News for hackers. Stuff that matters.

A comment on Notarizing Your Mac Software for macOS Catalina. Parent comment

Re:Notarizing Your Mac Software for macOS Catalina by rbanffy on Monday October 07, 2019 @09:05AM (#21180272)
> Anyway, were any of you who are complaining in this thread planning on actually publishing an app for macOS, or just here to beat a dead horse?

I was concerned MacPorts would stop working on my computer. I don't plan on publishing apps for Mac, but I depend on apps others publish.

[ Parent | on HN ]
Re:Notarizing Your Mac Software for macOS Catalina by klodolph on Monday October 07, 2019 @09:21AM (#21180437)
No, from what I understand this only affects binaries through Gatekeeper. Gatekeeper is “opt-in”—sort of. The way it works is that your web browser has an option “LSFileQuarantineEnabled” set in the bundle, and this makes it so files it creates have the “com.apple.quarantine” extended attribute on them by default. This attribute is propagated when you extract archives. When you open a program with the quarantine bit, you get the Gatekeeper warning.

All MacPorts has to do is either avoid setting the quarantine bit in the first place (easy enough) or remove it. The quarantine bit is nothing more than an xattr called “com.apple.quarantine” which you can inspect or remove with the xattr tool.

[ Parent | on HN ]
Re:Notarizing Your Mac Software for macOS Catalina by narag on Monday October 07, 2019 @09:49AM (#21180717)
So is this similar to Windows "this file was downloaded from the Internet" warning?
[ Parent | on HN ]
Re:Notarizing Your Mac Software for macOS Catalina by ceejayoz on Monday October 07, 2019 @09:52AM (#21180757)
Yes, but slightly more difficult to override - it's not presented as an option in the warning itself.
[ Parent | on HN ]
Re:Notarizing Your Mac Software for macOS Catalina by zwily on Monday October 07, 2019 @10:30AM (#21181245)
Basically.
[ Parent | on HN ]
Re:Notarizing Your Mac Software for macOS Catalina by ceejayoz on Monday October 07, 2019 @09:40AM (#21180629)
The MacPorts .pkg installer is probably the only thing affected, and they should be able to get that signed. (Plus, anyone using MacPorts should be capable of the right-click+open workaround.)
[ Parent | on HN ]
Re:Notarizing Your Mac Software for macOS Catalina by e12e on Monday October 07, 2019 @02:30PM (#21184324)
Actually an interesting question: will Apple be happy to sign third party app stores and package managers? Including those that, say, sell apps and take a percentage?
[ Parent | on HN ]
Re:Notarizing Your Mac Software for macOS Catalina by plorkyeran on Monday October 07, 2019 @03:39PM (#21185092)
They sign literally everything. There is no human review process involved in notarization.
[ Parent | on HN ]
Re:Notarizing Your Mac Software for macOS Catalina by e12e on Monday October 07, 2019 @04:59PM (#21185876)
They sign malware?
[ Parent | on HN ]
Re:Notarizing Your Mac Software for macOS Catalina by daxelrod on Monday October 07, 2019 @05:21PM (#21186090)
Pretty sure they do. Part of the point is that they can revoke the signature once it’s found to be malware, and likely the signatures for everything associated with that developer account.
[ Parent | on HN ]
Re:Notarizing Your Mac Software for macOS Catalina by saagarjha on Tuesday October 08, 2019 @12:44AM (#21188844)
They try not to, but it certainly seems like Notarization is more to be able to disable malware after it's detected than preventing it from being signed at all.
[ Parent | on HN ]
Re:Notarizing Your Mac Software for macOS Catalina by ceejayoz on Monday October 07, 2019 @10:19PM (#21188034)
They've probably got enough info from your signup for the developer program to send the FBI to your door afterwards.
[ Parent | on HN ]
Re:Notarizing Your Mac Software for macOS Catalina by l2dy on Monday October 07, 2019 @11:05PM (#21188302)
https://lists.macports.org/pipermail/macports-dev/2019-April...

> The MacPorts installer pkg will need to be submitted, but I don't think much else will change. Using MacPorts-built kernel extensions is already impossible because of signing requirements (we don't have a kext signing certificate and I don't think we qualify for one.)

> For general apps, Gatekeeper doesn't prevent running locally built ones due to them being unsigned, and I gather than notarization is only required in the same circumstances as signing. (It would be incredibly inconvenient for developers to test anything if this were not the case.)

https://lists.macports.org/pipermail/macports-dev/2019-Septe...

> * For 10.14 users: The pkg meets Apple's new requirements for notarization. This includes enabling the hardened runtime for all executables, which has the potential to cause new issues due to denying access to certain system resources and preventing the loading of unsigned plugins. Please let us know about any such problems.

MacPorts .pkg installers are notarized since 2.6.0.

[ Parent | on HN ]