<p dir="auto">I have been using Julia-1.0 at the Terminal and under Jupyter for some time under the previous MacOS. I recently upgraded to Catalina 10.15.2. I can still use Julia 1.0 under Terminal, but when I try to run the new Julia-1.3, I get the alert:</p>
<blockquote>
<p dir="auto">“Julia-1.3” can’t be opened because Apple cannot check it for malicious software.</p>
</blockquote>
<p dir="auto">Update: I am able to get around this by approving within "System Preferences / Security &amp; Privacy".</p>
<p dir="auto">Not sure, but I am guessing this is related to the new required app notarization under Catalina. Anyone want to fight with this? Maybe someone can update the instructions in the meantime.</p>
<p dir="auto">macOS 10.15+ is going to start requiring us to "notarize" our apps by sending them to Apple to be scanned.  If we do not, we will get scary errors like the following:</p>
<blockquote>
<p dir="auto">"Julia-1.0" can't be opened because Apple cannot check it for malicious software.<br>
<sub>This software needs to be updated. Contact the developer for more information.</sub></p>
</blockquote>
<p dir="auto">To temporarily work around this, right click on the application and select "open."</p>
<p dir="auto"><a target="_blank" rel="noopener noreferrer nofollow" href="https://user-images.githubusercontent.com/130920/65284720-44ee0800-daef-11e9-96a9-f359830baa32.png"><img src="https://user-images.githubusercontent.com/130920/65284720-44ee0800-daef-11e9-96a9-f359830baa32.png" alt="image" style="max-width: 100%;"></a></p>
<p dir="auto">Note that this is distinct from the "cannot be verified" error when an app is not signed; notarization protects against malware by forcing developers to upload their app bundles to Apple, where Apple can scan them with some algorithm, determine there is nothing harmful in there, then pass back a cryptographic notarization.  This must be done for every single build of Julia, if we want the <code class="notranslate">.app</code> to be openable. (We could conceivably not do this for nightly builds, and expect users to bypass the scary dialog, if this turns out to be a flaky process)</p>
<p dir="auto">The workflow we'll have to adopt is:</p>
<ul dir="auto">
<li>
<p dir="auto">Build and package Julia, just like normal.</p>
</li>
<li>
<p dir="auto">Sign julia, but opt in to the "<a href="https://developer.apple.com/documentation/security/hardened_runtime_entitlements" rel="nofollow">hardened runtime</a>".  Note that this, by default, disables things like being able to jump into writable pages, so we'll have to figure out the right set of "entitlements" to request, in order to peel back the appropriate layers of protection to get our JIT to still work.  This is done by passing <code class="notranslate">--options runtime</code> to <code class="notranslate">codesign</code>.</p>
</li>
<li>
<p dir="auto">Submit the packaged <code class="notranslate">.dmg</code> to Apple Notary service.  This should be doable by <code class="notranslate">/usr/bin/xcrun altool --notarize-app --primary-bundle-id "$BUNDLE_ID" --username "$APPLE_ID_EMAIL" --password "$APPLE_ID_PASSWORD" --file "$JULIA_DMG" --output-format "xml"</code></p>
</li>
<li>
<p dir="auto">Poll Apple until the notarization is complete.  We do that with something like <code class="notranslate">/usr/bin/xcrun altool --notarization-info --username "$APPLE_ID_EMAIL" --password "$APPLE_ID_PASSWORD" --output-format "xml"</code>, then parse the XML.  Note that this notarization can take multiple hours to complete, it is not a fast process, so I think we're going to need to run this as an asynchronous job, perhaps in parallel to testing.</p>
</li>
<li>
<p dir="auto">Staple notarization ticket to our app.  <code class="notranslate">xcrun stapler staple Julia.app</code>.  Note that this is performed on an <code class="notranslate">.app</code>, not a <code class="notranslate">.dmg</code>.  We need to download the DMG, mount it as read/write (probably by using shadow mounts, like we do when needing to <a href="https://gist.github.com/staticfloat/62369d705f265c0b35ff8888b2e1d76c">resign something</a>), staple the ticket to the .app, then generate a <em>new</em> <code class="notranslate">.dmg</code>.</p>
</li>
</ul>
<p dir="auto">References:</p>
<ul dir="auto">
<li>
<p dir="auto"><a href="https://stackoverflow.com/questions/56890749/macos-notarize-in-script" rel="nofollow">https://stackoverflow.com/questions/56890749/macos-notarize-in-script</a></p>
</li>
<li>
<p dir="auto"><a href="https://developer.apple.com/documentation/security/hardened_runtime_entitlements" rel="nofollow">https://developer.apple.com/documentation/security/hardened_runtime_entitlements</a></p>
</li>
<li>
<p dir="auto"><a href="https://gist.github.com/staticfloat/62369d705f265c0b35ff8888b2e1d76c">https://gist.github.com/staticfloat/62369d705f265c0b35ff8888b2e1d76c</a></p>
</li>
</ul>