本頁面暫無您所用語言的版本，您正在閱讀英文原文。
Glossary
Notarization
Notarization is an automated check Apple runs over a signed app, after which macOS opens it without stopping.
What Apple checks
A signed build is uploaded to a service that scans it automatically and answers within minutes. Nobody reads the source and nobody judges what the app is for.
A pass produces a ticket: a record held by Apple that this exact build was scanned and came back clean.
The round trip
Four steps, and skipping the last one of them is the mistake that costs a publisher the most.
Nothing here is interactive: the whole trip is a build going up and an answer coming back down.
- 1
Sign with a developer certificate
The identity Apple issues for distribution outside its store, with the hardened runtime turned on.
- 2
Send the build up
The notary service takes the archive and answers with a log, whether it passes or fails.
- 3
Staple the ticket
The answer is attached to the file itself, so a machine with no network can still read it.
- 4
Ship the stapled file
The first launch then reports that the software was checked and nothing malicious was found.
What the person opening it sees
The state of the build decides the whole of the first minute on a Mac that has never met it before.
The difference is not a warning against a green light. It is a stop against an ordinary launch.
| State of the build | First launch on a fresh Mac |
|---|---|
| Signed, notarized, ticket stapled | Opens, with a line saying it was checked for malicious software |
| Signed, not notarized | Stopped, and allowed only by hand from the security settings |
| Not signed at all | Stopped in the same place, with the developer reported as unidentified |
Why the ticket is stapled
Without stapling the system asks Apple over the network at the first launch. A laptop with no connection then behaves as if the build had never been checked.
Stapling puts the answer inside the file, so the check holds on a plane and inside a closed network.
What it is not
The step is young enough that three older things keep getting mistaken for it, and each of the three promises something different.
Store review
Human review judges what an app does and takes days. The notary service only scans, and it answers in minutes.
A signature
Signing comes first and is done by the publisher. This step comes after and is done by Apple.
A verdict for life
A ticket can be revoked later, and a build that used to open can stop opening.
Where it does not apply
This is a macOS mechanism. Windows has no matching step: its gate weighs the signature together with the reputation a file has earned.
Linux distributions verify signatures over a repository, and a file downloaded outside one meets no comparable check.
What this does not do
- It does not review what the app does. The scan looks for malicious patterns, not for behaviour you would personally object to.
- It does not replace signing. An unsigned build cannot be notarized at all, so the two always travel as a pair.
- It does not cover other systems. Windows and Linux have gates of their own and neither of them uses this one.
- It does not settle the matter forever. A ticket can be revoked, and a machine will then refuse a build that opened yesterday.
Check it
Each line here is a command you can run yourself, against an app that is already on your Mac.
- Whether a ticket is stapled to the file
- xcrun stapler validate /Applications/<any app>
- What the gate answers about that app
- spctl --assess --type execute --verbose /Applications/<any app>
- Whether the hardened runtime is on
- codesign --display --verbose=2 /Applications/<any app>
- The log the notary service returned
- xcrun notarytool log <submission id>
Questions
- How long does it take?
- Usually minutes. The answer comes back as a log, with the reason for any refusal written in it.
- Does Apple see my source code?
- No. The service takes a built and signed archive, and the sources never leave the machine that produced it.
- What happens on a Mac with no network?
- A stapled ticket is read straight out of the file. Without stapling the machine has nobody to ask and treats the build as unchecked.
- Is this the same as being in the App Store?
- No. The store adds human review, its own rules and its own delivery, while this step only lets a build from anywhere open quietly.
- Can a notarized app still be malware?
- It can. The scan is automated, and the ticket exists partly so that it can be taken away when something is found later.
The signature underneath it
Nothing can be notarized until it is signed, and the signature is where the whole chain of trust starts.