macOS 10.14.5 beta 4 & Notarization Update

Editors Note: This remains a work in progress. Notarization dates are a moving target as of beta 4.

Previous Posts

macOS 10.14.5 beta, Notarization and Stapling Review (April 18th 2019)
macOS 10.14.5 beta 2: Kernel Extension Notarization, UAMDM, Whitelisting & You (April 9th, 2019)

New Notarization Deadline

Apple released a new version of macOS 10.14.5 to the beta groups today, and as of the beta 4 build, the notarization cutoff date is now April 7th, 2019, for new software developers to sign and notarize their new builds of kernel extensions, and for newly registered developers to sign and notarize all builds fo their software signed with Developer ID certificates.

This April 7th date corresponds with Apple’s April 8th post to all Apple Developer members explaining the new Notarization Requirements:

We’re working with developers to create a safer Mac user experience through a process where all software, whether distributed on the App Store or outside of it, is signed or notarized by Apple. With the public release of macOS 10.14.5, we require that all developers creating a Developer ID certificate for the first time notarize their apps, and that all new and updated kernel extensions be notarized as well. This will help give users more confidence that the software they download and run, no matter where they get it from, is not malware by showing a more streamlined Gatekeeper interface.

As with previous releases, if the installer package has been notarized, but doesn’t have a stapled ticket, and network access is unavailable, the installer package will not successfully installed. This would be a great week to be testing your critical kernel extension installers with an up to date release of the beta to make sure that you’re not going to be faced with surprises when this is the new law of the land.

As with previous releases, kext whitelisting via UAMDM will successfully route around incomplete or non-existent notarization processes. Which reminds me: if you’re not using UAMDM of some kind, why is that exactly?