8 ms·

I'm interested in distributing Mac apps without any Apple involvement whatsoever. How do I bypass the notarization requirement? Can I use a shell script that w

I'm interested in distributing Mac apps without any Apple involvement whatsoever. How do I bypass the notarization requirement? Can I use a shell script that would remove the quarantine attribute? As in, I'd put the script into my disk image and instruct the user to click it to install the app.

kybernetyk 4y ago
https://lapcatsoftware.com/articles/without-notarization.html https://lapcatsoftware.com/articles/without-notarization.htm... I don't know if this still works, but it used to be that when you right-click an app bundle in Finder and select "open" (as opposed to double clicking the bundle) you get an "open anyway" option in the OMG APPLE CORP JUST WANTS YOUR BEST warning dialog.
- pilif 4y ago
  Using this method requires admin rights though, but that’s probably for the better as running code of unknown provenance is probably a privilege of a machine’s owner
  - temac 4y ago
    Does the code then run with admin rights ?
    - lwkl 4y ago
      No this does the same as going into system settings and approve the binary after trying to open it the first time. This requires elevated privileges. After that you can run the app as a user.
newaccount74 4y ago
Shell scripts are affected by quarantine just like any other executable. The easiest solition is, as kybernetyk says, to right-click the app. If you do that, you can bypass most the warnings. Another possibility would be to install the app in a way that doesn't set the quarantine attribute, eg. with curl, rsync or brew cask. But Apple has been tightening seccurity year after year, so it's questionable how long all the workarounds will continue working. My recommendation would be to just notarize the app - Mac users expect notarized software, and if you tell users they need to bypass the security checks, then a lot of people will think you are sketchy.
- grishka 4y ago
  > My recommendation would be to just notarize the app The problem is that this involves having a developer ID, which costs $100/year — which is the one thing I'd like to avoid. Hence my question. The apps I'm contemplating about would be free and open-source so I won't be making any money on them.
  - jagged-chisel 4y ago
    Rhetorical questions: how much salary do you make on other work? How much have you spent on your hardware? Real question: why is $100/yr such an egregious amount of money? If it’s a matter of principle, perhaps targeting macOS also lies outside those principles.
    - zeta0134 4y ago
      This would have been a completely unattainable amount of money as a high school student. In college, that money was better spent on school supplies and food, and spending cash was short. After college it took me the better part of a decade to get to the point where $100/year felt like something I could feasibly consider spending and not risk missing rent in January. $100/year is a lot of money to people in a wide variety of life situations. Being unable to afford this does not make them any less of a programmer.
      - pjmlp 4y ago
        I bought Turbo Pascal and Turbo C++ versions for Windows 3.1 as high-school student. Each of them were between 150 and 200 euros on today's money. High school student allowance in early 1990's Portugal after decades of dictatorship wasn't that great either.
        smoldesu 4y ago
        Was it a subscription service, though? That doesn't seem like a terrible deal if you get a perpetual license - meanwhile forking over $99/year for some basic functionality wrapped in Service Credit seems like a racket to me.
vbezhenar 4y ago
To remove all attributes, just ask user to run `xattr -c filename`. But I'm not sure if that would remove notarization requirement.
- 0ct4via 4y ago
  Non-technical end users won't want to be trying to enter Terminal commands they don't know or understand, and they shouldn't have to.
  - vbezhenar 4y ago
    How is it different from running shell scripts they don't understand (or entire applications for that matter)?
    - einherjae 4y ago
      It’s scarier, less ergonomic, and smells hacker-y. There is a significant difference between “just click on this”, and “open the DOS prompt and write these magical runes”
      - vbezhenar 4y ago
        It was observed that people get attached to Ikea furniture because they assembled it and it contains tiny bit of their labour. May be it could work with software? Like you've executed some scary command to enable this software to work, now you attached to it.
        0ct4via 4y ago
        That's not a fair comparison though -- if you screwdriver slips or you put the wrong screw in the hole, your sofa doesn't stop working -- but you could do real damage to your OS. IKEA furniture assembly involves very simple tasks and tools, and a guide that's purely pictorial -- and even then, there are an array of services where people will do that assembly for you, even offerings from IKEA themselves. Software neither has the same physical presence, nor the same relative lack of risk. The average person can appreciate something "made with their own hands," but lacks the specialist knowledge to appreciate a script or code deployment. Given how scared and how easily-scammed people can be by having someone open Event Viewer in Windows and claim this means their computer has viruses, opening some script and demanding verbatim typing of commands is more likely to lead to anxiety or unsureness than anything, and certainly not attachment. You're thinking as if the average person is the average HN reader -- they're not. At all.
ris58h 4y ago
Right-click, Open, Open should work for ad-hoc signed apps as others mentioned. I've made my very first MacOS app and users didn't complain installing it. It's https://github.com/ris58h/Touch-Tab https://github.com/ris58h/Touch-Tab BTW.
sbuk 4y ago
> How do I bypass the notarization requirement? Why? As a software user I want you to notarise your software.
- ris58h 4y ago
  As a FOSS developer I wish I could notarize it without paying $100/year to Apple.
  - sbuk 4y ago
    You'd need a separate certificate, which at the moment will cost considerably more than $100. Also is your objection the $100 or merely paying Apple?
    - samoit 4y ago
      Having to notarize your own software is giving one company total control over you and your future. It is unacceptable. I do not develop versions for macosx since notarization anymore.
      - oleks637 4y ago
        This is probably my biggest fear. One day Apple can revoke my certificate, and suddenly my apps stop working for everyone.
        ryandrake 4y ago
        But this has not happened. You're basing a decision today on something that might or might not happen in the future. "One day," Apple could do anything. One day, they could totally prevent installing things that are not notarized. One day, they could entirely prevent non-AppStore, non-sandboxed applications from running on macOS. They haven't, but they could and indeed all signs point to these being on the very long-term roadmap. Does this mean you stop writing Mac apps today?
gjsman-1000 4y ago
You can always have a user right-click the app in Finder and choose “Open Anyway” with admin rights. Otherwise… that is kind of the point of Gatekeeper. If it was any easier, notarization would be pointless and ineffective.

kybernetyk 4y ago

https://lapcatsoftware.com/articles/without-notarization.html https://lapcatsoftware.com/articles/without-notarization.htm... I don't know if this still works, but it used to be that when you right-click an app bundle in Finder and select "open" (as opposed to double clicking the bundle) you get an "open anyway" option in the OMG APPLE CORP JUST WANTS YOUR BEST warning dialog.

pilif 4y ago
Using this method requires admin rights though, but that’s probably for the better as running code of unknown provenance is probably a privilege of a machine’s owner
- temac 4y ago
  Does the code then run with admin rights ?
  - lwkl 4y ago
    No this does the same as going into system settings and approve the binary after trying to open it the first time. This requires elevated privileges. After that you can run the app as a user.

newaccount74 4y ago

Shell scripts are affected by quarantine just like any other executable. The easiest solition is, as kybernetyk says, to right-click the app. If you do that, you can bypass most the warnings. Another possibility would be to install the app in a way that doesn't set the quarantine attribute, eg. with curl, rsync or brew cask. But Apple has been tightening seccurity year after year, so it's questionable how long all the workarounds will continue working. My recommendation would be to just notarize the app - Mac users expect notarized software, and if you tell users they need to bypass the security checks, then a lot of people will think you are sketchy.

grishka 4y ago
> My recommendation would be to just notarize the app The problem is that this involves having a developer ID, which costs $100/year — which is the one thing I'd like to avoid. Hence my question. The apps I'm contemplating about would be free and open-source so I won't be making any money on them.
- jagged-chisel 4y ago
  Rhetorical questions: how much salary do you make on other work? How much have you spent on your hardware? Real question: why is $100/yr such an egregious amount of money? If it’s a matter of principle, perhaps targeting macOS also lies outside those principles.
  - zeta0134 4y ago
    This would have been a completely unattainable amount of money as a high school student. In college, that money was better spent on school supplies and food, and spending cash was short. After college it took me the better part of a decade to get to the point where $100/year felt like something I could feasibly consider spending and not risk missing rent in January. $100/year is a lot of money to people in a wide variety of life situations. Being unable to afford this does not make them any less of a programmer.
    - pjmlp 4y ago
      I bought Turbo Pascal and Turbo C++ versions for Windows 3.1 as high-school student. Each of them were between 150 and 200 euros on today's money. High school student allowance in early 1990's Portugal after decades of dictatorship wasn't that great either.
      - smoldesu 4y ago
        Was it a subscription service, though? That doesn't seem like a terrible deal if you get a perpetual license - meanwhile forking over $99/year for some basic functionality wrapped in Service Credit seems like a racket to me.

vbezhenar 4y ago

To remove all attributes, just ask user to run `xattr -c filename`. But I'm not sure if that would remove notarization requirement.

0ct4via 4y ago
Non-technical end users won't want to be trying to enter Terminal commands they don't know or understand, and they shouldn't have to.
- vbezhenar 4y ago
  How is it different from running shell scripts they don't understand (or entire applications for that matter)?
  - einherjae 4y ago
    It’s scarier, less ergonomic, and smells hacker-y. There is a significant difference between “just click on this”, and “open the DOS prompt and write these magical runes”
    - vbezhenar 4y ago
      It was observed that people get attached to Ikea furniture because they assembled it and it contains tiny bit of their labour. May be it could work with software? Like you've executed some scary command to enable this software to work, now you attached to it.
      - 0ct4via 4y ago
        That's not a fair comparison though -- if you screwdriver slips or you put the wrong screw in the hole, your sofa doesn't stop working -- but you could do real damage to your OS. IKEA furniture assembly involves very simple tasks and tools, and a guide that's purely pictorial -- and even then, there are an array of services where people will do that assembly for you, even offerings from IKEA themselves. Software neither has the same physical presence, nor the same relative lack of risk. The average person can appreciate something "made with their own hands," but lacks the specialist knowledge to appreciate a script or code deployment. Given how scared and how easily-scammed people can be by having someone open Event Viewer in Windows and claim this means their computer has viruses, opening some script and demanding verbatim typing of commands is more likely to lead to anxiety or unsureness than anything, and certainly not attachment. You're thinking as if the average person is the average HN reader -- they're not. At all.

ris58h 4y ago

Right-click, Open, Open should work for ad-hoc signed apps as others mentioned. I've made my very first MacOS app and users didn't complain installing it. It's https://github.com/ris58h/Touch-Tab https://github.com/ris58h/Touch-Tab BTW.

sbuk 4y ago

> How do I bypass the notarization requirement? Why? As a software user I want you to notarise your software.

ris58h 4y ago
As a FOSS developer I wish I could notarize it without paying $100/year to Apple.
- sbuk 4y ago
  You'd need a separate certificate, which at the moment will cost considerably more than $100. Also is your objection the $100 or merely paying Apple?
  - samoit 4y ago
    Having to notarize your own software is giving one company total control over you and your future. It is unacceptable. I do not develop versions for macosx since notarization anymore.
    - oleks637 4y ago
      This is probably my biggest fear. One day Apple can revoke my certificate, and suddenly my apps stop working for everyone.
      - ryandrake 4y ago
        But this has not happened. You're basing a decision today on something that might or might not happen in the future. "One day," Apple could do anything. One day, they could totally prevent installing things that are not notarized. One day, they could entirely prevent non-AppStore, non-sandboxed applications from running on macOS. They haven't, but they could and indeed all signs point to these being on the very long-term roadmap. Does this mean you stop writing Mac apps today?

gjsman-1000 4y ago

You can always have a user right-click the app in Finder and choose “Open Anyway” with admin rights. Otherwise… that is kind of the point of Gatekeeper. If it was any easier, notarization would be pointless and ineffective.