Published on · Guide
macOS protection, notarization and Gatekeeper are separate checks
Notarization supports distribution trust, not an anti-reversing score. Modified apps need the complete delivery chain checked again.
Do not conflate security evidence
Apple explains how Developer ID signing and notarization help Gatekeeper check tampering and known malware. This does not prove that business algorithms resist analysis. Keep evidence for protection, signing, notarization and installation separately.
Test the version users receive
Transform first, then sign, notarize and test installation as required by the distribution channel. A pre-transformation notarization result cannot validate a changed package. Cover architectures, permission prompts, updates and first launch, or explicitly identify what remains untested.
Your checklist
- Hash the final deliverable.
- Check nested libraries and permissions.
- Keep original installation and rollback paths.
Primary sources
- Apple: Developer ID certificates · Checked 2026-10-12