Gatekeeper App Block - Reason

Confirming: Gatekeeper does not provide the specific reason when blocking an application?


If so, is there any consideration of adding this?


The online guidance I am finding is that the known reasons for a Gatekeeper block are:


  1. The app is downloaded from a third-party website.
  2. The app’s digital signature is corrupted or invalid.
  3. The app has not been notarized — Apple has not checked it for malware and marked it as safe to open.
  4. You’re downloading and installing an app for your business that was made in-house, meaning that some proper certificates and digital signatures are lacking.


The last 3 reasons I would agree warrant not using an app. The 1st reason I do not think is sufficiently reasonable to warrant not using one.


I do not know which reason is causing a Gatekeeper block because it does not specify.




Posted on Apr 4, 2025 8:20 AM

Reply
8 replies
Sort By: 

Apr 15, 2025 6:42 AM in response to FairWarning332

The 2 relevant points from the Support Article that you may be referring to are:

  • Gatekeeper also requests user approval before opening downloaded software for the first time to make sure the user hasn’t been tricked into running executable code they believed to simply be a data file.
  • Therefore by default, all software in macOS is checked for known malicious content the first time it’s opened, regardless of how it arrived on the Mac.

Gatekeeper and runtime protection in macOS - Apple Support


So the first warning you will see is that you have downloaded an app from a third party website that is an executable, not a benign data file. After you install the app or when it is run for the first time, then you may see an additional warning with a description that could say it has been blocked and moved to the trash, or that it could not be checked for Malware, which would mean that it is not notarized.

Safely open apps on your Mac - Apple Support


In addition to Gatekeeper and Notarization, you also have XProtect that performs 3 different scans on your computer at regular intervals to remediate Malware. This is for protection after the file has been installed and independent of the Notarization.

Protecting against malware in macOS - Apple Support


Reply

Apr 15, 2025 6:45 AM in response to John Galt

Gotcha, OK...



Clarified original question might be: what is the precise definition of "identified developer"?


Went hunting for documentation one more time. AFAIK, this is what Apple provides: Safely open apps on your Mac - Apple Support


(Won't get hung up on "identified developer" vs "verified developer". I assume that's simply a terminology change since macOS 12).


Per this guidance, a Gatekeeper block in this scenario does in fact explicitly mean the app has not been signed and notarized.


Interpretation being that if you've selected "Allow apps from App Store and identified developers"... then if you get one of these Gatekeeper blocks, it's specifically because the app is not signed.


Had been going off numerous forum discussions that suggested not identified developer could simply be triggered because an app was downloaded from 3rd-party site (even though still signed). But I think this confirms that's not the case.


Thanks.

Reply

Apr 15, 2025 7:30 AM in response to FairWarning332

Here you go: Signing Mac Software with Developer ID - Apple Developer


and


Notarizing macOS software before distribution | Apple Developer Documentation


It's not particularly difficult for a developer to comply with those requirements, even to the point that software that can arguably be considered malware can be signed and notarized.

Reply

Gatekeeper App Block - Reason

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.