel extensions, and even the disk images they are distributed on. Without notarization, Gatekeeper will block the app from launching on modern macOS versions and show the user a stern warning.
WHEN NOT TO USE IT: You do not need to notarize apps distributed exclusively through the Mac App Store, as they undergo a more comprehensive App Review process. You also don't notarize builds intended for local development and testing on your own machine.
ONE CANONICAL EXAMPLE: A developer builds a utility and wants to sell it from their website. They first archive and sign the app. Then, they run a command like xcrun notarytool submit MyApp.zip --keychain-profile "MyProfile" --wait. After the service returns success, they run xcrun stapler staple "MyApp.app" to attach the ticket. The final, stapled app is then zipped and ready for distribution.
Read the original → developer.apple.com
Get five bites like this every day.
Tezvyn delivers a daily feed of 60-second tech bites with quizzes to lock in what you learn.