It is rare to find an app that hasn’t gone through notarization. But you may still encounter software you can download from an open source project’s site—typically free and often developed by a group of volunteers—that isn’t signed and notarized.
While most developers consider Apple’s annual developer program fee and company oversight affordable and reasonable, some folks do not. They may be creating a small piece of utility software that’s maintained, but nobody in the group that produces it wants to either ask for donations or cough up the dough. Or they may find Apple’s oversight irksome and invasive, despite the advantage to users. Or they may have interpreted copyright in a way that doesn’t match Apple’s policies.
If it’s not the above case, there are a few other reasons that you might encounter an app Gatekeeper balks at:
- You run a preliminary version of a new app that the developer simply hasn’t gotten around to signing yet.
- You create your own app or standalone script (perhaps using Script Editor) and don’t want to (or don’t know how to) sign it.
- You’ve downloaded malware. It isn’t signed because the developer doesn’t want to risk exposing their identity—and enabling Apple to revoke the certificate, thus preventing the app from being installed in the future.
Whatever the reason, if you launch an app that isn’t signed or is signed but not notarized, macOS explains the problem. The dialog may say that it’s by an unidentified developer, or by a developer whose identity can’t be verified. Click OK—the only choice—and the app never completes launching.
Apple does let you install Mac software like this, but they don’t make it easy. There used to be an option in the Gatekeeper settings to disable Gatekeeper altogether; now, you have to use a manual bypass for any such app you want to launch on its first use, which Apple made more complicated in Sequoia to deter people even further.
Before you override Gatekeeper, give a lot of thought to what you’re trying to run and where you got it. As battle-scarred and cynical as I am, I always take additional effort and make additional scrutiny before bypassing Gatekeeper for an app I know I need and know its source.
Check it before you run it
The most excellent developers who forswear Apple’s process always offer out-of-band methods you can use to check the integrity of their downloads. So if you trust the project and want to make sure an app hasn’t been fiddled with, the site might post hashes it makes of its disk image files at the time of creation, or use its own signing process that can be validated with publicly available encryption keys. The best of these apps will then also provide pointers on how to perform validation and authentication without you having to take a two-hour cryptography course.
With all that in mind, here’s how to bypass Gatekeeper.
- Open the application. You see a dialog saying the app can’t be opened, with no suggestion of what to do next. Click Done.
- Go to System Settings > Privacy & Security. As with a signed app when you have Gatekeeper set to App Store, you have identical text and an Open Anyway button.
- Click Open Anyway.
I’m not sure Apple made the right call here, equating signed apps from developers and unsigned apps as the same kind of problematic item based on the Gatekeeper setting. But I suppose both are now considered suspect in the context of each setting choice.
