When deploying third-party applications, internally developed command-line binaries, or enterprise packages across macOS, users frequently encounter Gatekeeper alerts stating: “App cannot be opened because it is from an unidentified developer” or “Apple could not verify that this app is free of malware”. Behind this GUI barrier lies Apple’s code-signing and notarization security architecture. The built-in command-line tools codesign and spctl (Security Policy Control) enable developers, security auditors, and system administrators to inspect digital certificates, verify notarization tickets, and audit Gatekeeper compliance directly in Terminal.
Understanding Code Signing and Notarization Requirements
Modern macOS (macOS 11 through macOS 15) enforces strict execution requirements before allowing an application downloaded from the web to run:
- Cryptographic Digital Signature: Executables must be signed with a valid Apple Developer ID certificate.
- Hardened Runtime: The binary must adopt the Hardened Runtime environment, restricting memory execution and debugging hooks.
- Apple Notarization: Apple’s automated malware scanning service must inspect the package and issue a cryptographic notarization ticket stapled to the application bundle.
| Command | Primary Scope | Diagnostic Purpose |
|---|---|---|
codesign -dv --verbose=4 |
Code signature details. | Displays Team ID, Certificate Chain, and Code Directory Hash. |
codesign --verify --deep --strict |
Bundle integrity verification. | Checks if internal frameworks or resources have been tampered with. |
spctl --assess --type execute -v |
Gatekeeper policy evaluation. | Simulates how Gatekeeper treats the application upon user launch. |
Inspecting Code Signatures with codesign
To inspect the digital signature, developer identity, and team ID of any application bundle (e.g., /Applications/SampleApp.app):
codesign -dv --verbose=4 /Applications/SampleApp.appReview key fields in the output:
- Authority: Should list
Developer ID Application: Company Name (TeamID)followed byDeveloper ID Certification AuthorityandApple Root CA. - TeamIdentifier: A 10-character alphanumeric ID unique to the registered Apple Developer organization.
- Runtime Version: Confirms whether the Hardened Runtime is active.
Performing Deep Integrity Verification
An application bundle may have a valid signature on its main executable while containing modified internal dynamic libraries (.dylib) or frameworks. Execute a deep strict audit:
codesign --verify --deep --strict --verbose=2 /Applications/SampleApp.appIf the output returns valid on disk and satisfies its Designated Requirement, the application has maintained complete cryptographic integrity without tampering.
Simulating Gatekeeper Assessment with spctl
The spctl utility tests whether an application meets Gatekeeper’s active execution policy without needing to double-click the file in Finder:
spctl --assess --type execute --verbose=4 /Applications/SampleApp.appInterpreting the assessment results:
accepted (source=Notarized Developer ID): The app is signed, notarized, and will launch smoothly without user warnings.rejected (source=Unnotarized Developer ID): The app has a valid developer certificate, but lacks an Apple notarization ticket.rejected (source=no usable signature): The app is unsigned or ad-hoc signed, and will be blocked by Gatekeeper.
Checking and Stapling Notarization Tickets
To verify if an Apple notarization ticket is stapled to the application bundle:
xcrun stapler validate /Applications/SampleApp.appDevelopers who have notarized an app through Apple’s notarytool service can staple the ticket offline using:
xcrun stapler staple /Applications/SampleApp.appBypassing Quarantine Attributes Safely in Development
When testing internally built binaries that trigger Gatekeeper blocks due to the web quarantine flag (com.apple.quarantine):
# Inspect extended quarantine attributes
xattr -p com.apple.quarantine /Applications/SampleApp.app
# Strip quarantine attribute to allow local execution
xattr -d com.apple.quarantine /Applications/SampleApp.appMastering codesign and spctl equips macOS developers and IT administrators with the tools necessary to validate software supply chains, diagnose Gatekeeper launch failures, and enforce enterprise code security.