Distributing Mac Apps Without Notarization
Sometimes a developer needs to send a Mac app to a user for testing, and in that case it’s a pain to upload the app to App Store Connect first and wait for Apple to notarize the app before you distribute it. […] if you normally distribute your app exclusively in the Mac App Store, the app might not have enabled the hardened runtime, and you won’t be able to notarize the app for distribution outside the Mac App Store[…]
The easiest solution is to download the file in a way that doesn’t cause it to be quarantined. This can also be used to work around the recent problem that some users have been encountering where macOS falsely claims that a properly signed and notarized app is damaged.
In my opinion, using
curlin this way is the easiest way to distribute a Mac app to a user without notarization. You still can and should sign your app with your Developer ID certificate, as Mac developers did for years before the notarization requirement. If the user wants some assurance about the downloaded app, they can run thecodesigncommand to verify that the app was indeed validly signed with your Developer ID certificate.
I like to run curl like this:
cd ~/Downloads/ && curl -LO 'https://c-command.com/downloads/SpamSieve-current.dmg'
The L handles redirects, and the O avoids having to repeat the filename. Johnson notes that if you download directly to the /Applications folder you can avoid a TCC prompt.
Previously:
- Hazel Codesigning and Notarization Woes
- “Damaged” Apps That Can’t Be Opened
- Where Is TestFlight for Mac?
Update (2021-07-02): Howard Oakley:
This article is a demonstration of features in Big Sur which you might have thought would protect you, but because of their inconsistent behaviour could catch you out. This shows how you can download, install and run executable code, such as an app, which isn’t signed with a Developer ID, only an ad-hoc signature, without macOS warning you that the code is potentially dangerous.
Update (2024-08-19): For C-Command apps, there is now a Download Fixer tool that can make the “damaged” apps launchable without having to use Terminal.
5 Comments RSS · Twitter
"You need to open the application with a right mouse-click". Every user of my test versions is able to do that. The users don't know quarantine, codesign or notarisation. The only know the error messages on "can't be tested on malicious software". But they can follow a simple instruction.
can´t update from 3.0.4 to 3.0.5 on sonoma. it crashes before it opens. dunno what i should do now?!°
