title: Hardened runtime for Java and Mojave
body: <p>I currently distribute a Java application, <a href="http://thegreyblog.blogspot.com/2014/06/os-x-creating-packages-from-command_2.html" rel="noreferrer">packaged and signed</a> using <a href="http://thegreyblog.blogspot.com/2014/06/os-x-creating-packages-from-command_2.html" rel="noreferrer"><code>pkgbuild</code></a> on macOS.</p>
  
  <p>Recently, Apple warns developers:</p>
  
  <blockquote>
    <p>"In an upcoming release of macOS, Gatekeeper will require Developer ID–signed software to be <a href="https://developer.apple.com/developer-id/" rel="noreferrer">notarized</a> by Apple."</p>
  </blockquote>
  
  <p>Upon reading the notarizing docs, apple <a href="https://help.apple.com/xcode/mac/current/#/dev033e997ca" rel="noreferrer">warns developers</a>:</p>
  
  <blockquote>
    <p>"You must enable <a href="https://help.apple.com/xcode/mac/current/#/dev9d65d791c" rel="noreferrer">hardened runtime</a> for your app to be notarized by Apple."</p>
  </blockquote>
  
  <p>Which goes into some details about how to toggle these settings on within Xcode.  But what about apps not developed with Xcode?  <a href="https://github.com/mono/mono/issues/9210" rel="noreferrer">Xamarin/Mono have some back and forth</a> about how they're tackling this but the commits so far seem to focus on Mojave detection and C/C++.  What about Java apps or apps that don't distribute any C/C++/Objective-C compiled code?  How does a project get "notarized" so that it doesn't get blocked by a future macOS update?</p>
  
  <p>Possibly related: <a href="https://stackoverflow.com/questions/52905940">How to codesign and enable the hardened runtime for a 3rd-party CLI on Xcode?</a></p>