Hardened Runtime Gatekeeper and notarization for a Developer ID twin build
Parent: macOS App Sandbox Networking and Entitlements · Published reference · snapshot 2026-10-02
↓ Facts as markdownall context files
Source-anchored research for Hardened Runtime Gatekeeper and notarization for a Developer ID twin build. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Definitions
- Stapling only the DMG is not enough for offline first launch: once the app is copied out of the mounted DMG and the DMG is unmounted, the app has no ticket. An Apple engineer's guidance is to notarize and staple the app first, put it in the DMG, then notarize and staple the DMG. (medium confidence) [source]
How it works
- Notarization is not App Review. Apps distributed through the Mac App Store need no notarization because App Store submission already includes equivalent checks; software built after June 1, 2019 and distributed with Developer ID must be notarized (macOS 10.15+). (high confidence) [source]
- When an app is both hardened and sandboxed, the restrictions stack: the app needs the entitlement each system requires (for example com.apple.security.automation.apple-events for the Hardened Runtime and a sandbox exception for Apple events). Missing either blocks the action. (low confidence) [source]
- Hardened Runtime entitlements are Boolean and default to false; Xcode embeds an entitlement only when true, and manual signers should follow that convention. Entitlements go only on executables; frameworks, shared libraries and in-process plug-ins inherit the host's entitlements. Apple's Hardened Runtime resource-access list covers camera, audio input, location, contacts, calendars, photos and Apple events, and does not list network access. (medium confidence) [source]
Problems, failure modes and limitations
- Notarize from the command line with `xcrun notarytool submit <zip|dmg|pkg> --keychain-profile <name> --wait`, then `xcrun stapler staple` the app, disk image or flat package. A .app cannot be uploaded directly; zip it with `ditto -c -k --keepParent`. altool and Xcode 13 or earlier were refused by the notary service from November 1, 2023. (high confidence) (verified as of 2026-10-02) [source]
- A ZIP can be notarized but not stapled; staple each item inside it, then rezip. Standalone binaries get tickets but cannot be stapled. Without a stapled ticket Gatekeeper must look the ticket up online. (high confidence) [source]
- Always read the notarytool log (`xcrun notarytool log <id> --keychain-profile ...`), even for Accepted submissions; it can carry warnings. A typical failure entry is 'The signature of the binary is invalid.' Notarization is limited to 75 submissions per day. (medium confidence) (verified as of 2026-10-02) [source]
Facts and statements
- Apple's notary service requires: valid code signatures on all executables, a Developer ID (not Mac Distribution/ad hoc/development) certificate, the Hardened Runtime on app and command-line targets, a secure timestamp, no com.apple.security.get-task-allow set to true, and linking against the macOS 10.9 or later SDK. (high confidence) [source]
- Hardened Runtime and App Sandbox are independent technologies. The sandbox is mandatory for the Mac App Store; the Hardened Runtime is required for Developer ID notarization while the sandbox is optional there. A Developer ID twin can therefore be hardened with or without the sandbox. (medium confidence) [source]
- macOS Sequoia (15) removed the Control-click > Open override for software that is not correctly signed or notarized. Users must go to System Settings > Privacy & Security and click Open Anyway, which makes an unnotarized Developer ID twin much harder to install. A properly notarized build avoids that path. (high confidence) (verified as of 2024-08-07) [source]
- Notarized apps have been reported as wrongly flagged 'damaged' by Gatekeeper, and the Control-click bypass never fixed that case. This scopes the headline: notarization is necessary for a clean first launch but not always sufficient. (low confidence) (verified as of 2024-07-05) [source]
- Plug-ins and frameworks loaded by a hardened host inherit the host's entitlements; a host that loads third-party code may need com.apple.security.cs.disable-library-validation. A network-monitor twin that loads no plug-ins normally needs none of the cs.* runtime exceptions. (low confidence) [source]
Children
- No children recorded.