Notarization is the process where Apple's notary service scans a signed Mac app for malware and known signing problems, then attests that it is okay to launch. It is required for any app distributed outside the Mac App Store on modern macOS. An app that is signed but not notarized still launches, but the first-launch experience is a 'cannot verify the developer' warning that nukes conversion.
What it takes to notarize
- A Developer ID Application certificate signing the binary.
- Hardened runtime enabled on every binary in the bundle.
- A timestamped signature (`codesign --timestamp`).
- No prohibited entitlements (the `com.apple.security.cs.*` family is restricted).
- An App Store Connect API key or app-specific password to submit through notarytool.
The flow with notarytool
bash
# Submit and wait for the result xcrun notarytool submit MyApp.zip \ --key AuthKey_ABC123.p8 \ --key-id ABC123DEFG \ --issuer 12345678-90ab-cdef-1234-567890abcdef \ --wait # Staple the ticket onto the bundle so Gatekeeper can verify offline xcrun stapler staple MyApp.app
Why stapling matters
Without stapling, Gatekeeper has to make a network call to Apple to fetch the notarization ticket on first launch. Stapled apps carry the ticket inside the bundle, so they pass Gatekeeper checks even if the user is offline.