Notarization is a check in which a platform vendor scans signed software for malware and issues a ticket that lets it run without warnings.
How notarization works
The best-known example is Apple notarization, mandatory for software distributed outside the Mac App Store since macOS Catalina (2019):
- the developer signs the app with an Apple Developer ID certificate;
- the app is uploaded to Apple’s notary service, which scans it automatically for malicious content and signing problems;
- if the check passes, Apple issues a notarization ticket, which the developer “staples” to the app;
- when a user opens the app, Gatekeeper checks the signature and the ticket; un-notarized apps are blocked or require explicit permission.
Notarization is not a manual review like the App Store; it is an automated malware scan plus a record of who published the software. Microsoft uses a similar idea for Windows drivers (attestation signing), and the word is also used for proving that a document or file existed at a certain time.
Why notarization matters for security
Notarization makes it harder to spread anonymous malware and lets Apple revoke tickets and certificates quickly when abuse is found. It is not a guarantee of safety: in 2020 Shlayer adware was notarized by mistake, and attackers regularly steal or buy developer certificates. Many macOS stealers therefore trick users into bypassing Gatekeeper, for example by right-clicking “Open” or pasting a command into Terminal.
Best practices
- Install Mac software only from the App Store or the developer’s official site.
- Never bypass Gatekeeper warnings or run Terminal commands from websites and chats.
- Developers should protect signing keys, notarize every release and enable the hardened runtime.
