Apple could not verify `app` is free of malware

Question

Youssef-Hammad OP

Created 5h

Replies 1

Boosts 0

Participants 2

Hello,

I'm working on an app at work and we finally got to signing and notarizing the app. The app is successfully notarized and stapled, I packaged it in a .dmg using hdiutil and went ahead and notarized and stapled that as well.

Now I tried to move this app to another machine through various methods. But every time I download it from another machine, open and extract the contents of the dmg and attempt to open the app, I get the "Apple could not verify my app is free of malware that may harm your Mac or compromise your privacy.

When I check the extended attributes there's always the com.apple.quarantine attribute which from what I know, is the reason that this popup appears

I've tried uploading it to google drive, sending through slack, onedrive, even tried our AWS servers and last but not least, I tried our Azure servers (which is what we use for distribution of the windows version of our app). I tried uploading to Azure through CloudBerry (MSP360 now), and azure-cli defining the content-type as "application/octet-stream", the content-disposition as "attachment; filename=myApp.dmg", and content-cache-control as "no-transform". None of these worked

The only times where a download actually worked with no problems was when I downloaded through the terminal using curl, which obviously not a great solution especially that we're distributing to users who aren't exactly "tech savy"

I want the installation experience to be as smooth as other apps outside the App Store (i.e Discord, Slack, Firefox, Chrome etc....) but I've been stuck on this for more than a week with no luck.

Any help is greatly appreciated, and if you want me to clarify something further I'd be happy to do so

Boost

Answer 1

Etresoft OP

4h

The app is successfully notarized and stapled, I packaged it in a .dmg using hdiutil and went ahead and notarized and stapled that as well.

You don't need to notarize both. If this is a stand-alone app, I recommend just notarizing the app and distributing it as a ZIP file. You don't really need a disk image at all.

The only times where a download actually worked with no problems was when I downloaded through the terminal using curl,

The curl tool won't add the quarantine attribute. That makes it avoid Gatekeeper altogether.

Problems like this are usually because of some runtime check. There is a new tool called "syspolicy_check", as described here, that is supposed to help with that.

Are you building in Xcode? This is a common problem, but occurs most often to people who aren't using Xcode. If you are using some 3rd party build system, I recommend you put your efforts towards porting to Xcode. This makes lots of problems, including notarization, go away.

0