> is it not that the actual security of notarization is provided by OSCP? The security of notarization is provided by Apple's signature over the hashes of the

> is it not that the actual security of notarization is provided by OSCP? The security of notarization is provided by Apple's signature over the hashes of the executables in the app [0]. The hashes and signature are put into a "ticket". This ticket is stored on Apple's servers, and can also be "stapled" to the app. Gatekeeper (one of the macOS security systems) will prefer to fetch the ticket from Apple if possible, and fall back to the stapled ticket if available. Notarization is meant to guarantee that the code was sent to Apple and checked for malicious code. OCSP checks that the Apple Developer ID certificate used to sign the app hasn't been revoked. They are two separate checks done by the Gatekeeper system, which is meant to ensure that only trusted software runs on macOS. I believe it makes sense to call the OCSP check part of the Gatekeeper system, but this may be incorrect. [0]: https://forums.developer.apple.com/forums/thread/710738 https://forums.developer.apple.com/forums/thread/710738