Mac app notarization and customer privacy

from blog The Desolation of Blog, | ↗ original
When you download a Mac app from outside the Mac App Store and launch the app for the first time, macOS checks whether the app was signed with a valid certificate from a developer registered with Apple's paid Developer ID program. The macOS technology responsible for this verification is called Gatekeeper. On macOS 10.14 Mojave, Gatekeeper added a step to the verification: in addition to checking whether an app was signed with a Developer ID certificate, it also checks whether the app was notarized by Apple. App notarization requires that a developer submit the app to Apple for an automated malware scan, and if no malware is found, Apple notarizes the app; the notarization status is stored on Apple's servers, and a notarization ticket can be "stapled" to the app by the developer so that Gatekeeper can see the notarization when the app is launched. Every version of an app must be notarized separately, the notarization does not carry over to later versions. Apple has provided some documentation of Mac app notarization for developers and for end users.