I have an installer app which will download our macOS app from server (as zip) and extract it to the root folder of a USB flash drive. Both installer and the macOS app are code signed / notarized with the same Developer ID certificate and Team ID. What to expect? macOS Ventura should allow my installer to extract the app bundle to the root folder of the USB flash drive. What happened? macOS Ventura doesn't allow my installer to extract the app bundle to the root folder of the drive, App Management notification was triggered. It does allow my installer to extract the software to any subfolders on the USB drive. I am forcing my users to enable Full Disk Access before installing the software to their USB drive, this is not ideal. Is it a bug of Gatekeeper?

I have MacOS bundle application which I've signed, packed into dmg and notarized. When I upload and download the dmg, copy the app somewhere, it is rejected by gatekeeper: “my” cannot be opened because the developer cannot be verified. or “check-signature” cannot be opened because it is from an unidentified developer. Tested on Monterey and High Sierra. In past it worked, but my HDD crashed so I had to install OS and whole development environment again so now I'm trying with different xcode version (13.4.1) and some 3rd party c++ libraries are newer, but basically layout of the application is the same and also code signing post build script which calls codesign inside out. In the Contents/MacOS folder my application contains nested bundle app. When I omit that nested bundle and notarize the app, gatekeeper is happy, but I need that nested application. When I verify dmg, or extracted application, there is no problem: spctl -a -t exec -vvv my.app  my.app: accepted source=Notarized Developer ID origin=Developer ID Application: my company (L….) spctl -a -t exec -vvv my.app/Contents/MacOS/nested.app my.app: accepted source=Notarized Developer ID origin=Developer ID Application: my company (L….) codesign --verify --deep --strict -v my.app my.app: valid on disk my.app: satisfies its Designated Requirement I've also tried check-signature tool (ironically it is not notarized) ./check-signature my.app .my.dmg  (c) 2014 Apple Inc. All rights reserved. my.app: YES my.dmg: YES I've also checked the logs, I've found nothing suspicious. Mounting the DMG: assessment granted for my.dmg by Notarized Developer ID com.apple.message.domain: com.apple.security.assessment.outcome2 com.apple.message.signature2: bundle:UNBUNDLED com.apple.message.signature3: my.dmg com.apple.message.signature5: UNKNOWN com.apple.message.signature4: 3 com.apple.message.signature: granted:Notarized Developer ID Some log from finder about opening the app, then this from syspolicyd: assessment granted for .app by Developer ID com.apple.message.domain: com.apple.security.assessment.outcome2 com.apple.message.signature2: bundle:com.my com.apple.message.signature3: .app com.apple.message.signature5: 1.0 com.apple.message.signature4: 1 com.apple.message.signature: granted:Developer ID I've followed advices from other threads from this forum, but I cannot figure out anything. Any idea what else can I do to see what exactly is the problem? Thank you.

I'm developing a custom library that is loaded in a third-party software. The library is being built using CMake, and then signed using the codesign tool with a "Developer ID Application" certificate. The signing process works just fine, and I get the following output when I check for the correct signature: xxxxx@MacBook-Pro-JS Downloads % codesign -dv --verbose xxxxxx.so Executable=/Users/xxxxxx/Downloads/xxxxxx.so Identifier=xxxxxx Format=Mach-O thin (x86_64) CodeDirectory v=20400 size=8115 flags=0x0(none) hashes=248+2 location=embedded Signature size=8967 Authority=Developer ID Application: Binho LLC (VG9F9RW797) Authority=Developer ID Certification Authority Authority=Apple Root CA Timestamp=30 Sep 2022 at 17:56:49 Info.plist=not bound TeamIdentifier=VG9F9RW797 Sealed Resources=none Internal requirements count=1 size=176 I can also verify the signature with the following command: xxxxxx@MacBook-Pro-JS Downloads % codesign --verify --verbose xxxxxx.so xxxxxx.so: valid on disk xxxxxx.so: satisfies its Designated Requirement However, when I load it in the third-party software, I get the following OS prompt: "xxxxxx.so" can't be opened because Apple cannot check it for malicious software. This software needs to be updated. Contact the developer for more information. Note: the warning only shows on some systems, and not on others. Am I missing any step to avoid Apple from identifying my library as malicious software? Thanks in advance.

Is it true that signing should always over-write any existing code-signing?I ask because I've had a recent case where this was done in SD Notary. The signing (of a framework) succeeded and notarization succeeded, although the app then failed when it tried to load the framework. I checked the logFileURL and there was an issue saying the framework was not signed.I repeated the exercise, this time starting with an un-signed version of the framework, and all went well. (I have no idea how the previous version was signed -- it was from a user).

Hi. We have an app whose current version has a component that is not code signed, which in turn shows up in the login items as coming from an unidentified developer. We did the required changes and, when doing a fresh install, said component does not show up anymore (yay!). The problem is when doing an upgrade, from the version that has the unsigned component to the newer one, as Ventura still shows the same component with the same description even though checking the signature shows that it is code signed. Is there some extra step we need to do so that the OS updates the state and the component is not there anymore?

We noticed there had been a new "App Management" permission option under "Privacy & Security" settings introduced in the upcoming Ventura release. It accidentally blocked some of our scripts modifying parts of our product, which, at this point, proved to be problems on our end and can be resolved by us. However, we are in general wary that there doesn't seem to be any documentation on this new option and what behaviors would run into its way. Are there any guidelines Apple can provide? Also, IF it turned out at some point we couldn't work around this option, is there a corresponding MDM payload we can grant certain apps this permission through a profile (we are largely dealing with enterprise customers)?

I am trying to build a c++ application for Mac, I have followed all the steps for codesigning the application code, codesigning the DMG, notarising the DMG and also stapling the DMG after successful notarisation. But when I try to open the application on Mac gate keeper is blocking the application from opening and opening the popup with error message as " '<Application_Name>' cannot be opened because the developer cannot be verified." What could be the reason? Please help.

Hi,My software installs frameworks in the local domain (/Library/Frameworks) that are accessed from third-party apps. Some of these apps are simply code-signed, others are sandboxed. They are obviously signed by other companies, and so far there have been no problems on the part of DYLD in loading and executing code inside our frameworks. The loader is happy to continue looking for our framework outside the app container, in the case of sandboxed apps.What changes are necessary to ensure that our frameworks remain accessible from hardened apps? Hardened Runtime, to the best of my understanding, only allows executables to load code that has been code-signed by the same team, or by Apple. I also think that hardened runtime affects only executables, and yet when I enable the ENABLE_HARDENED_RUNTIME setting in Xcode on my framework targets (via xcconfig) it clearly influences the way they are signed, and suddenly these "hardened frameworks" fail to be loaded by third-party apps, even if these apps aren't yet hardened themselves. In what its perhaps the key to solving this issue, how can one mark non-app targets to enable the library-validation exception? Why would a non-hardened app fail to load code whose only difference may be a simple flag (kill,runtime) in its signature?Maybe I'm wrong to assume that non-app targets deserve any special treatment, but the fact remains that when I enable hardened runtime, our code simply stops being "seen" and loaded by DYLD, with all other variables remaining identical.Thank you!Gabe

Hi everyone, Since macOS 12.3+ removed built-in Python, I try to bundle the official Python installer package (.pkg) in our Mac Application (.app). Therefore the user can install Python directly in the application to make one of our app functions correctly. However, this application cannot be opened because macOS cannot verify that this app is free from malware. This issue happened on macOS 12.4, but it can be opened without any error messages on macOS 10.14.6. When bundling the package, I did re-sign it using our developer ID certificate, And the app also passes the notarization process. Then I checked the following utilities on macOS 12.4 and all of them are correct. Please help me to solve this issue. Thank you very much. Checking the Gatekeeper: spctl -a -t exec -vvv --ignore-cache Spark.app Spark.app: accepted source=Notarized Developer ID origin=Developer ID Application: *** Inc (SKLFZ4533Y) Checking the signature of application: codesign -vvv --check-notarization --deep Spark.app --prepared:/Users/oz-chc/Downloads/Spark.app/Contents/Helpers/python.pkg --validated:/Users/oz-chc/Downloads/Spark.app/Contents/Helpers/python.pkg Spark.app: valid on disk Spark.app: satisfies its Designated Requirement Checking the signature of Python package after re-sign and bundle it. (I marked the fingerprint) pkgutil --check-signature Spark.app/Contents/Helpers/python.pkg Package "python.pkg": Status: signed by a developer certificate issued by Apple for distribution Notarization: trusted by the Apple notary service Signed with a trusted timestamp on: 2022-08-25 03:07:00 +0000 Certificate Chain: 1. Developer ID Installer: *** Inc (SKLFZ4533Y) Expires: 2024-10-25 04:12:29 +0000 SHA256 Fingerprint: ****** ------------------------------------------------------------------------ 2. Developer ID Certification Authority Expires: 2027-02-01 22:12:15 +0000 SHA256 Fingerprint: ****** ------------------------------------------------------------------------ 3. Apple Root CA Expires: 2035-02-09 21:40:36 +0000 SHA256 Fingerprint: ******

I have created signed some binaries with Apple development certificates and then revoked the certificate from developer account. After revocation of certificate, gatekeeper is not blocking the execution of binaries. Even evaluating these revoked certificates in keychain is showing valid certification and successful evaluation . Same applies for Installer certificate. I tried checking revocation status of binary using method "SecPolicyCreateRevocation(kSecRevocationUseAnyAvailableMethod)" but we are getting trust result as 'kSecTrustResultUnspecified'. Please tell me how to check if certificate is revoked using any utility. Also let me know if I am missing anything in revocation check call.

Hello, We are trying to codesign our osx binary which we created. $ codesign --verbose=4 --timestamp --strict --options runtime -s "Developer ID Application: Rill Data, Inc (XXX)" macOS-x64/application/rill --force macOS-x64/application/rill: replacing existing signature macOS-x64/application/rill: signed Mach-O thin (x86_64) [rill] $ codesign --verify macOS-x64/application/rill --verbose=4 macOS-x64/application/rill: valid on disk macOS-x64/application/rill: satisfies its Designated Requirement We also tried creating the pkg, we were able to install it locally but when actually executing the binary it again complained "Apple cannot check it for malicious software" We also tried getting it notarized but that also fails. $ xcrun altool --notarization-info <hash> -u <> -p <> No errors getting notarization info. Date: 2022-08-19 05:26:14 +0000 Hash: <hash> RequestUUID: <hash> Status: in progress Status Code: 2 Status Message: Package Invalid

Odd one here. I'm having trouble getting a signed, notarised, stapled app to actually run. It is packaged as a zip file. When uncompressed and run from finder, I get "“iShowU Switcher” cannot be opened because the developer cannot be verified." and "macOS cannot verify that this app is free from malware." (this is publicly available, https://shinywhitebox.com/download-thanks/17/1 - app is called iShowU Switcher, currently in development) Here's what I've checked: signed codesign --verify --deep --verbose iShowU\ Switcher.app iShowU Switcher.app: valid on disk iShowU Switcher.app: satisfies its Designated Requirement notarized spctl -a -t exec -vvv iShowU\ Switcher.app iShowU Switcher.app: accepted source=Notarized Developer ID origin=Developer ID Application: Shiny White Box Limited (PMJ275ZTUX) stapled xcrun stapler validate iShowU\ Switcher.app Processing: /Users/neil/Downloads/iShowU Switcher.app The validate action worked! So it all looks sane to me. If I remove the quarantine bit (xatter -d -r) then the app runs fine. Ideas of where to next look?

PackageKit: Begin install 8 Dec 14 10:33:18 loca lhost installd [51841： Packagekit: PKInformsystemPolicyInstal1operation failed with error:An error occurred while registering installation with Gatekeeper

Hello, I have a notarized application distributed outside the Mac App Store which is working properly at the moment. Recently I added the ability to load third-party plug-ins in the application, and thus Library Validation needs to be disabled. However, after I disabled it, the app is no longer passing Gatekeeper checks, and can only be launched via "Right Click &amp;gt; Open". If I remove the com.apple.security.cs.disable-library-validation entitlement again, the app can pass the Gatekeeper, but that prevents the app from loading third-party plug-ins. I noticed that the documentation mentioned: Because library validation is such an important security-hardening feature, Gatekeeper runs extra security checks on programs that have it disabled. If your program is blocked by Gatekeeper, check whether you’ve unnecessarily disabled library validation. and was wondering whether it has something to do with this. Appreciate any suggestions. Thanks.

For some reason, I have to develop a command-line tool for my company and pushlish it in my company. So, After my development, I try to notatize it. And after notatization, it can not wok. My step is as follow: complie it as [tool]. run commands as follows : codesign -fs [fs] --timestamp --force --deep --options runtime --entitlements [plist_path] [tool] codesign -dvvv [tool] productbuild --identifier [bundleId] --sign [cert] --timestamp --install-location --root [tool_folder] / [tool_folder_pkg] xcrun altool --notarize-app --primary-bundle-id [bundleId] --username esc@tencent.com --password [password] --file [tool_folder_pak] xcrun altool --notarization-info [notatizaion_id] --username esc@tencent.com --password [password] xcrun stapler staple [tool_folder_pkg] try to unzip the pkg pkgutil --expand [tool_folder_pkg] [folder] cd [tool_folder_pkg] tar xvf Payload .[tool] get error: zsh: killed   [tool] how can I fix it? Thanks a lot

IMPORTANT This post is now obsolete, having been replaced by: Code Signing Resources Trusted Execution Resources App Sandbox Resources Notarisation Resources App Sandbox: App Sandbox Design Guide Gatekeeper and notarisation: Developer ID landing page Signing a Mac Product For Distribution Manual Code Signing Example Testing a Notarised Product --deep Considered Harmful Update to Notarization Prerequisites (23 Dec 2019) Notarize Your Mac Software for macOS Catalina (3 Oct 2019) Notarizing Your Mac Software for macOS Catalina (3 Sep 2019) New Notarization Requirements (10 Apr 2019) Notarizing Your App Before Distribution Customizing the Notarization Workflow WWDC 2019 Session 701 Advances in macOS Security WWDC 2019 Session 703 All About Notarization Safely open apps on your Mac (from Apple Support) Share and Enjoy — Quinn “The Eskimo!” Apple Developer Relations, Developer Technical Support, Core OS/Hardware let myEmail = "eskimo" + "1" + "@apple.com" Change history: 5 Jun 2015 — First posted. 25 Mar 2020 — Updated with a bunch of notarisation resources. Changed the title to About App Sandbox, Developer ID, Notarisation. 30 Mar 2020 — Add a link to Manual Code Signing Example. 18 May 2020 — Added a link to --deep Considered Harmful.

I am trying to notarize the unity build and I do get an email from apple saying that my app is notarized, but when I test it out on my own mac, it says that the app is from an unidentified developer and is malicious software. When I run the command line tool for checking if the app is notarized or not, it tells me that the notarization was rejected and developer id is unknown. Did anyone have this issue or know how to solve it?

We complete this process without any error or issue. But, when we try to open the file it still says " can't be opened because the identity of the developer cannot be confirmed". https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution#:~:text=notarization%20workflow.-,Notarize%20your%20preexisting%20software,-Notarizing%20your%20preexisting Here are the results of running xcrun notarytool log on our notary submission. I have scrubbed it to avoid exposing sensitive information. % xcrun notarytool log --apple-id --team-id Password for:  {  "logFormatVersion": 1,  "jobId": "",  "status": "Accepted",  "statusSummary": "Ready for distribution",  "statusCode": 0,  "archiveFilename": ".dmg",  "uploadDate": "2022-07-07T02:12:43.412Z",  "sha256": "582d852371780441637e1f9d8eb36fa3d6daf1bd8538771fc79522d481908c84",  "ticketContents": [   {    "path": ".dmg",    "digestAlgorithm": "SHA-256",    "cdhash": "55df35c3d99520e5d6167a23668a66905f209f03"   },   {    "path": ".dmg/",    "digestAlgorithm": "SHA-256",    "cdhash": "9a545fd55fb481714a990753ceda696aa637df9a",    "arch": "x86_64"   }  ],  "issues": null }

I develop Adobe AIR apps in Adobe Animate CC on Mac and Windows. For the first time this year, the last publishing process ends with an error msg. On both Mac and Windows, I get this message. Adobe Animate could not sign the AIR file. Unable to build a valid certificate chain for the signer. Please help!!!

We have an application written in C and C++ that runs on Windows, Linux, and Mac. Recently a customer trying to install it on macOS Monterey received a message saying "cannot be opened because it is from an unidentified developer". To deal with this my company has joined the Apple Developer Program. So my question is how do we make use of that membership to get past this problem? Of the three platforms mentioned above, Mac accounts for the fewest customers, so we're not Mac experts. The software is built using Xcode but with makefiles that directly invoke clang or clang++. The finished product is packaged into a .dmg file. Note that we're not intending to put this software into the App Store.