Everything you need to know about app notarization in macOS Catalina

Apple is going to require an additional certification step for apps distributed outside of the Mac App Store. But before you panic about the openness of the Mac ecosystem, know that the situation is bit more complicated than it seems.

Related:

• PSA: macOS Catalina will kill your 32-bit apps — here’s what you should know
• App Store not working in macOS Catalina, How-To Fix
• Need to run 32-bit apps on macOS Catalina? Use a Mojave virtual machine

That additional step is called app notarization — and Apple actually debuted it back in macOS Mojave. While the mechanism isn’t brand new, the company is implementing a new app notarization requirement in macOS Catalina.

Here’s what you need to know.

What is App Notarization?

In the most basic terms possible, app notarization is essentially a way for Apple to vet or check applications and software distributed outside of the App Store.

Through the notarization process, Apple scans software for malicious content and code-signing issues. App notarization is automated, however. That’s a big difference from the App Store’s review process.

As far as the actual process, there won’t be much change for users. Developers, on the other hand, will need to notarize their app. That will require a Developer ID certificate and actually submitting an app to Apple’s notarization system.

Notarization is meant to be a process to protect users from malware, code injection and other malicious threats. It is not a way for Apple to approve or ban any app from a Mac based on its content. Notarization attaches a ticket to signed apps. Gatekeeper will check for notarization on all non-Mac Store Apps beginning in macOS Catalina.

Putting it another way, Apple isn’t checking for what an app does. Unlike the Mac or iOS App Store, there won’t be any restrictions on what kinds of apps you can download. It’s only checking the app for malicious content and code-signing issues.

What’s changing in macOS Catalina?

In macOS Catalina, Apple is requiring apps distributed outside of the App Store to be notarized before Gatekeeper will give them the green light.

More specifically, Apple says that “all new or updated kernel extensions and all software from developers new to distribution with Developer ID must be notarized in order to run.”

Apple also says that “beginning in macOS 10.15, notarization is required by default for all software.” It’s a bit more complex than that, however.

The changes only specifically apply to newly signed apps and executable code built after June 1, 2019. More than that, software built before April 7, 2019 shouldn’t require notarization in macOS Catalina (at least in theory).

What this means for users & developers

To be clear, the app notarization requirement will not completely break your apps in macOS Catalina. There has been quite a lot of confusion in the Apple blogosphere over this matter.

Apple will continue to let you run any software that you want on its Mac platform (which differs from its philosophy on iOS). Some media outlets have reported that macOS Catalina won’t run unsigned apps. That isn’t true. At best, it’s misleading.

In other words, you will still be able to run non-notarized and even unsigned apps in macOS Catalina. But there may be additional steps and the process will be overall a bit more complicated.

You won’t be able to “disable” the feature, but you will be able to ignore it in a “run away” capacity. According to some developers, running software from the command line or alt-clicking an app will also bypass Gatekeeper.

What that looks like in practical terms is explicitly ignoring a Gatekeeper popup and perhaps some additional steps not present in past versions of macOS.

On the other hand, Apple has hinted that the situation may even be more complex in a future version of macOS. You may not be able to run non-notarized or unsigned apps at all in an upcoming update.

When will this take place?

Technically, Apple will start requiring that developers notarize their apps in macOS Catalina. By all accounts, macOS Catalina should drop some time this month, possibly during the week of Sept. 16.

Of course, unless you download macOS Catalina, the restrictions won’t apply to you. Despite the new requirements, we still recommend users download the latest Mac updates to mitigate bugs and security threats.

However, Apple recently relaxed some of the notarization requirements to help ease both users and developers through the transition.

For developers, that includes being able to notarize apps that don’t have Hardened Runtime enabled; have not been signed with a Developer ID; or apps that were built with an older SDK than Apple’s more recent toolkits.

These prerequisites apply until January 2020, according to Apple’s documentation on the matter.

What are the implications of app notarization?

Some developers and users are concerned about the implications of the app notarization requirements in macOS Catalina (and beyond). And at face value, it looks like they could have reason to worry.

Apple could ban any non-notarized software in a future version of macOS. Based on the direction that it’s heading, the process could be as simple as “flipping a switch,” so to speak.

For users who appreciate the fact that macOS is an open operating system — as opposed to something like iOS — the app notarization requirements look like a warning sign. On the other hand, that does appear to be the quickest way to lose the support of enterprising developers and professional Mac users.

But Apple could simply be using app notarization to add a bit of extra security (or security theater) to the Mac without forcing all apps to go through the Mac App Store, as it does for iOS.

In our opinion, and the opinions of many developers, this seems like the most likely scenario. But, of course, it’s hard to predict what Apple is going to do so take this forecast with a grain of salt.

Michael Peterson( Senior Writer )

Mike is a freelance journalist from San Diego, California.

While he primarily covers Apple and consumer technology, he has past experience writing about public safety, local government, and education for a variety of publications.

He’s worn quite a few hats in the journalism field, including writer, editor, and news designer.