Shipping a Mac app without a $99 Apple Developer account

I am the author of Kopi, an open-source clipboard manager for macOS and Windows. It was while writing this open-source project that I had to make a decision about shipping a Mac app without a $99 annual Apple Developer account. I wrote up the decision in a decision record and decided to share the story behind it.

macOS requires apps downloaded from the internet to be signed with an Apple Developer ID certificate and notarized by Apple to avoid Gatekeeper warnings. For a commercial app, this fee is normal, but Kopi is free and open source, so I decided against paying the fee. My first thought was to skip the paid certificate, sign the app ad-hoc, and tell people to click through the warning.

However, this didn't work because Kopi needs two macOS permissions: Accessibility and Pasteboard access. macOS doesn't remember these grants by app name, but rather by the app's designated requirement, which is based on the code signature hash. With an ad-hoc signature, every new build has a different hash, meaning each new build appears as a different app to macOS.

This caused issues for my alpha testers, who would lose permissions with every update and have to manually grant them every time.

The solution was to use a self-signed certificate that never changes. By signing the app with a real, self-signed certificate, I could base the designated requirement on the bundle identifier and the certificate itself instead of the build's hash. This means that version N+1 is considered the same app as version N by macOS, so permissions carry over between updates. Although the app is not trusted by Apple when first opened, this approach solved the issue of permissions resetting on every update.