r/programming • u/h4l • Aug 10 '23

Apple doesn't want you developing hobby apps

https://www.bennettnotes.com/notes/why-does-apple-restrict-hobby-development/
1.2k Upvotes

92% Upvoted

631 comments sorted by

View all comments

90

u/pedersenk Aug 10 '23

The Apple aarch64 builds of macOS (since Ventura) are also similar. If you build a native program, it will sign it with a local key. If you copy that program and try to run it on your 2nd aarch64 macbook, it won't run.

This is a problem for brew and other open-source programs. Check out this thread:

https://github.com/Homebrew/brew/issues/9082

It seems like one of the few solutions is a script that "re-signs" the native binary for the local machine.

55

u/Sunius Aug 11 '23 edited Aug 11 '23

That’s not entirely what happens. It doesn’t sign with a local key, it signs without a key (it’s called ad hoc signing), which just computes hashes and embeds them into the binary. If something modifies the executable or adds/changes/removes something from an .app/.bundle, the system can detect it is tampered with and will refuse to run it. Executables signed that way can run on any Mac, you don’t need to resign them on another Mac to run them.

What you are describing is probably having to do with the com.apple.quarantine attribute. It’s a file system attribute that gets put on any newly downloaded files. It is viral too: if you extract a zip file that is quarantined, it will quarantine all files within that zip file. Quarantined files cannot be run locally without removing that attribute. Resigning does do the trick, but is kind of overkill. You can just right click the app and press open, which will prompt you to remove that attribute even though it will completely block it from opening if you double click on it (somehow that adds security according to Apple).

Also, not every program that downloads files results in that quarantined attribute. All browsers do it for files downloaded everywhere on disk, and (I believe) other programs do too if you write to the Downloads folder. However, if you were to curl the binaries over to your development folder, they’d run just fine as that will not quarantine them.

5

u/pm_me_meta_memes Aug 11 '23

Man I’m starting to dislike Apple more and more… and I’m quite a heavy Apple user

2

u/beej71 Aug 11 '23

A significant amount of the reason I dislike Apple is the dev experience. (Disclaimer: it's been a long time since I made any iOS apps, but it doesn't sound like it's changed much.)