If you push your packages with MDM you don t need to notariz

Question

If you push your packages with MDM you don t need to notarize

Guillaume · Answer

Good point but for people with customers who aren t gonna be on MDM 100 of the time we need to have a good workflow to get that done too For internal needs with MDM there s probably no need for EV certs etc either slightly smiling face

groob · Answer

sure but osquery is also largely going to work less and less for customers without mdm

groob · Answer

that s the brave future on macOS

Guillaume · Answer

Yep

groob · Answer

kolide builds unique packages for each customer because it includes enrollment secrets config specific for that customer

groob · Answer

but they could also build + notarize a single package with no configuration for everyone

Guillaume · Answer

We do that too at Uptycs

groob · Answer

and use a different method for configuration

groob · Answer

yeah it s a convenience thing which is probably not a use case apple is thinking about

groob · Answer

but it s a good question to bring up

Guillaume · Answer

I think I would rather have a immutable package and have a way to specify config with arguments than hope notarization will always happen at the speed I would want it to but who knows maybe it ll scale too

groob · Answer

there s other tools that ship config cisco comes to mind

Guillaume · Answer

yeah definitely not a unique use case