3 ms·
I don't fully understand the difference. But signed is different from notarized. Notarized means you uploaded the binary to Apple. Previously, you can sign with
by asveikau 7y ago
I don't fully understand the difference. But signed is different from notarized. Notarized means you uploaded the binary to Apple. Previously, you can sign without doing that.
I haven't looked enough to understand what is gained by notary. Does Apple want to search your binary for maliciousness or rulebreaking (potentially even at a later date) so that it might revoke the notarization/signature?
- pjmlp 7y agoIn order to avoid repeating myself, from WWDC 2019: "Advances in macOS Security" https://developer.apple.com/videos/play/wwdc2019/701/ https://developer.apple.com/videos/play/wwdc2019/701/ "All About Notarization" https://developer.apple.com/videos/play/wwdc2019/703 https://developer.apple.com/videos/play/wwdc2019/703
- asveikau 7y agoThanks. Some of this stuff seems a tad disingenuous. Like preventing debugging. The debugger APIs on Mac already pop up a password prompt, limiting the usability in malware (and actual use, like trying to debug over ssh). Meanwhile, a culture of producing separate binaries for debug and for end users (debug builds lacking optimization, allowing additional permissions) is in my experience a great way to fail to reproduce legit customer-facing bugs during development and have greater difficulty diagnosing them when they occur on a real live user machine.
- saagarjha 7y agoAs far as I understand, notarization is intended to catch malware before it can be distributed. The traditional signing mechanism can protect users against malicious software because Apple can pull certificates used to sign malware.