However, unsigned executables are not permitted to launch under a hardened runtime environment and, therefore, the App Review team provided guidance that the packaging of the BlueMail app may need to be changed in order for it to become compatible with Catalina.
Apple now claims that “unsigned executables are not permitted to launch under a hardened runtime environment,” and that BlueMail needs “to become compatible with Catalina.” Again, Apple’s rejection of BlueMail pre-dates Catalina and was not tied to Catalina. This is another shifting explanation. And again, it is not true. Apps distributed through the App Store are not required to have the hardened runtime capability enabled.
More details
There are two ways to distribute macOS apps.
Distribution through the Mac App Store
BlueMail for Mac was on the App Store until June 7, 2019. Notarization is not required for apps distributed through the App Store.
“Beginning in macOS 10.15, all software built after June 1, 2019, and distributed with Developer ID must be notarized. However, you aren’t required to notarize software that you distribute through the Mac App Store because the App Store submission process already includes equivalent security checks.”
Apple Developer documentation
The hardened runtime is not required for Mac App Store distribution. What is required is the App Sandbox capability, which BlueMail fully supports.
“To distribute a macOS app through the Mac App Store, you must enable the App Sandbox capability.”
Apple Developer documentation
Distribution outside the Mac App Store
To distribute outside the App Store, notarization is required to skip the Gatekeeper warnings:
“Notarization is all about identifying and blocking malicious Mac software prior to distribution, without requiring App Review or the Mac App Store.”
“All About Notarization”, WWDC19
We have asked to return to the App Store, so this is irrelevant to us. If we wanted to notarize our app (and we do not), the hardened runtime would be required. Apple is asking us to enable it for Mac App Store distribution. It is yet another excuse for not restoring BlueMail to the Mac App Store.
And last but not least: even if we wanted to distribute outside the Mac App Store, Apple does not tell the whole truth:
“We’ve adjusted the notarization prerequisites until January 2020. You can now notarize Mac software that doesn’t have the Hardened Runtime capability enabled [and] has components not signed with your Developer ID.”
Apple Developer News
So even if we had to enable the hardened runtime (and we do not), Apple raised it eight months after expelling us from the Mac App Store, and three days before its own end-of-January 2020 deadline.