Do you need to notarize a Mac app you sell yourself?

Updated · Dmytro Virych

Guide · 2 min read

Yes — an app you distribute outside the Mac App Store should be signed with a Developer ID certificate and notarized by Apple, so Gatekeeper lets people open it without a warning.

When someone downloads your app from your website and opens it, macOS's Gatekeeper decides whether to let it run. Two things from Apple make that decision go your way: a Developer ID signature and notarization.

What the Developer ID signature does

Apple describes it plainly: a Developer ID certificate "lets Gatekeeper verify that you're a trusted developer when people download and open your app" from outside the Mac App Store. The certificate comes with a paid Apple Developer Program membership, and every executable inside your app — frameworks, helper tools, the updater — has to be signed with it.

What notarization adds

Notarization is a scan Apple runs on software you have already signed. You upload the app, Apple checks it for malicious code and for common signing mistakes, and returns a ticket. You then staple that ticket to your disk image, so a Mac that is offline can still verify it.

Apple notes that the notary service also "catches common code signing problems that can prevent your software from installing properly" — which is the part that saves you support email: most "the app is damaged" reports are a signing mistake, and notarization finds it before your customer does.

What happens without them

An app that is not signed and notarized is stopped by Gatekeeper when a person opens it from a download, with a warning that most buyers will not click past. For a paid app that is the end of the sale.

The steps, in order

  1. Build the app with the hardened runtime enabled.
  2. Sign every nested component inside-out, then the app, with your Developer ID Application certificate and a secure timestamp.
  3. Put the app in a disk image and sign that too.
  4. Submit the disk image with notarytool and wait for "Accepted".
  5. Staple the ticket to the disk image.
  6. Check it the way a stranger's Mac will: spctl should report "Notarized Developer ID".

The template's release script runs all six, launches the signed app on both Apple silicon and Intel before it spends time on notarization, and stops before publishing anything, so the irreversible step stays yours.

#notarization#distribution

Sources