macOS Installer Requires Notarization To Be Run Under Catalina and Beyond

[enquora]

Catalina and beyond refuse to execute installer package (because of lack of notarization). It is possible to circumvent this but the procedure is not discoverable and shouldn't be expected of normal users.

It is unlikely even this current work-around will be permitted in future versions of macOS. The installer package should either conform to platform security requirements or be removed from the distributions list entirely.

[targos]

Refs: https://developer.apple.com/documentation/security/notarizing_your_app_before_distribution

[bnoordhuis]

Reading through Customizing the Notarization Workflow, it sounds like it'd be a major PITA to integrate with our release process. Thanks, Apple!

[MajuMadhusudanan]

I'm also facing the same problem. My package file bundle nodejs .PKG file. Now when I try to notarize my package file, apple rejects the package file saying it as invalid one. The below errors are coming in logs:

/node-v8.11.3.pkg/node-v8.11.3.pkg Contents/Payload/usr/local/bin/node",
"message": "The signature algorithm used is too weak.",

[silverwind]

These requirements do not apply to Homebrew, right? If Apple's processes prove too tricky, maybe we should make that the recommended installation method.

[enquora]

Transferring responsibility for distribution to package managers is, indeed, one answer to a fundamental requirement of the modern computing landscape.

[duncanmak]

I also ship an app that has node bundled inside the app bundle, depending on Homebrew is not a viable solution for me.

Will the Node.js foundation ship a hardened (optionally also notarized) copy of Node.js soon, in time for the release of MacOS Catalina?

[tylersmalley]

Apple has announced that Catalina will be coming in October. It would be great to hear from the OpenJS Foundation to understand if they intend on notarizing the macOS Binary.

[devsnek]

perhaps we should just recommend people install via brew/n/nvm/etc, easier to upgrade that way anyway.

[tylersmalley]

@devsnek, unfortunately, that isn't an option for folks who ship a version of Node in their software as myself and multiple folks on this thread do.

[jasontedor]

It's also relying on an assumption that Homebrew won't add the quarantine extended attribute that causes Gatekeeper to enforce signing/notarization requirements. Note that applications installed by Homebrew Cask do get the quarantine extended attribute.

[somu84]

Yea and resigning / hardening the node binary also doesn't work. As node tries to validate the signature and terminates if it's signed with any other certificate

[devsnek]

sorry I don't know much about this packaging... Why can't you just bundle the node binary itself?