Notarize the app?

[zaqes]

Problem(s) addressed

I'm trying to avoid executing non-notarized apps

Proposed solution(s)

Is it possible for you to notarize the app?

[rgoldberg]

For all the reasons below (which might not be exhaustive), I will put notarization in the backlog (which means it probably will never get done) because:

1. I don't have an Apple Developer Program subscription. Given that I'm not making any money from this project (the few sponsorships go to someone else, and they wouldn't even cover an annual Apple Developer Program subscription), I don't want to shell out money in addition to my time & effort.
2. mas uses 2 Apple private frameworks: CommerceKit & StoreFoundation. I don't know if that will prevent notarization.
3. Almost all users (of which I'm aware) install mas via Homebrew Core, which cannot notarize formulae.
4. Last I heard, Homebrew doesn't have any plans to notarize formulae.
5. Homebrew wants mas to remain a formula, not a cask.
6. I assume that distributing via a notarized binary precludes users knowing for certain what code was used to build the binary. Assuming people trust Homebrew, then a formula guarantees what source produced the binary.
7. I haven't notarized, signed, etc. code before, so it would take investigation.

I don't know Apple's policy about others notarizing open source code, but if you need a hardened runtime, want to ensure that the code isn't malicious, etc., maybe you could fork the code, then get it notarized yourself, run AI on it to detect anything that might worry you, etc.

Sorry.

[zaqes]

Thanks for the answer, I didn't know about point 4 and 5. Then I should probably have a talk with Homebrew about this.

Thanks again!

[rgoldberg]

If you ever get any information about Homebrew notarizing formulae, please comment here (with links, if possible), so I can stay abreast of any developments.

Thanks.