Notarization is now obligatory for developers, but at the same time, we’re still able to run our own apps that aren’t notarized. Here’s how that works, and why.
quarantine
App launch security is built in multiple layers, and not all check are run on every launch of an app. Syspolicy plays a key role, CDHashes are now central, and XProtect scans can make checks on large apps slow.
Three malicious apps – Atomic Stealer, Genieo and XCSSET – against macOS 14.6.1, with full security, SIP disabled, and Gatekeeper disabled.
If you thought spctl disabled Gatekeeper assessments, and disabling SIP had little effect, then you might like to think again.
Details of security checks including Gatekeeper, XProtect and notarization, performed when launching an app in full security.
How is it going to be harder to run apps that haven’t been notarized in Sequoia, and does it bring any benefit in return for the inconvenience?
It has often been assumed that App Store apps don’t undergo app translocation. That isn’t true: here’s an example of one that gets stuck in eternal translocation because it comes with an unwanted gift.
Some apps have odd problems when they’re run in translocation. Here’s how to tell whether they are, and what to do about it.
Gatekeeper may decide to run a new app from a random location, in translocation. The rules for this are explained, and how to ensure that doesn’t affect your apps.
All apps now undergo Gatekeeper assessment, but only some have XProtect checks for malware, and the unfortunate few get translocated too.
The Eclectic Light Company 