OpenDMG

What "notarized" means on a Mac, in plain words

By Arvind Kumar ยท

When you open an app you downloaded, macOS sometimes opens it after one question and sometimes refuses outright. The difference is signing and notarization. Here is what those words mean.

Signed

A developer who joins Apple's developer programme gets a certificate called a Developer ID. Signing an app with it does two things: it names who made the app, and it seals the app so that any later change to its files breaks the seal. If someone tampers with a signed app, macOS can tell.

Notarized

Notarization is a second step. The developer uploads the signed app to Apple, Apple's automated service scans it for known malicious software, and if nothing is found Apple issues a ticket for that exact build. It is an automatic scan, not a review by a person and not a promise that the app is good. It says: this build came from this developer and Apple found nothing harmful in it.

What Gatekeeper does

Files you download are marked as coming from the internet. The first time you open such an app, the part of macOS called Gatekeeper looks at it. A notarized app opens after you confirm once. An app that is unsigned, or signed but not notarized, is blocked, and you have to allow it yourself in System Settings under Privacy and Security.

Why many open source apps are not notarized

The developer programme costs 99 US dollars a year. Plenty of open source developers give their work away and do not pay for it, so their apps are unsigned or signed without notarization. That says nothing about the quality of the app. It does mean the check Apple would have done has not been done, so it is worth a look at who the developer is and how widely the app is used.

How OpenDMG shows it

OpenDMG checks the signature on your own Mac after the download, rather than taking anyone's word for it, and it leaves macOS's own protections in place.

Install them in one click

OpenDMG is a free, open source app store for open source Mac apps. It downloads each app from its developer's own GitHub release, checks it, and keeps it up to date. No account is needed.

Get OpenDMGBrowse all apps

Widely used open source apps