development
Gatekeeper
macOS security technology that verifies app signatures and notarization tickets before allowing an app to run, protecting users from malicious software.
Gatekeeper is the first line of defense against malware on macOS. It checks every app before its first launch, verifying the software comes from an identified developer and has not been tampered with.
Verification Levels
Gatekeeper checks apps against three trust levels:
- App Store - apps from the Mac App Store are signed and reviewed by Apple
- Developer ID + Notarized - apps signed with a Developer ID certificate and notarized by Apple
- Unsigned/Unnotarized - apps that fail both checks are blocked with a warning dialog
What Users See
- Notarized app: Opens normally with no warning
- Signed but not notarized: Warning dialog saying “Apple cannot check it for malicious software” (users can still open it through System Settings)
- Unsigned: Blocked entirely by default
Why Gatekeeper Matters for Developers
If you distribute macOS apps outside the App Store, Gatekeeper makes notarization mandatory in practice. An unnotarized app triggers a warning dialog that most users refuse to bypass, leading to support tickets and lost installs.
Checking Gatekeeper Status
Verify how Gatekeeper will treat your app:
spctl --assess --type execute --verbose YourApp.appThe output shows the assessment result: accepted (will open normally) or rejected (will show warning).