Questions tagged [osx-gatekeeper]

Gatekeeper is a new feature in OS X Mountain Lion that helps protect users from downloading and installing malicious software. Signing your applications, plug-ins, and installer packages with a Developer ID certificate lets Gatekeeper verify that they are not known malware and have not been tampered with.

Gatekeeper makes it safer to download apps by protecting you from inadvertently installing malicious software on your Mac. The safest place to download apps for your Mac is the Mac App Store. Apple reviews each app before it’s accepted by the store, and if there’s ever a problem with an app, Apple can quickly remove it from the store. When you download software from any other place on the Internet, Gatekeeper makes that safer, too. Developers can get a unique Developer ID from Apple and use it to digitally sign their apps. The Developer ID allows Gatekeeper to block apps created by malware developers and to verify that apps haven’t been tampered with. If an app was developed by an unknown developer — one with no Developer ID — Gatekeeper can keep your Mac safe by blocking the app from being installed.

126 questions
33
votes
3 answers

Code Sign Windows programs with Apple Certificate?

I'm trying to minimize the cost of code-signing certificates necessary to develop a program for Mac OS X and Windows. As far as I can tell, I can't use a 3rd party certificate to sign my OS X program and have it get past GateKeeper, as indicated…
Scott Driscoll
  • 2,869
  • 2
  • 23
  • 22
30
votes
3 answers

Non-Apple Issued Code Signing Certificate: Can it Work with Mac OS 10.8 Gatekeeper?

Our company develops our application for both Mac OS X and Windows. We have an existing purchased code signing certificate from a non-Apple authority we use to ID our Windows installers. We distribute both our DMGs & MSIs through our own company…
GNat
  • 475
  • 1
  • 6
  • 9
30
votes
2 answers

OS X 10.8 Gatekeeper and Java applets

With the new release of OS X 10.8, the Gatekeeper will popup the following warning, when you try to start a signed Java applet: The applet has been signed with a valid code signing certificate and will work correctly on other platforms as well as…
Rasmus Faber
  • 48,631
  • 24
  • 141
  • 189
21
votes
5 answers

How to sign (dynamic) JNLP files for OSX and Gatekeeper

My company produces Java Applications for Servers and delivers JNLP files to start local Applications. Since OSX 10.8.4 it is required to sign JNLP files with a Developer ID to keep Gatekeeper happy (it's actually in the release notes at the very…
gamma
  • 1,902
  • 1
  • 20
  • 40
18
votes
3 answers

Gatekeeper signing for OSX DMGs outside of OSX/XCode/Mac App Store?

From looking at notes for the upcoming OSX version (the one after OSX Lion), it appears that all DMGs/installers need to be signed, even if not distributed via the Mac App store. I couldn't find a command-line tool to do this signing though, or much…
psychotik
  • 38,153
  • 34
  • 100
  • 135
16
votes
5 answers

Failure digitally signing a Mac app outside Xcode

I develop a Mac app with Qt5, so outside Xcode. I want GateKeeper to allow my app to run on clients' computers rather than issuing the "Can't be opened because the identity of the developer cannot be confirmed" warning. I have successfully digitally…
adlag
  • 1,016
  • 9
  • 19
16
votes
6 answers

Unidentified developer for Java Web Start application on OS X

On Mac OS X 10.9 signed Java Web Start applications are blocked by default with the message: "application.jnlp" can't be opened because it is from an unidentified developer. I know it's possible to weaken the security checks to allow any…
Emmanuel Bourg
  • 9,601
  • 3
  • 48
  • 76
12
votes
1 answer

Validating macOS apps that pass codesign, spctl, and check-signature but fail to run "because the identity of the developer cannot be confirmed"

My macOS app is codesigned and runs on some computers but on another it fails to run since Gatekeeper pops up "{App} can't be opened because the identity of the developer cannot be confirmed." I want to detect this issue on the build machine before…
ide
  • 19,942
  • 5
  • 64
  • 106
11
votes
4 answers

osx 10.9.5 code signing V2 - signing a framework with: bundle format is ambiguous

I'am trying to code sign an app bundle on osx mavericks 10.9.5 with format v2. On previous testing the signing on 10.9.5 (13F12) all went well, all frameworks could be signed without error. Now, on 13F34, the frameworks could not be signed any more.…
Peter
  • 111
  • 1
  • 4
10
votes
2 answers

How to codesign and enable the hardened runtime for a 3rd-party CLI on Xcode?

My project needs the Ghostscript to do lots of tasks, so I have added the gs CLI tool into my project resource. However when I tried to notarize the project application, Xcode shows me this: I assume that might because the ghostscript portable CLI…
SuperBerry
  • 1,193
  • 1
  • 12
  • 28
9
votes
1 answer

Codesigning Kext with kext enabled certificate fails during kextload, "code signature invalid"

So we have a certificate that allows us to sign kexts, but when we run > sudo kextload friendly.kext, it fails and we sign the kext we want, and to prove it's signed, here's some diagnostic output: codesign --verify -vvvv friendly.kext…
A O
  • 5,516
  • 3
  • 33
  • 68
9
votes
2 answers

Bypass Gatekeeper in Mac OS X Apps without a Mac Developer Membership

Scenario I want to release an app for Mac OS X, but not on the AppStore. The app runs on 10.6 - 10.8 and up. Problem Apple requires all apps for Mac OS X 10.8+ to be signed by the developer to get past Gatekeeper. And unless I tell each user to…
Sam Spencer
  • 8,492
  • 12
  • 76
  • 133
7
votes
1 answer

why are executables installed with homebrew trusted on MacOS?

I have a stupid question about homebrew: Why are executables that I install via homebrew trusted by MacOS (gatekeeper)? i.e. after installation I can run an executable and don't get a security popup and don't have to allow an exception - why is…
Chris
  • 567
  • 6
  • 24
7
votes
1 answer

Code sign Java app for OS X Gatekeeper

I am trying to distribute a Java application to OS X users. I am not using the Mac store - it is to be distributed through my own website. Whatever I try, OS X's Gatekeeper rejects the app. Here's my method: (1) Build the app as usual, get a JAR…
HughHughTeotl
  • 5,439
  • 3
  • 34
  • 49
7
votes
6 answers

Mac DMG oddity - signing and "damaged" applications

My Gatekeeper settings are "App Store and Identified Developers" I have a DMG with a signed app. When I mount the DMG and run it locally, it works. when I upload the same DMG to our servers (via http), download it (via http), mount it, and try to…
JasonGenX
  • 4,952
  • 27
  • 106
  • 198
1
2 3
8 9