Notarization has been a nightmare of a solution to a problem that isn't effective. You can get practically as much security by pushing malware signatures to the client without the massive privacy overreach of having Apple archive each and every bit of code that you generate for distribution.

This is just Apple's overreach extended to the desktop. Excessive control that makes developer's lives hell while adding barely any security on top.

I wrote a little sh script to notarize HandBrake two (or maybe three) years ago, and that's was it. It's not rocket science. But like every new thing, it required a bit of time to read the documentation and to understand what's going on.

The plugin issue described in the article is probably related to the hardened runtime, so it's unrelated to the actual notarisation process.

The initial setup is a bit of a pain (and the documentation is a bit lacking - though much better than most Apple documentation - particularly for edge cases like mine, distributing a screensaver), but to Apple's credit the process is pretty solid and is now consistently quick. I've notarized dozens of builds of Aerial since the requirement was announced and I think only once did I have to wait to release because their service was stuck.

Minor tip: Stapling, while optional, should be recommended (and might as well be mandatory) to everyone that notarize (you staple a certificate signed from Apple that avoids the call home when the user tries to open your software).

The only thing that slightly irks me is the contract situation, if you have a "paid" developer account, you absolutely need to sign any update to the "paid app" contract from the App Store even when you want to notarize an "out of store", open source app.

Plus it breaks my script every time...

And, not mentioned in the article... you have to have an Apple Developer ID which costs £79/year ($99). Presumably if your subscription lapses any previously released software will stop working?

That is the part I find most offensive, if it was just difficult and buggy I would suck it up and work around it. But having to pay for the privilege is too painful, particularly if you're offering free software.

For my case (non GUI app) I can at least distribute via Homebrew and have the user build from source in a more or less automated way.

Another notarization helper tool is here https://github.com/mitchellh/gon

I don't get the whole panic around notarization. I maintain a big open source project, and is quite complex. It is a game engine with downloadable plugins and lots of system integration. Notarization was easy. I didn't use Xcode GUI for it, because it has one line command to do it, which is more comfortable for me: https://github.com/coronalabs/corona/blob/53eeb3e31ac09f7a46... Not a biggie.

Could we get a year added to the headline?

The blog post talks about waiting to upgrade to macOS 10.15, but the current macOS is version 11, so I'm thinking this is fairly old. Because at first I thought this might have been related to a recent info.plist vulnerability. [0]

[0] https://www.wired.com/story/macos-malware-shlayer-gatekeeper...

I've just barely got my app working with code signing (using desperate amount of self-checks and fixups for when Xcode messes up the build or signing decides to use xattrs, which doesn't survive in normal archive formats).

Now I'm battling with Notarization which is exactly this hell that either pretends to work and doesn't, or spits inscrutable errors and sends me in circles between multiple tools and services.

And these days all the documentation that Apple produces is in form of brief mentions in WWDC videos. Aaaarrggh!

I'm seriously considering switching to WASM or just abandoning my apps.

From personal experience, notarization hasn't really caused any friction in my dev process for Mimestream. The upload + server response usually only takes about a minute. Yeah, it's another thing to learn, but the process is pretty well-integrated into Xcode, and if you're building via script then it seems well-supported?

On the other hand, code signing is perennially confusing, and I wish the documentation was better.

The notarization process is super painful, no doubt. I had originally written shell scripts to automate the process for my company, but recently switched to the excellent command line tool 'xcnotary' (https://github.com/akeru-inc/xcnotary). it's available through Homebrew.

I wrote a little thing about signing and notarization recently. I don't harp on the details of the actual platform processes, because the argument is that even if the process was smooth, it's completely unacceptable.

https://nixpulvis.com/ramblings/2021-02-02-signing-and-notar...

There are issues with the way we develop and distribute applications and software in general, but none of the major platforms are doing anything but extracting $$$ for themselves and tricking users into a false sense of security.

The administration around code signing and notarization for both Apple and Windows was huge (1.5 developer months from start to kinks-worked-out for an electron app). Startup lessons learned: don't build desktop apps.

What a fantastic write up. So many of us are familiar with the "quirky" parts of the apple development ecosystem and the self-gaslighting effect of trying to solve problems that are non-existent and yet persistent.

This really captured the constant "wtf" of building against the sloppy moving target.

But... its still better than a lot of toolchains/ecosystems, and when it all does work, for 1 month a year lol, it's great!

Maybe Apple should hire Steve Ballmer, I hear he's available: https://www.youtube.com/watch?v=OHVhiybBb1U

10.15 was released 18 months ago so I assume this article is from 2020.

The process has improved since then so not sure how much of this still applies.

All this code signing stuff is an admission of defeat. "Our OSes are insecure and we can't secure them, so fuck it."

Unix and VMS/NT, the two most popular kernel lineages, were both designed when computers were either isolated or connected to an Internet that was effectively an academic/government walled garden. They absolutely were not designed to deal with the present information war zone where everything is trying to spy/hack/ransomware you and every piece of code is guilty until proven innocent.

Since the Internet went mainstream we've been constantly stuffing wads of chewing gum into their many cracks, adding hack after hack to try to secure that which is not secure. Address layout randomization, pointer authentication hacks, stack canaries, clunky system call whitelisting solutions, trying to shoehorn BPF into a system call filtering role, leaky containers and sandboxes, and so on.

Code signing is an admission that none of those measures have worked.

A secure OS would be built from the ground up with security as a primary concern. It would be written in a safe language like Rust or perhaps even in a system that permits strong proofs of correctness. Every process would run with minimal required permissions. Everything everywhere would be authenticated. The user would have visibility into all this and would be able (if they desired) to control it, or they could rely on sets of sane defaults.

There'd be no need for code signing on such an OS. You could safely run anything and know it would not be able to access things you didn't grant it permission to access. The web JavaScript sandbox is the closest thing we have to that but it's extremely limited. By providing a Turing-complete sandbox that can be generally trusted to run code from anywhere, it does show that such a thing is possible.

(Mobile OSes look like they've kind of done this, but they haven't. They've just stuffed more chewing gum into the cracks in Unix and put a UI on top that hides it. They also "solve" the problem by nerfing everything.)

Anyone think that users will eventually become desensitized to the "malicious software" popup? If the process is this complex and buggy I imagine a lot of developers simply won't bother with notarization. Eventually if enough legitimate apps don't bother the popup will become common, and users may be annoyed more by Apple than any particular app. Like how the "run as admin" prompt just became an extra automatic click to many users in Windows.

It's not like the big development shops that do take the time to get the notarization process working get a special green checkmark by their app. After the app has been launched the first time, it's back to an even playing field with the apps that didn't notarize.

If you're going to rant about details, it helps to actually get the details right.

For example, showing a screenshot that doesn't contain the word "malware" and then saying:

> Using my application name and the word "malware" in one sentence is suggestive and extremely offensive by Apple.

Does not fill me with much hope that the author is detail-oriented. I'll keep reading, and I know already that the notarizing process isn't smooth, but my "snowflake meter" is already in the yellow zone, and I've yet to reach the part of the essay labeled "Part 1"

Yep. This focuses on the command line’s terrible error messages but the Xcode UI is bad too. Clicking through multiple steps, and for some reason non-standard “transparent buttons in list items” are used to reveal the “Export App” action you need to finally obtain a local notarized copy. Except those buttons will not appear after it is “done”; you have to switch to another target and then switch back to get the buttons to be clickable. I mean the whole process just screams “does anyone at Apple ever have to use this?”.

Ha! Even though Notarizing was released in 2018, it's still too soon to discuss for me....

Try packaging a python interpreter with a ton of .so's and .dylibs with your .app and see how much hair you have left!

My advice from years of notarizing my apps is to make sure you do it at least once per day for each of your apps. If you only notarize once every release (say, every month or so), you are almost guaranteed to encounter some new cryptic error that you've never seen before, either due to some glitch in signing your app or frameworks, or else some server-side error such as new terms & conditions that you are being "encouraged" to agree to. It will take you hours to research and resolve them if they aren't spotted right away.

As others pointed out, https://github.com/mitchellh/gon is a great tool for doing this on your local machine (e.g., with a cron job). In addition, if you are building your app using a GitHub action (which I highly recommend if it is open-source), you can use my https://github.com/hubomatic/hubomat action to package, notarize, and staple a release build in one shot. The sample/template app does this automatically on every commit as well as once per day: https://github.com/hubomatic/MicroVector/actions.

So when this fails from a scheduled job, you at least know that something has changed on the Apple side and can investigate that right away. And if it fails as a result of a commit, then at least you can start looking at what changes you may have made to your entitlements or code signing settings or embedded frameworks or any of the other million things that can cause it to fail.

I agree about notarisation, I think it's the wrong solution. It gives Apple too much insight in what applications are used on Macs. This is my business and mine alone. I don't wany my Mac calling home with everything I open. Despite there being a way to turn it off.

I think simply spreading signatures of known malware for a local check would be a much better option.

However as a Mac enterprise admin I don't think the process is particularly difficult. When it came in I scripted it all once and that worked fine. Only issue is that sometimes it doesn't like if I make a PKG with a package from another supplier embedded in it. The problem is that I have to do that because some solutions have several packages that need to be installed in a particular order, and my MDM (MS Intune) does not provide a means by which to specify installation order. It just blasts all packages in a random order at the machines. So I re-package those. But anyway even that is not all that tough to get around.

For our small software company, notarization took at least 40 hours of additional work, and slows down releases.

Anyone knows if "stapling" the distributed bundles files (.app .pkg executable files etc.) is useful in any way ?

Notarization is nothing except Apple making sure they have visibility into the tail end of their ecosystem.

Remember the days of Windows 95 when you could make an application, sell it to a person in your own town and nobody in the world knew?! Not anymore!

Now Apple has to know that you made an app and get an exact copy of it, just for safe-keeping.

FYI: The original title of the post is "The Gates to Hell: Apples Notarizing" evidencing the frustration involved with the notarization process and which now was relativised to just "Apple’s Notarizing".

This is my notary script for a DMG: https://gist.github.com/lunixbochs/0ceeb23be5c3d5c6748165e61...

   ./notary.sh notarize app.dmg
   ./notary.sh staple app.dmg

I store a password as a keychain entry named AC_PASSWORD. If you're running this in headless CI you should run a notarize command once interactively so you can tell keychain to always allow altool to access the password.

While you only have to update your build process once, you now have a noticeable delay for every single release build, and worse, a few times per year, your build will break because you haven’t signed Apple’s latest contract.

And for what? There is no way Apple can make it impossible to get malware notarized.

I got all the Airwindows audio unit plugins notarized in about a week (that's several hundred distinct plugins), and used third party apps to do it (DropDMG and SD Notary)

The trouble I ran into was this: Apple wants the process to be a little mystifying as a barrier to people trying to find exploits within it, I think. I disagree: for instance, using a shell script and the Apple terminal tools is very much the Apple-intended approach, but integrating the third party tool got me sending code to Apple's servers quicker, and it's those servers that matter. I wasn't considered a significant developer to Apple, nor will I ever be, but I code open source software that's being adopted by other projects and used as an on-ramp for would-be DSP coders: my choices and attitudes matter.

Apple in the form of a key Gatekeeper dev had very specific intentions for me: I was strongly advised to use automatic code signing in XCode and use Terminal and a separate workflow to remove the incorrect cert that Xcode assigns, and put in the correct one (Developer ID Application, in this case).

Apple's defaults for an XCode application (written in Swift, because of course it is) and automatic signing, work perfectly first time for something like their example 'hello world' app. For any Audio Unit, this fails every time. You can set it correctly inside XCode from the start, using manual settings. I chose to do this.

Near as I can tell, I am expected to have a manager to whom I will turn over code, and who is the only one with a code signing ID, because as a lowly DSP coder I'm not expected to be allowed to put code out into the wild without supervision. There's a clear expectation that if I mattered, I'd either be the boss of (not necessarily trustworthy) coders, or I'd have a boss whose job it is to be more trustworthy and oversee my code in case I have a wild hair some day and code a bomb into things. I feel there's a resistance at Apple to putting the keys to distribution into the hands of untrustworthy people. Perhaps a belt and suspenders approach? I'm not convinced this is in any way a good thing, though.

Doing the code signing correctly, which is not the same thing as having an Apple-specified process, means every bit of code I generate gets checked for malware by an Apple process. This could save my butt if I got owned by some extremely clever second-level malware that tried to commandeer my XCode and build malware into everything I make. I get that there are also possible risks with having every executable sent to the mothership to be studied: if I competed with them, that's wildly anticompetitive and lets them decompile and pirate anything I do (given sufficient effort). I'm literally sending them all my work before anybody else ever runs it.

I feel that this type of risk (which I'm not convinced is a currently active threat) is better handled by government, regulation, and the law, than by forcing the software ecosystem to normalize running any old code from anywhere.

Doing Apple notarization the way Apple wants it done, should be a nontrivial factor in keeping Apple products from being a giant pile of malware, spyware, and user-manipulation in future. If you're able to do it properly (as in, get the code AUDITED, not 'do it only the way Apple says') the result is distributed plugins and applications that 'just work' the way they used to, but without the same level of risk to the end user.

I think it's worth the trouble to do this. The benefit is clear, and possible dangers of the approach belong to the legal sphere rather than being a technical reason to avoid code signing, or normalize having everybody avoid code signing on your behalf.

An admission of defeat is one way to look at it, or you could describe it as acceptance of reality.

As you point out, security engineers have been working for decades on a vast array of techniques to mitigate classes of vulnerabilities. There's no reason to believe this is something that can ever be finished. There will always be bugs, always. Code signing embraces that reality by making it much easier to contain bad programs after they get out into the wild. It is just another tool in the toolbox, as with all security mitigations.

It's silly to suggest that you can solve security by simply rewriting the entire OS in Rust; and in a modern OS, every process already does run with minimal required permissions, and authentication is generally enforced, and users do have visibility and control, at least by design. Sometimes things slip through, of course. That will still happen even in the shiny new world you're proposing.

The existence of JavaScript does not imply that a completely secure OS is possible. There's a rich history of JS bugs that have led to total compromise of the OS -- in fact, earlier in your comment, you listed several vulnerability classes that have disproportionately affected JavaScript VMs.