2

I am asking this out of curiosity. When I download an app by an unidentified developer:

1) What does it mean that the app is by an "unidentified developer"? How is a developer identified?

2) What is the Mac doing when I am opening that app for the first time and I see "Verifying.." (or something similar)?

1

Apple provides digital 'certificates' to registered developers, who pay $99 per year to register. Any applications signed with those certificates will be 'verified'.

It's nothing to do with the App Store as such. Registered developers can make certified apps available on their own websites.

Apple can remove the certificate from developers who are found to be shipping malware or being naughty in some other way.

When you first open an application, MacOS checks that the certificate is valid. If the app was made by a developer who is not registered with Apple, then you will get the message that the app is unknown to Apple, and therefore potentially risky. Of course, lots of very good software is written by developers who don't register with Apple.

| improve this answer | |
  • I believe macOS also checksums package files and checks compatibility against some internal reference files, like LSMinimumSystemVersionin the info.plist file. This is how applications know if you're trying to run them on a version of macOS or OS X that's too old. (This is why it can take a long time for big and/or complex packages.) – SYGMAH Jun 9 at 21:49
0

AppStore is curated, which means Apple has a lot of guidelines to what can and cannot be posted in its AppStore and it is basically Apple's way of telling you it is safe to install the app.

They certify apps and guarantee they know the developer by making them enroll in a developer program and issue a certificate, which is a file used to 'sign' the app and ensures whoever signed it is the developer who requested it - certificates can be stolen and misused, and there's nothing to be done about it though.

Although they'd prefer to have all apps installed through the AppStore, macOS still allows you to install apps which are not certified by Apple, but it will tell you by saying the app is from an unidentified developer.

https://developer.apple.com/support/certificates/ https://developer.apple.com/app-store/review/guidelines/

| improve this answer | |
  • Welcome to Ask Different and thanks for this answer. It's correct in general, but GateKeeper has nothing to do with the App store and this verification happens exclusively on the client side - with code downloaded from the internet as well as apps copied in side-load style from USB or storage or created locally. This verification happens even for identified developers, signed and notarized apps. This dialog illustrates the verification phase of the stapled or non-stapled certificates to detect tampering. – bmike Jun 9 at 14:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .