How can you run apps and executable code that hasn’t been notarised? Can you also run those with broken signatures, or none at all? And do the controls actually disable Gatekeeper or XProtect?
spctl
macOS Sequoia and Tahoe have changed the way Gatekeeper and XProtect are controlled. Can a user disable them, and if so, how? And how can you check whether both are enabled?
Although macOS won’t tell, Apparency will, even down to launch constraints. Other alternatives, and how to check in the command line.
You may be surprised to learn that SIP or XProtect are disabled, that the SSV isn’t working, or that your security systems are way out of date.
Despite its lack of security release notes, the 11.5.2 update contains new versions of several important security executables, including spctl, sandboxd and syspolicyd.
Stepping through building it correctly in Xcode, turning it into an Installer package getting it notarized and the ticket stapled to the tool.
Validating signatures isn’t straightforward. GUI apps are limited, and command tools confusing and prone to user error.
Yesterday, I explained how you can ensure that macOS 10.15 Catalina will open an app which doesn’t meet […]
Now can check apps (bundles with the extension .app) to determine whether they’re notarized, from Apple, App Store, etc.
It took 5 apps, 4 command tools in 6 commands, 2 developer certificates and an app-specific password for 260 lines of code.
The Eclectic Light Company 