Apple warns developers to get apps Notarized against malware threats

guest · Oct 20, 2018

Apple warns developers to get apps Notarized against malware threats
October 19, 2018
https://venturebeat.com/2018/10/19/...o-get-apps-notarized-against-malware-threats/

Apple is today telling developers to submit their apps for notarization — a currently optional but soon to be mandatory step for non-App Store software from known developers, designed to protect both users and developers from malware.

As of now, Apple’s Gatekeeper serves as a barrier to app installation, presenting users with a dialog box that flags each app as potentially untrustworthy before allowing users to manually install it.

Notarization is exclusive to the recently released macOS Mojave, and provides an assurance that the specific download — not just the developer — has been checked for malware.

For now, non-App Store apps don’t require notarization, but that’s going to change. “In an upcoming release of macOS,” Apple says, “Gatekeeper will require Developer ID signed software to be notarized by Apple.”
Click to expand...

guest · Jul 23, 2019

A Real Gatekeeper
July 22, 2019
https://bitsplitting.org/2019/07/22/a-real-gatekeeper/

While working on the notarization process for my own apps, and a company I work for, I noticed an interesting error from “altool”, the command line program that is used to submit binaries to Apple for verification:

1 package(s) were not uploaded because they had problems:
Error Messages: To use this application, you must first sign in to iTunes Connect and sign the relevant contracts. (1048)
For the past 35 years, any Mac developer who wanted to ship an update directly to customers could do so by recompiling a binary and distributing it. When macOS 10.15 ships this fall, the status quo will change.
My colleague Patrick Machielse noticed right away what the larger implication is: all Mac software, inside or outside of the Mac App Store, can now be held up by unsigned contract agreements with Apple. In a rush to fix a horrible bug and get it out to customers? Better review that new contract ASAP.

Mac developers must register with Apple and sign their products. They must submit their binaries to Apple for notarization. And most significantly of all, they must agree to the terms of Apple’s App Store developer contracts, even if they don’t distribute their apps through the App Store.
Click to expand...

Update: Since I first published this article, feedback from folks at Apple who should know has led me to believe the issue is not as dire as I laid it out below.
The crude “contracts need to be signed” error message may be returned for any account type that has not yet agreed to the latest “Apple Developer Program License Agreement.”

I believe it was a mistake for me to assume that shipping apps with Developer ID + notarization would require agreeing to “App Store” contracts.
Click to expand...

guest · Dec 24, 2019

Apple will enforce app notarization for macOS Catalina in February
Apple has warned developers it will be reinstating the app notarization requirements it set out for macOS Catalina
December 23, 2019
https://appleinsider.com/articles/1...p-notarization-for-macos-catalina-in-february

New app notarization policies meant for macOS Catalina was announced in June at the Worldwide Developers Conference, with an intention to ensure the security of end users. To ensure the rollout of macOS Catalina was smooth, the full enforcement of the requirements was delayed, but an announcement by Apple reveals that time will end in early 2020.

In a post to the Apple Developer site, Apple confirms "all submitted software must meet the original notarization prerequisites" starting from February 3, 2020.
The new policies require developers to submit their apps to Apple to go through a notarizing security process, or they won't run in macOS Catalina. An extension to the existing Gatekeeper process that previously allowed notarization as an option, the requirement is designed to ensure downloaded software is from the source users believe it is from.

Notarized apps are scanned automatically by Apple for security issues and malicious code. While the Mac App Store apps undergo stringent checks before being made available, Notarization aims to provide a similar level of safety and security to users downloading apps from third-party servers, such as those owned and managed by an app's developer.
Click to expand...

Apple: Update to Notarization Prerequisites

Log in or Sign up

Apple warns developers to get apps Notarized against malware threats

guest Guest

guest Guest

guest Guest

Log in or Sign up

Apple warns developers to get apps Notarized against malware threats

guest Guest

guest Guest

guest Guest

Useful Searches