News for hackers. Stuff that matters.
Re:Notarizing Your Mac Software for macOS Catalina by klodolph on Monday October 07, 2019 @09:21AM (#21180437)
No, from what I understand this only affects binaries through Gatekeeper. Gatekeeper is “opt-in”—sort of. The way it works is that your web browser has an option “LSFileQuarantineEnabled” set in the bundle, and this makes it so files it creates have the “com.apple.quarantine” extended attribute on them by default. This attribute is propagated when you extract archives. When you open a program with the quarantine bit, you get the Gatekeeper warning.

All MacPorts has to do is either avoid setting the quarantine bit in the first place (easy enough) or remove it. The quarantine bit is nothing more than an xattr called “com.apple.quarantine” which you can inspect or remove with the xattr tool.

Re:Notarizing Your Mac Software for macOS Catalina by narag on Monday October 07, 2019 @09:49AM (#21180717)
So is this similar to Windows "this file was downloaded from the Internet" warning?
Re:Notarizing Your Mac Software for macOS Catalina by ceejayoz on Monday October 07, 2019 @09:52AM (#21180757)
Yes, but slightly more difficult to override - it's not presented as an option in the warning itself.
Re:Notarizing Your Mac Software for macOS Catalina by zwily on Monday October 07, 2019 @10:30AM (#21181245)
Basically.
Re:Notarizing Your Mac Software for macOS Catalina by ceejayoz on Monday October 07, 2019 @09:40AM (#21180629)
The MacPorts .pkg installer is probably the only thing affected, and they should be able to get that signed. (Plus, anyone using MacPorts should be capable of the right-click+open workaround.)
Re:Notarizing Your Mac Software for macOS Catalina by e12e on Monday October 07, 2019 @02:30PM (#21184324)
Actually an interesting question: will Apple be happy to sign third party app stores and package managers? Including those that, say, sell apps and take a percentage?
Re:Notarizing Your Mac Software for macOS Catalina by plorkyeran on Monday October 07, 2019 @03:39PM (#21185092)
They sign literally everything. There is no human review process involved in notarization.
Re:Notarizing Your Mac Software for macOS Catalina by e12e on Monday October 07, 2019 @04:59PM (#21185876)
They sign malware?
Re:Notarizing Your Mac Software for macOS Catalina by daxelrod on Monday October 07, 2019 @05:21PM (#21186090)
Pretty sure they do. Part of the point is that they can revoke the signature once it’s found to be malware, and likely the signatures for everything associated with that developer account.
Re:Notarizing Your Mac Software for macOS Catalina by saagarjha on Tuesday October 08, 2019 @12:44AM (#21188844)
They try not to, but it certainly seems like Notarization is more to be able to disable malware after it's detected than preventing it from being signed at all.
Re:Notarizing Your Mac Software for macOS Catalina by ceejayoz on Monday October 07, 2019 @10:19PM (#21188034)
They've probably got enough info from your signup for the developer program to send the FBI to your door afterwards.