Notarization Archives - Mr. Macintosh

MacOS 10.15 Catalina – Updated Index of Need to Know Changes & Links

MrMacintosh.com - Index of macOS 10.15 Catalina new changes and links — *This page will be updated when new 10.15 new information or links come in.*

WWDC 2019

WWDC is here again! On Monday, June 3rd, 2019 Apple Released macOS 10.15 Catalina. The first question MacAdmins have is, what changes do I need to know about and how will they affect my macOS deployments? Hopefully, I will help you answer that question with this article. I am following the same format as my previous Notarization Index post. MacAdmins have told me they really liked having all the important information on a topic in one place. MacAdmins like Robert Hammem, Charles Edge and Rich Trouton are already crushing it by gathering information on all the latest changes. In this post, I will keep an updated index of changes and links to keep you informed of the latest public information regarding macOS 10.15 Catalina.

Index – Updated 6/08/20

1. System Requirements
2. How To Download macOS Catalina 10.15
3. How to Block macOS Catalina 10.15
4. How to Manage Catalina’s New App Notifications
4. MacAdmins Catalina Community Notes Document
5. macOS Catalina 10.15.0 Security Content
6. Previous macOS Catalina Releases
4. OS Level Changes
5. Security Changes
6. Apple Links
7. WWDC19 Video Links
8. MacAdmins Links
9. 10.15 Beta 1 Patch Notes
10. 10.15 Beta Known Issues
11. Miscellaneous Links

MacOS Catalina 10.15 Release Date

macOS Catalina 10.15 is Live!! apple.com/macos/catalina/

1. macOS 10.15 system requirements

Below is the list of compatible Macs that can run 10.15. Removed from the list that could install Mojave is the Late 2010 and Mid 2012 Mac Pro 5,1.

MrMacintosh.com - macOS 10.15 list of compatible Macs. — macOS 10.15 System Requirements

2. How To Download macOS Catalina 10.15

Direct from Apple

Mac App Store – apps.apple.com/us/app/macos-catalina/id1466841314
New softwareupdate option!!! softwareupdate --fetch-full-installer

From Apple via open source tools.

installinstallmacos.py – github.com/munki/macadmin-scripts/blob/master/installinstallmacos.py
MDS macOS Download – GUI installinstallmacos.py fork – https://bitbucket.org/twocanoes/macdeploystick/downloads/PreBeta-MDS_Build-20041_Version-2.0.dmg

6. Previous macOS Catalina Releases

macOS Catalina 10.15.0 (19A583) – 10/07/19 – Prod Release
11th Catalina 10.15 GM Seed (19A582a) – 10/03/19 – Release Notes
10th Catalina 10.15 Beta 10 (19A578c) – 09/30/19 – Release Notes
9th Catalina 10.15 Beta 9 (19A573a) – 09/23/19 – Release Notes
8th Catalina 10.15 Beta 8 (19A558d) – 09/10/19 – Release Notes
7th Catalina 10.15 Beta 7 (19A546d) – 08/28/19 – Release Notes
6th Catalina 10.15 Beta 6 (19A536g) – 08/19/19 – Release Notes
5th Catalina 10.15 Beta 5 (19A526h) – 07/31/19 – Release Notes
4th Catalina 10.15 Beta 4 (19A512f) – 07/17/19 – Release Notes
3rd Catalina 10.15 Beta 3 (19A501i) – 07/02/19 – Release Notes
2nd Catalina 10.15 Beta 2 (19A487l) – 06/17/19 – Release Notes
1st Catalina 10.15 Beta 1 (19A471t) – 06/03/19 – Release Notes

4. OS Level Changes

zsh is now the default shell instead of Bash – Starting with the macOS Catalina beta, your Mac uses zsh as the default login shell and interactive shell. You can make zsh the default in earlier versions of macOS as well. https://support.apple.com/en-us/HT208050

Python 2.7 is deprecated.
Scripting language runtimes such as Python, Ruby, and Perl are included in macOS for compatibility with legacy software. Future versions of macOS won’t include scripting
language runtimes by default, and might require you to install additional packages. If your software depends on scripting languages, it’s recommended that you bundle the runtime within the app.
Use of Python 2.7 isn’t recommended as this version is included in macOS for compatibility with legacy software. Future versions of macOS won’t include Python 2.7. Instead, it’s recommended that you run python3 from within Terminal.

32 Bit applications are now deprecated
If you still have older software that is 32bit they will NOT load.

Profile installation using the profiles command-line tool will be deprecated in future releases of macOS.

New Activation Lock Option for T2 Macs. – All Mac models with the Apple T2 Security Chip now support Activation Lock — just like your iPhone or iPad. So if your Mac is ever misplaced or lost, the only person who can erase and reactivate it is you. More info: forums.developer.apple.com/message/363374

New Read-Only Filesystem Partition. User data is stored on the 2nd partition “Macintosh HD — Data”. MacOS Catalina runs in a dedicated, read-only system volume — which means it is completely separate from all other data, and nothing can overwrite your critical operating system files.
NOTE: Beta 1 – The Macintosh HD Read Only Partition is writeable
If you want to enable read only you have to place a file in the root of the drive.
sudo touch /.rootro
Then reboot to enable read-only mode.
Verify by trying to create /.rootro2
sudo touch /.rootro2
You should get touch /.rootro2: Read-Only file system
NOTE #2: Beta 2 – The Macintosh HD Read Only Partition is now protected by default
When checking on beta 2 you should get touch /.rootro2: Read-Only file system from running sudo touch /.rootro

TCC now covers the users Desktop & Documents Folder, cloud and external drives. – macOS Catalina checks with you before allowing an app to access your data in your Documents, Desktop, and Downloads folders; iCloud Drive; the folders of third-party cloud storage providers; removable media; and external volumes. In addition, you’re asked before an app can perform key logging or capture a still or video recording of your screen.

User Space System Extensions and SDriverKit. – Previously many hardware peripherals and sophisticated features needed to run their code directly within macOS using kernel extensions, or kexts. Now these programs run separately from the operating system, just like any other app, so they can’t affect macOS if something goes wrong.

Marzipan is now Project Catalyst – Allowing iOS apps to be ported over to macOS using Xcode.

lpadmin: Printer drivers are deprecated and will stop working in a future version of CUPS. CUPS printer drivers and backends are deprecated and will no longer be supported in a future feature release of CUPS. Printers that do not support IPP can be supported using applications such as ippeveprinter.

Enterprise Connect is transforming from an app into a new Apple first-party Single Sign-On macOS extension. This new extension delivers improved Kerberos support on macOS. Developers can now build SSO extensions that integrate with websites or native apps and support identity providers like Microsoft Azure AD, Okta and Ping. 10.14 and under will still support the old application for 1 year.

SecureToken BootStrap or Active Directory BootStrap Tokens will be a new way for Active Directory Accounts to get a SecureToken. This will need to be applied from a UAMDM via profile. This new feature will be for the 2nd 3rd or 4th Active Directory SecureToken User only, NOT the first user to log into the system.

4. Security Changes

Notarization is now enforced for all packages, applications and installers built or after June 1st 2019 EDIT: See Update Below.
This includes Kexts, but enforcement was already put into place on macOS Mojave 10.14.5.
developer.apple.com/news/?id=06032019i

Updated Notarization Guidelines Now until January 2020
developer.apple.com/news/?id=09032019a

Gatekeeper Improvements – Gatekeeper will ensure that all new apps you install — from the App Store or the internet — have been checked for known security issues by Apple before you run them the first time and periodically thereafter. This extends the protection from the app’s source to include automated checks for what’s in the app.

UPDATE: 10/03/19 – Apple has changed this and Kexts will NOT require a reboot! – Kernel Extensions (Kexts) now require a reboot to load – Installing third party kernel extensions now requires that you restart your Mac before they’re permitted to load.

Requirements for trusted certificates in macOS 10.15 – Learn about new security requirements for TLS server certificates in iOS 13 and macOS 10.15. support.apple.com/en-us/HT210176

FileVault & fdesetup changes – FileVault FV2 now requires User-Approved MDM Enrollment or UAMDM. You also can’t pass username/password authentication to fdesetup enable. These changes may break existing scripts, workflows or MDM agents. Be sure to check man fdesetup in 10.15 beta to read more about the new Authorization policy. You will need to follow at least one path to use fdesetup to enable FileVault Encryption.

5. Apple Links

macOS 10.15 Catalina – apple.com/macos/catalina-preview

macOS 10.15 Catalina Features – apple.com/macos/catalina-preview/features

10.15 Public Beta Release Notes – developer.apple.com/documentation/macos_release_notes/macos_10_15_beta_release_notes

Xcode 11 Beta Release Notes – developer.apple.com/documentation/xcode_release_notes/xcode_11_beta_release_notes

macOS Server 5.9 Beta Release Notes (Developer Account Required) – download.developer.apple.com/Documentation/macOS_Server_5.9_beta_Notes/macOS_Server_5.9_beta_Release_Notes.pdf

BugReporter is now deprecated and has been replaced with FeedBack Assistant. developer.apple.com/bug-reporting/ – feedbackassistant.apple.com/welcome

Device Management -Remotely manage devices within your organization. developer.apple.com/documentation/devicemanagement

Endpoint Security – Develop system extensions that enhance user security. developer.apple.com/documentation/endpointsecurity

Device Management Command – AccountConfigurationCommand.Command developer.apple.com/documentation/devicemanagement/accountconfigurationcommand/command?changes=latest_minor

Device Management Profile – New TCC PrivacyPreferencesPolicyControl Services profile options. developer.apple.com/documentation/devicemanagement/privacypreferencespolicycontrol/services?changes=latest_minor&language=objc

What’s New for Enterprise and Education WWDC June 2019 v1.1 (AppleSeed Account Required) – appleseed.apple.com/sp/downloads/projects/1001200/downloads/1011874

6. WWDC19 Video Links

WWDC 2019 Keynote – apple.com/apple-events/june-2019/

Platforms State of the Union – WWDC 2019 iOS, macOS, ipadOS, & tvOS Platforms State of the Union developer.apple.com/videos/play/wwdc2019/103/

Advances in macOS Security – We are on a journey to continuously improve macOS security, with a particular focus on preventing malware and protecting user data. developer.apple.com/videos/play/wwdc2019/701/

Network Extensions for the Modern Mac – Learn about powerful new APIs in macOS that you can use to create apps that extend and customize the networking capabilities of macOS without using kernel extensions. developer.apple.com/videos/play/wwdc2019/714

What’s New in Apple File Systems – Learn about what’s new in file system technology, including changes to file system layout and imaging technologies. developer.apple.com/videos/play/wwdc2019/710/

What’s New in Managing Apple Devices – Learn about the latest management enhancements for iOS, macOS, and tvOS and the evolution of management tools over the past year. developer.apple.com/videos/play/wwdc2019/303

App Distribution – From Ad-hoc to Enterprise – Whether you want to share your app with a few colleagues, deliver it to employees within an organization, or release it to the world, there’s a distribution mechanism designed to fit your needs. developer.apple.com/videos/play/wwdc2019/304

Advances in Networking – Part 1 – Keep up with new and evolving networking protocols and standards by leveraging the modern networking frameworks on all Apple platforms and following best practices for efficiency and performance. developer.apple.com/videos/play/wwdc2019/712/

Advances in Networking – Part 2 – Take your networking apps to the next level with advances in Bonjour, custom message framing handlers, and the latest in security. developer.apple.com/videos/play/wwdc2019/713/

Introducing Sign In with Apple – Sign In with Apple is the fast, easy way for people to sign in to apps using the Apple IDs they already have. developer.apple.com/videos/play/wwdc2019/706/

System Extensions and DriverKit – One of the next steps in modernizing and improving the security and reliability of macOS is to provide a better architecture for kernel extensions and drivers. developer.apple.com/videos/play/wwdc2019/702

All About Notarization – Notarization is all about identifying and blocking malicious Mac software prior to distribution, without requiring App Review or the Mac App Store. developer.apple.com/videos/play/wwdc2019/703

7. MacAdmins Blog Links

This list is specifically for MacAdmins. This will be an ongoing list of articles and posts that will help you learn the latest 10.15 changes.

Robert Hammem – Medium.com – @hammen –
Robert has been a top investigator so far on 10.15 changes.
Significant Changes in macOS 10.15 Catalina of Interest to Mac Admins

Charles Edge – krypted.com (Now with SSL and a new logo) – @cedge318
Charles put together a detailed article on macOS iOS, tvOS & MDM changes plus some additional information on authentication.
Differences Between zsh and Bash
Notes from the underground Apple WWDC and you
Differences Between zsh and bash

Armin Briegel – scriptingosx.com – @scriptingosx
Bash Scripting Expert and Author wrote about moving to zsh.
scriptingosx.com/2019/06/moving-to-zsh-part-2-configuration-files/
scriptingosx.com/2019/06/moving-to-zsh/
scriptingosx.com/2019/06/imaging-is-still-dead/

Tom Bridge – tombridge.com – @tbridge77
Tom, who runs the MacAdmins Podcast had a live broadcast during WWDC19
tombridge.com/2019/06/04/waving-the-green-flag/

Rich Trouton – derflounder.wordpress.com – @rtrouton
Rich is attending WWDC and has a running a list questions from MacAdmins. He is also keeping detailed notes in the Apple Dev forums.
Main Index of all Developer Links – derflounder.wordpress.com/2019/06/04/wwdc-2019-notes/
Apple Security Lab Questions – forums.developer.apple.com/message/362750
Notes from System Extensions and DriverKit – forums.developer.apple.com/message/362746
Notes from Advances in macOS Security – forums.developer.apple.com/message/362745
All about Notarization Notes – forums.developer.apple.com/message/362907
Notarization lab questions – forums.developer.apple.com/message/362910
Device management lab questions Part One – forums.developer.apple.com/thread/117417
Device management lab questions Part Two –forums.developer.apple.com/message/363283
Installer lab questions – forums.developer.apple.com/message/363336
Health and Fitness Technologies lab notes – forums.developer.apple.com/message/363431
Notes from What’s New in Apple File Systems – forums.developer.apple.com/message/363443
Questions for the Filesystems lab – forums.developer.apple.com/message/363444
Notes from Advances in Networking Part 1 – forums.developer.apple.com/message/363701
Questions for Security lab – forums.developer.apple.com/message/363638
Notes from Network Extensions for the Modern Mac – forums.developer.apple.com/message/363912
Networking Labs questions – forums.developer.apple.com/message/363913
Notes from What’s New in Apple Device Management – forums.developer.apple.com/message/363935
Questions for Device Management lab – forums.developer.apple.com/message/363874

8. macOS Catalina 10.15 Beta 1 Release Notes

NOTE: I posted 10.15 Beta 2 notes HERE.

New Features

The macOS 10.15 SDK provides support for developing apps for Macs running macOS Catalina 10.15. The SDK comes bundled with Xcode 11 beta available from Beta Software Downloads. For information on the compatibility requirements for Xcode 11, see Xcode 11 Beta Release Notes.

Installing third party kernel extensions now requires that you restart your Mac before they’re permitted to load.

Deprecations

macOS frameworks are now thinned for the x86-64 architecture. Apps that execute i386 code now fail with the EBADARCH error code. The remaining stub frameworks are nonfunctional and exist only for compatibility purposes.

9. macOS Catalina 10.15 Beta 1 Known Issues

Migration Assistant is currently unable to correctly migrate data from a Mac running macOS 10.15 to another Mac running macOS 10.15.
WarningYour Secure Token might be lost if FileVault is enabled on a non-APFS formatted volume while upgrading to macOS 10.15. You might be able to work around this by disabling FileVault before upgrading to macOS 10.15, then reenabling FileVault once the upgrade has completed.
During installation of macOS 10.15 you might be prompted to enter your administrator password multiple times to allow installation to proceed.
macOS 10.15 cannot be installed onto an encrypted volume unless it is already in the APFS format.
During upgrades to macOS 10.15, files and folders stored at the root-level of a volume are moved aside to /Library/SystemMigration/History/Migration-UUID/QuarantineRoot/.
If your Mac currently has macOS 10.10 or earlier installed, you must first upgrade to macOS Mojave 10.14 before upgrading to macOS 10.15.
The Install macOS 10.15 app might quit unexpectedly when run on macOS 10.9.
On Macs with the Apple T2 Security Chip, if you’ve used Startup Security Utility to lower Secure Boot to Medium Security or No Security, you’re currently unable to modify Secure Boot settings after upgrading to macOS 10.15.
Workaround: Set Secure Boot to Full Security before upgrading to macOS 10.15. Alternatively, disabling and reenabling FileVault might resolve the issue.
Some apps might not automatically relaunch after installation or updating and must be manually relaunched.
On Macs with the Apple T2 Security Chip, VoiceOver is currently unavailable while in macOS Recovery.
When using the SecureEnclave API with access control set on keys, users might not be prompted to authenticate. This might cause subsequent operations requiring authentication to fail.
Volume replication shouldn’t be used with Fusion volumes, either as a source or destination.

10. Miscellaneous 10.15 Links

Block 10.15 Beta installer -JamfNation – Discussion Link
10.14 & 10.15 Notarization – Mr. Macintosh – Notarization Links
Installing 10.15 Beta 1 on VMFusion 11.1.0 – VMWare Forum Post
How to install 10.15 Beta 1 on VMFusion Blog Post – planetvm.net

Apple releases fifth beta of macOS Mojave 10.14.5 (18F131a) Beta 5

Mr. Macintosh - 10.14.5 (18F131a) Beta 5 — *macOS beta Feedback Assistant application*
10.14.5 (18F131a) Beta 5

Today Apple released macOS Mojave 10.14.5 (18F131a) Beta 5 to Developers and Public Beta Testers.

NOTE: Be sure to check out the note on Known Issues with Notarization in 10.14.5 (18F131a) Beta 5 at the very bottom.

As a MacAdmin it’s important that you take time to test Apple’s Beta Releases. The public beta release notes are very thin on changes for 10.14.5 (18F131a) Beta 5 except for one change at the very end. This may or may not be the last beta before 10.14.5 goes public. 10.14.4 went to Beta 6.

Make sure you’re testing Notarization!

As mentioned in the my previous post on Beta 4, 10.14.5 (18F131a) Beta 5 has all of the Notarization security features enabled. You need to dig in and start testing the new system. The Beta 4 release notes call out that Kernel extensions signed after April 7th, 2019 must be notarized in order to load. Be sure if you have an important 3rd party app that installs a kernel extension that you reach out to the vendor and make sure they are aware of these changes.

10.14.5 (18F131a) Beta 5 Release Notes

Overview

The macOS 10.14.4 SDK provides support for developing apps for Macs running macOS Mojave 10.14.5. The SDK comes bundled with Xcode 10.2.1 available from the Mac App Store. For information on the compatibility requirements for Xcode 10.2.1, see Xcode 10.2.1 Release Notes.

General

Copy-protected video content plays back correctly on iMac Pro. (Same as Beta4)

Accessibility

Accessibility Events switch was removed, because related aspects of the W3C AOM effort are no longer applicable. (Same as Beta4)

Date and Time

Support for the Reiwa (令和) era of the Japanese calendar, which begins on May 1, 2019, is now available. The first year of Japanese-calendar era is represented as “元年” (“Gannen”) instead of “1年”, except in the shorter numeric-style formats which typically also use the narrow era name; for example: “R1/05/01”. (Same as Beta4)

Security

Kernel extensions signed after April 7th, 2019 must be notarized in order to load on macOS 10.14.5.

Known Issues (Beta 5)

The system fails to register tickets stapled to installer packages not scanned by Gatekeeper, which causes newly installed kernel extensions to fail to load if Internet access isn’t available. This can occur if a user launches installation from a local folder or an enterprise uses automated tools to deploy an installer. This issue doesn’t affect stapled disk images, apps, or kext bundles.
Workaround: In a new folder, create a shell script named preinstall to register the stapled ticket during install:

#!/bin/sh
if [[ `/usr/bin/sw_vers -productVersion` == 10.14.5 ]]; then
    /usr/sbin/spctl -a -vvv -t install "$PACKAGE_PATH"; fi

Then, when creating the flat package installer using either the pkgbuild or productbuildtool, pass the --scripts <path to folder containing preinstall> option to embed the preinstall script into the finalized installer.

Previous 10.14.5 Beta Releases

4th macOS Mojave 10.14.5 beta 4 (18F127a) – Release Notes
3rd macOS Mojave 10.14.5 beta 3 (18F118d)
2nd macOS Mojave 10.14.5 beta 2 (18F108f)
1st macOS Mojave 10.14.5 Beta 1 (18F96h)

How to get macOS beta releases

How to download macOS Mojave Beta

Sign up Public Beta – Apple Beta Software Program
Sign up as an Apple Developer (Yearly $100)
Contact your Apple SE to join AppleSeed for IT

10.14.5 (18F131a) Beta 5

Apple releases fourth beta of macOS Mojave 10.14.5 (18F127a) Beta 4

Mr. Macintosh - macOS Mojave 10.14.5 (18F127a) Beta 4 — macOS beta Feedback Assistant application
macOS Mojave 10.14.5 (18F127a) Beta 4

Apple has released macOS Mojave 10.14.5 (18F127a) Beta 4 to Developers and public beta testers. As a MacAdmin it’s important that you take time to test Apple’s Beta Releases. We all missed that Local Account password changes at the login window using the PRK was flat out broke! This could have been fixed if it was caught before the public release of 10.14.4. We now have to wait 1-2 months before 10.14.5 is released.

Make sure you are testing Notarization

10.14.5 has all of the Notarization security features enabled. You need to dig in and start testing the new system. The Beta 4 release notes call out that Kernel extensions signed after April 7th, 2019 must be notarized in order to load. Be sure if you have an important 3rd party app that installs a kernel extension that you reach out to the vendor and make sure they are aware of these changes.

10.14.5 (18F127a) Beta 4 Release Notes

Overview

General

Copy-protected video content plays back correctly on iMac Pro.

Accessibility

Accessibility Events switch was removed, because related aspects of the W3C AOM effort are no longer applicable.

Date and Time

Support for the Reiwa (令和) era of the Japanese calendar, which begins on May 1, 2019, is now available. The first year of Japanese-calendar era is represented as “元年” (“Gannen”) instead of “1年”, except in the shorter numeric-style formats which typically also use the narrow era name; for example: “R1/05/01”.

Security

Kernel extensions signed after April 7th, 2019 must be notarized in order to load on macOS 10.14.5.

Previous 10.14.5 Beta Releases

macOS Mojave 10.14.5 beta 3 (18F118d)
macOS Mojave 10.14.5 beta 2 (18F108f)
macOS Mojave 10.14.5 Beta 1 (18F96h)

How to get macOS beta releases

How to download macOS Mojave Beta

Sign up Public Beta – Apple Beta Software Program
Sign up as an Apple Developer (Yearly $100)
Contact your Apple SE to join AppleSeed for IT

Updated List of macOS 10.14.5 – 10.15 Notarization Links & Info

MrMacintosh.com - MacOS 10.14.5 & 10.15 Notarization

Updated: 09/04/19 – 54 Links

By now you have most likely heard about Apple’s new Notarization system. If you haven’t you can read Apple’s Developer Documentation explaining the change starting in 10.14.5. Below I will keep an updated list of macOS 10.14.5 – 10.15 notarization links.

As a MacAdmin it’s hard to keep up, I will help.

When Apple announces a new security feature on macOS it takes time to get a handle on how it will affect your deployment workflow. Most likely you are busy streamlining the last change! You end up searching google for links so you can get up to speed as soon as possible. This time around I will attempt to make this easier on you. I will be collecting the most important Notarization links and will add them to this article. Some of the links I will be posting will be from Apple, MacAdmins, 3rd Party Vendors and Security Researchers. A lot of hard work and research was put into some of the articles below. Let’s get started!

Be sure to drop me a line if you would like to see a link added to the list.

Notarization Table of Contents

Important Notarization Dates
Apple Developer
MacAdmin Blogs
3rd Party Vendors
GitHub Links
Slack #Notarization Channel
Misc. Links

1. Important Notarization Dates

10.14.5 = April 7, 2019 – ONLY Kexts have to be Notarized after this date. All pkg, dmg, installer’s will install just fine if they are not Notarized.
10.15 Beta 1 = Jun 1st 2019 – All pkg, dmg, installer and Kext’s need to be Notarized after this date to install.

2. Apple Developer Links

Signing Mac Software with Developer ID
Give users even more confidence in your software by submitting it to Apple to be notarized. The service automatically scans your Developer ID-signed software and performs security checks.

Notarizing Your Applications Before Distribution
Give users even more confidence in your software by submitting it to Apple for notarization.

Customizing the Notarization Workflow
Notarize your app from the command line to handle special distribution cases.

Resolving Common Notarization Issues
Handle common problems reported in the notarization log file, or that arise during ticket stapling.

Hardened Runtime Entitlements
Manage security protections and resource access for your macOS apps.

Customizing the Xcode Archive Process
Archive, export, and notarize your app in one step using Xcode post-action build scripts.

App Sandbox Entitlements
Manage access to system resources and user data in macOS apps to contain damage if an app becomes compromised.

altoola – Transporter command line tool Network Requirements
To incorporate notarization into a custom workflow, your build server needs access to certain network resources.

Apple Developer Forum – App Distribution
Apple Developer Forums / Distribution / Mac Apps

Safely open apps on your Mac
macOS includes a technology called Gatekeeper, that’s designed to ensure that only trusted software runs on your Mac.

Upcoming Changes for Mac Software Signed with Developer ID
1st bulletin – December 3rd 2018 – changes coming in Spring 2019

New Notarization Requirements – Developer Email
2nd Bulletin – April 10th 2019 – We’re working with developers to create a safer Mac user experience through a process where all software, whether distributed on the App Store or outside of it, is signed or notarized by Apple.

What is Transporter?
Transporter is Apple’s Java-based command-line tool for large catalog deliveries. You can use Transporter to deliver your pre-generated content, in a Store Package, to the iTunes Store, Apple Books, and App Store.

Updated Notarization Requirements 09/03/19 until January 2020
https://developer.apple.com/news/?id=09032019a

3. MacAdmin Blogs

Howard Oakley – eclecticlight.co – @howardnoakley

1. Theres More to Notarization than that – 04/24/19
2. Apple’s Notary Service: ten months experience – 04/22/19
3. Last Week on My Mac: The hard road to macOS 10.15 – 04/14/19
4. How does notarization affect your own apps and scripts? – 04/12/19
5. Macs move closer to compulsory notarization – 04/10/19
6. Entitlements: how apps get back what they’ve given up – 02/26/19
7. Where do Apple’s recent security updates leave macOS? – 12/14/18
8. Launching apps in Mojave: how it has changed – 10/03/18
9. Has that app been notarized, what are the benefits to the user? – 9/24/18
10. Notarization: a big step forward for users and developers – 08/02/18

Tom Bridge – tombridge.com – @tbridge77

1. Mac Admins Talk: The Loyal Order of Notaries – 7/11/19
2 macOS 10.14.5 beta 4 & Notarization Update – 04/20/19
3. macOS 10.14.5 beta 2: Kernel Extension Notarization, UAMDM, Whitelisting & You – 04/19/19
4. macOS 10.14.5 beta, Notarization and Stapling Review – 04/18/19
5. Apple Updates Notarization Requirements – 09/03/19
6. Manipulating the System Policy Database with Configuration Profiles – 09/04/19

Jeff Johnson – lapcatsoftware.com – @lapcatsoftware

The true and false security benefits of Mac app notarization – 04/21/19
Mac app notarization and customer privacy – 12/06/18
Hardened Runtime and Sandboxing – 11/16/18
Debugging on Mojave – 06/11/18

Michael Tsai – mjtsai.com – @mjtsai

Tim Perfitt – twocanoes.com – @tperfitt

Apple Ramps Up Fight against Malware with Notarization, Stapling, and Hardening – 04/17/19
Adding Notarization to Xcode Builds – 04/12/19

Charles Edge – krypted.com – @cedge318

Adding App Notarization For Macs To Your Build Train – 04/11/19

Rich Trouton – derflounder.wordpress.com – @rtrouton

Notarizing Automator applications – 04/10/19

Gus Mueller – shapeof.com – @ccgus

MacOS Notarization – 01/25/19

Latenightsw.com – Shane Stanley

SD NOTARY: NOTARIZING MADE EASY

Successfulsoftware.net

How to notarize your software on macOS

Hackernews

Huge forum thread on Notarization – https://news.ycombinator.com/item?id=19609653

4. 3rd Party Vendors

Fleetsmith.com – Fleetsmith automates device setup, intelligence, patching, and security for your company’s Macs, iPhones, iPads, and Apple TVs.
App Notarization: A Quick Primer – 04/22/19

Sophos.com – Advanced Endpoint Protection with EDR and Artificial Intelligence, Next Gen Firewall with Synchronized Security and Business-Grade Security for Home Users.
Sophos Support for MacOS 10.14.5 Notarized Kernel Extensions – 04/26/19

Symantec.com – Symantec provides security products and solutions to protect small, medium, and enterprise businesses from advanced threats, malware.
Endpoint Protection 14.2 RU1 and kext notarization for macOS 10.14.5

zeplin.io Connected space for product teams. Handoff designs and styleguides with accurate specs, assets, code snippets—automatically.
Dev Journal — Automate notarizing macOS apps – 01/09/19

5. GitHub Links

https://github.com/zeplin/fastlane-plugin-notarize
fastlane plugin to notarize a macOS app

https://github.com/igeekjsc/notarizedCheck.sh
Rudimentary shell script to find notarization status of apps and KEXTs

https://github.com/macmade/Notarize
Notarization status monitoring tool for macOS, supporting multiple developer accounts. https://xs-labs.com

5. Slack #Notarization Channel

http://macadmins.slack.com

Upcoming Mojave 10.14.5 update enables enforcement of some Notarization & Gatekeeper controls.

Today Apple released an updated developer document informing us of upcoming notarization changes.

MacOS 10.14.5 (18F108f) Beta 2 was released this afternoon you can begin testing notarization changes now!

Update 04/09/19 – The cut off date has been found for new or updated Kernel Extensions 03/11/19

Last year Apple took the covers off 10.14 Mojave at WWDC 2018. Apple then released information on the following new security features User Content (TCC), Enhanced Runtime & Notarized Apps. You can watch the entire WWDC presentation “Your Apps and the Future of macOS Security”.

Later that year Apple released a document reminding us of the upcoming changes. This time they gave us a time frame “Spring 2019 release”

A little history on Apple releasing mid-cycle security changes.

Last year Apple released the following security changes midway through High Sierra’s deployment.

User Approved MDM (UAMDM)

Apple released this document explaining the User Approved MDM system and User Approved Kernel Extension Loading (UAKEL).

If you wanted to install profiles that managed Kernel extensions a UAMDM was required.

User Approved Kernel Extension Loading

Apple then announced changes around User Approved Kernel Extension Loading (UAKEL). “Starting with macOS 10.13.4, enrolling in MDM no longer disables User Approved Kernel Extension Loading, and extensions previously allowed to load for that reason now require approval”.

Starting in 10.13.4 all new kernel extensions installed needed to be approved or white listed.

10.14.5 Notarization requirements.

This bit of information was just made public late this afternoon. Looking at the requirement paragraph we can make some guesses.

Looking over this paragraph the important part seems to be “all new or updated”.

10.14.5 – New or updated Kernel Extensions

I think this means that once you have 10.14.5 any NEW or UPDATED Kernel extension will NOT LOAD unless it is fully notarized.

Example #1 – I build a brand new application today that has a built-in Kernel Extension. I did not notarize the kernel extension. If I tried to install this app on a 10.14.5 system the Kernel Extension would NOT INSTALL.

Example #2 – If I attempt to install Symantec Endpoint Protection.app that has a Kernel extension built in on a 10.14.5 system. The app WILL INSTALL because this application was built before the change.

10.14.5 – All software from Developers new to distributing with a Developer ID.

Reading this again I think it’s the same as Kernel extensions. If you build apps with a brand new Developer ID notarization is required for your app to install.

Example #1 – I build a brand new Application with my new Developer ID that I signed up for today. When I go to install this app on a 10.14.5 system Gatekeeper will BLOCK this application from installing.

Example #2 – I built an application last year with my Developer ID. I attempt to install this application today and Gatekeeper WILL ALLOW the install.

Update 04/09/19 – The date for new/updated kernel extensions is 03/11/19

What does mid-cycle security changes mean for MacAdmins?

I posted above about mid-cycle security update releases because this is the new norm for Mac Administration. Apple is no longer releasing features and security enhancements in the gold master and calling it a day. They are continuing to secure macOS and if that means releasing a security change mid-cycle so be it! Again this is a good thing, anything Apple can do to secure macOS what we want. The rub is MacAdmins have to continually be on top of these changes or they will come back to bite us.

Learn with us! Join the #notarization channel on MacAdmins.slack.com

Notarization is still new to most of us and will start to affect you soon. It’s better to learn how this new system works so you can be ahead of the game!

Join us on macadmins.slack.com

WWDC 2019

Index – Updated 6/08/20

MacOS Catalina 10.15 Release Date

1. macOS 10.15 system requirements

2. How To Download macOS Catalina 10.15

3. How to Block macOS Catalina 10.15

4. How to Manage Catalina’s New App Notifications

4. MacAdmins Community Catalina Notes Document

5. macOS Catalina 10.15.0 Security Content

6. Previous macOS Catalina Releases

4. OS Level Changes

4. Security Changes

5. Apple Links

6. WWDC19 Video Links

7. MacAdmins Blog Links

8. macOS Catalina 10.15 Beta 1 Release Notes

9. macOS Catalina 10.15 Beta 1 Known Issues

10. Miscellaneous 10.15 Links

Today Apple released macOS Mojave 10.14.5 (18F131a) Beta 5 to Developers and Public Beta Testers.

Make sure you’re testing Notarization!

10.14.5 (18F131a) Beta 5 Release Notes

Overview

General

Accessibility

Date and Time

Security

Known Issues (Beta 5)

Previous 10.14.5 Beta Releases

How to get macOS beta releases

Make sure you are testing Notarization

10.14.5 (18F127a) Beta 4 Release Notes

Overview

General

Accessibility

Date and Time

Security

Previous 10.14.5 Beta Releases

How to get macOS beta releases

Updated: 09/04/19 – 54 Links

As a MacAdmin it’s hard to keep up, I will help.

Notarization Table of Contents

1. Important Notarization Dates

2. Apple Developer Links

3. MacAdmin Blogs

4. 3rd Party Vendors

5. GitHub Links

5. Slack #Notarization Channel

Today Apple released an updated developer document informing us of upcoming notarization changes.

A little history on Apple releasing mid-cycle security changes.

User Approved MDM (UAMDM)

User Approved Kernel Extension Loading

10.14.5 Notarization requirements.

10.14.5 – New or updated Kernel Extensions

10.14.5 – All software from Developers new to distributing with a Developer ID.

What does mid-cycle security changes mean for MacAdmins?

Learn with us! Join the #notarization channel on MacAdmins.slack.com