How macOS checks the apps you open

Code signing, Gatekeeper, notarization and XProtect: four checks that run before and after you open an app.

Every time you open an app for the first time, macOS runs a short series of checks before letting it start. Most of the time you never see them; you only notice when one of them stops something. This lesson follows what actually happens, using Apple’s own description of each step.

Code signing: proving who built it

Apple’s security documentation explains that on macOS, ‘code signing is performed by the developer using their Developer ID certificate (issued by Apple). Verification of this signature proves to the user that a developer’s software hasn’t been tampered with since the developer built and signed it.’ A signature does not say the app is safe; it says the app is the exact file that developer produced, unmodified since.

Notarization: Apple’s own check

Notarization is a separate, additional step. Apple explains that it ‘can be performed by anyone in the software distribution chain and proves that Apple has been provided a copy of the code to check [for harmful content], and no [known harmful software] was found. The output of Notarization is a ticket, which is stored on Apple servers and can be optionally stapled to the app.’ Since macOS Catalina, this check applies by default to nearly everything you open, whichever way it arrived on your Mac.

Gatekeeper: the check that runs when you open an app

Gatekeeper is what actually applies these results at the moment you double-click something. Apple describes it as designed ‘to help ensure that only trusted software runs on a user’s Mac. When a user downloads and opens an app, a plug-in, or an installer package from outside the App Store, Gatekeeper verifies that the software is from an identified developer, is notarized by Apple to be free of [known harmful content], and hasn’t been altered. Gatekeeper also requests user approval before opening downloaded software for the first time to make sure the user hasn’t been tricked into running executable code they believed to simply be a data file.’ That is the alert you see the first time you open something downloaded from the internet.

You download an app from outside the App Store and double-click it.
Gatekeeper checks the developer’s signature and looks up Apple’s notarization ticket for it.
If the checks pass, macOS still asks you to confirm you want to open it the first time.
If Apple has revoked the app, or nothing checks out, macOS refuses to open it and tells you why.

XProtect: watching after the app has run

The last layer works after the fact. Apple’s guide describes XProtect as macOS’s ‘built-in antivirus technology for the signature-based detection and removal of [known harmful software]’, which ‘checks for known [harmful] content whenever: an app is first launched, an app has been changed, [or] XProtect signatures are updated’, with Apple updating those signatures automatically, independent of full system updates. If it finds a known threat, Apple explains it ‘blocks it and moves it to the Trash. Then it alerts the user in the Finder.’

Key takeaways

Code signing proves an app’s file has not changed since its developer built and signed it; it does not, by itself, mean the app is safe.
Notarization is Apple checking a copy of the app’s code before it can run by default on current macOS.
Gatekeeper applies both checks at the moment you open an app, and asks for your approval the first time.
XProtect keeps checking after the app has run, using signatures Apple updates automatically and independently of full system updates.
macOS lets you override these checks for a specific app in Settings, but doing so removes a real protection, so it should be rare and deliberate.

Check yourself

1. What does a valid code signature actually prove?
- That the app is free of every possible problem
- That the app’s file has not changed since the developer signed it — Right.
- That the app was reviewed by a human at Apple
- That the app cannot access the internet
Code signing verifies integrity and the developer’s identity, not that the app is otherwise safe or well-behaved.
2. What does notarization mean, according to Apple?
- Apple wrote the app
- Apple has checked a copy of the app’s code and found no known threats — Right.
- The app was purchased from the App Store
- The app has been translated into multiple languages
Notarization proves Apple was given the code to check, and nothing known to be harmful was found in it.
3. When does Gatekeeper ask for your approval to open an app?
- Every single time you open any app
- Only the first time you open downloaded software — Right.
- Only for apps from the App Store
- Never, it works silently
Gatekeeper requests approval the first time you open downloaded software, so you cannot be tricked into running something unexpected.
4. How does XProtect update its detection signatures?
- Only when you install a major macOS upgrade
- Automatically, independent of full system updates — Right.
- Only when you manually run a scan
- It never updates once installed
Apple updates XProtect signatures automatically and separately from full system updates, often daily.

Do it with FireAI

Put this lesson into practice on your own Mac.

Sources

Put it into practice on your Mac

Try every feature free for 17 days, no card needed.

Download for Mac Docs