Hardened Runtime

The Hardened Runtime is a macOS security mode that an app opts into at signing time. It blocks classes of tampering, code injection, loading unsigned libraries, debugger attachment, unless the app explicitly carves out exceptions via entitlements.

It matters because notarization requires it: Apple will not notarize a Developer ID app that isn't signed with the Hardened Runtime enabled, and without notarization, Gatekeeper blocks the app on modern macOS. So for any Mac app distributed outside the store, the chain is fixed: hardened runtime, then sign, then notarize.

Electron apps need a small set of exceptions to function under it, most notably allowances for JIT-compiled JavaScript. Getting those flags right is boilerplate once known, and mysterious crashes when not.

Deskifier's Mac builds are signed with the Hardened Runtime and the correct Electron exceptions, then notarized automatically, which is what lets the resulting DMG open cleanly on a fresh Mac.