macOS 27 Golden Gate Is Out: What Changes for Developers

macOS 27 Golden Gate shipped on September 14, 2026 as build 26A428, on the same day as iOS 27.0 and Xcode 27, and it installs only on Apple silicon: Apple’s compatibility list runs from the M1 MacBook Air of 2020 to the M6 Mac mini and includes one A-series machine, the 13-inch MacBook Neo with the A18 Pro.¹² For developers the release is the last general-purpose year of Rosetta. Apple’s support article of the same day says Rosetta “is available for any Mac with Apple silicon using macOS 27 or earlier” and that macOS 28 keeps it “only for certain older, unmaintained games that rely on Intel-based frameworks.”³ The GA release notes carry four Rosetta entries: apps a user had set to “Open using Rosetta” launch natively, Rosetta is not restored after the upgrade, installer packages that name no host architecture default to arm64, and Intel plug-ins may not appear in the Settings list or trigger a notification.⁴ I do not have a Mac running macOS 27, so every claim below is Apple’s text, plus what I could check on macOS 26.6.2: what a stock installer package declares, what the productbuild manual says the installer did with a distribution that names no architecture, and which of the new command-line verbs the 26.6 tools lack.⁵¹³¹⁴

TL;DR

• Dates and builds. Apple’s releases feed lists macOS 27.0 (26A428) on Monday, September 14, beside Xcode 27 (27A266a) and iOS 27.0 (24A437).¹ The compatibility page, published the same day, carries 35 model entries, all Apple silicon, and the upgrade page states the rule in one sentence: “macOS 27 is compatible with any Mac with Apple silicon, which includes any Mac with an M-series chip or A-series chip.”²
• Apple has written Rosetta’s calendar down. The support article and the release notes agree that macOS 28 keeps a games-only subset, and the enterprise notes call Rosetta “a general-purpose compatibility tool through macOS 27.”³⁴¹⁰ On the upgrade itself, Rosetta “is not automatically restored,” and apps a user pinned to “Open using Rosetta” launch natively.⁴
• Installer packages change architecture by default. Apple: “Installer packages which specify no hostArchitecture will now default to arm64.”⁴ On macOS 26.6.2 a component package built with pkgbuild carries no distribution file at all, so it names no architecture, while productbuild --synthesize wrote hostArchitectures="x86_64,arm64" into the distribution it generated for my package; Apple’s archived Distribution XML reference still lists only i386, x86_64, and ppc as valid codes.⁵⁶
• Intel apps carry a label before they stop. Apple says Get Info now displays “a treatment” on “Intel-based applications that will no longer run in macOS 28.0,” and Settings > General lists them, with a beta-only game-test-tool that disables Rosetta outright and runs legacy games through what Apple calls “the new underlying system behavior.”⁸
• Five system changes with no Rosetta in them. macOS denies cross-team container reads without a prompt, apps lose direct access to the TCC database, spctl gains a purge command, management-related connections require TLS 1.2 with ATS-grade cipher suites, and App Attest arrives on the Mac.⁹¹⁰¹¹
• What I could not run. The native-launch override, the missing Rosetta after upgrade, the Get Info treatment, the Settings list, and the arm64 default for a bare component package: all five need a Mac on 27. I report them here as Apple states them, and the section near the end lists each one.

What shipped on September 14?

The name comes from the release notes’ own overview: “The macOS 27 SDK provides support to develop apps for Mac computers running macOS 27 Golden Gate.”⁴ The A-series entry is the detail worth a second look: the upgrade page’s phrasing, “M-series chip or A-series chip,” describes the platform rather than one chip family, and the MacBook Neo is the only machine on the list that fits the second half of it.²

What does macOS 27 do to Rosetta?

Two support articles published on September 14 and the GA release notes describe the same boundary from three angles, and they agree on where it falls.

The support article for Intel apps: “Rosetta is available for any Mac with Apple silicon using macOS 27 or earlier. Starting with macOS 28, the next major macOS release, Rosetta functionality will be available only for certain older, unmaintained games that rely on Intel-based frameworks.”³

The enterprise notes: “If Rosetta was previously installed, it will not be automatically restored upon upgrading to macOS 27. Rosetta will continue as a general-purpose compatibility tool through macOS 27.”¹⁰

The release notes, Rosetta section, which carries one New Features entry and three Deprecations:⁴

• “On launch, Applications previously set to ‘Open using Rosetta’ by a user will have the application launch natively. Any compatibility issues requiring Rosetta from the past should be re-assessed on macOS 27.”
• “If Rosetta was previously installed, it is not automatically restored after upgrading to macOS 27.0.”
• “Installer packages which specify no hostArchitecture will now default to arm64. Ensure any pre and post install scripts behave as intended under arm64. Additionally, audit any remaining installer plugins to ensure compatibility on Apple silicon.”
• “Intel-based plugins and loaders may not appear in Settings or trigger notifications of their incompatibility. All Intel-based software will no longer be compatible with macOS 28.0, excluding legacy games.” The same entry names the folders to check: ~/Library/Audio/Plug-Ins/*, ~/Library/Printers/, and ~/Library/ColorPickers/, for “VSTs, HAL, ARA, PDEs, Color Pickers, Quicklook & Spotlight plugins/extensions/components.”

The first bullet and the support article look contradictory until you read the word “previously.” The support article says a Universal app’s “Open using Rosetta” checkbox still works: “you can use it in macOS 27 or earlier to force the app to open as an Intel-based app, which allows it to use Intel-only plug-ins, extensions, and other add-ons.”³ The release note says apps “previously set” to that mode launch natively. My reading, which I cannot test without a 27 machine, is that the upgrade clears the setting once and the user can set it again; Apple’s instruction to “re-assess” the old compatibility issue points the same way. If that reading is right, a user who relied on that checkbox for an Intel plug-in sees the app open native, with the plug-in unloaded, on the first launch after upgrading.

The second change bites earlier than the first. Apple says a Mac that had Rosetta installed upgrades to 27.0 without it, so, per its install instructions, opening any Intel app is how it comes back.³⁴¹⁰ Apple’s text does not say what a script that runs an Intel binary does on a Mac without Rosetta; plan for it to fail until Rosetta is installed, by that prompt or by softwareupdate --install-rosetta.³ Apple’s Rosetta documentation adds the one case that needs no install: “macOS 27 directly integrates support for Intel binary translation, without needing to install Rosetta,” for Intel Linux binaries inside virtual machines and containers; the Xcode 27 Intel post walks through that sentence and the rest of the Rosetta timeline as Apple’s documentation stated it in July.⁷

The games carve-out has a beta-only shape. The Gaming section describes sudo game-test-tool enable, which turns on “support for legacy Intel-based games” and, in the same breath, warns that “enabling legacy game support disables Rosetta, non-game processes might crash or behave unexpectedly, and this feature is intended only for playing legacy Intel-based games and is not available outside of macOS beta releases.”⁸ So the tool is a beta-only switch for what Apple calls “the new underlying system behavior”; the note says nothing about how macOS 28 exposes it.

Which installer packages default to arm64?

Apple’s sentence names a key, hostArchitecture, in the singular; the attribute it matches is hostArchitectures on the <options> element of a Distribution XML, the file inside a product archive, which Apple’s reference describes as “a comma-separated list of supported architecture codes.”⁶ Apple’s “packages which specify no hostArchitecture” are, on my reading, ones whose distribution has no such attribute, or that have no distribution at all.

On macOS 26.6.2 I built the smallest possible package both ways.⁵ A component package from pkgbuild expands to three entries, Bom, PackageInfo, and Payload, and no Distribution file; there is nowhere in it for an architecture to be declared, so a bare component package installed directly is the plainest case of a package that specifies none. A product archive is different: productbuild --synthesize on the same component wrote this options line into the distribution it generated, and the archive built from it carries the same line after pkgutil --expand:

<options customize="never" require-scripts="false" hostArchitectures="x86_64,arm64"/>

So a package produced by a stock productbuild run on 26.6 already declares both architectures, and, on Apple’s wording, the new default does not apply to it. The packages that change are the ones built from a hand-written distribution that omits the attribute, the ones assembled by third-party tools that never emit it, and bare component packages. The archived Distribution XML reference makes the gap visible: its list of valid codes is “i386, x86_64, and ppc,” with no arm64, so a distribution written against that reference had no arm64 code to name.⁶

The productbuild manual on 26.6.2 supplies the “before” that Apple’s note leaves out. “On Apple Silicon, the macOS Installer will evaluate the product’s distribution under Rosetta 2 unless the arch key includes the arm64 architecture specifier,” and “If the distribution is evaluated under Rosetta 2, any package scripts inside of product will be executed with Rosetta 2 at install time.” The same page describes the requirements key behind the attribute I saw, arch, which on my reading productbuild writes out as hostArchitectures: “Starting on macOS Big Sur (11.0), productbuild will automatically specify support for both arm64 and x86_64 unless a custom value for arch is provided.”¹⁴ So the default Apple says it is changing was evaluation under Rosetta 2, scripts included; on 27, by Apple’s note, a distribution that names no architecture defaults to arm64 instead.

To check a package you ship or install:

pkgutil --expand YourProduct.pkg /tmp/expanded
grep -o 'hostArchitectures="[^"]*"' /tmp/expanded/Distribution

No Distribution file, or no match, on Apple’s wording means the package inherits the new arm64 default on 27, and the scripts inside it run under arm64. That is the part of Apple’s note that changes behavior rather than metadata: a preinstall or postinstall script that branches on uname -m would take the arm64 branch, and one that launches a helper built for x86_64 needs Rosetta on a machine that may no longer have it installed at all.⁴ Apple’s note ends with the audit it wants: “audit any remaining installer plugins to ensure compatibility on Apple silicon,” because Apple’s Rosetta documentation rules out the mixed case: “The system prevents you from mixing arm64 code and x86_64 code in the same process.”⁷

What else changed for developers?

The rest of the GA notes that touch code you ship, with Apple’s wording where the wording is the point:⁹

• Cross-team containers. “Accessing files in other developer teams’ app data containers and app group containers no longer prompts the user for authorization; such accesses are denied by default and can be managed by the user in Privacy & Security settings.” My August post covers the failure mode: the API still returns a URL, and the denial lands at read time. A second entry adds that “XProtect may now restrict access to app data that is commonly targeted by malicious software.” A Known Issue under Privacy & Security Settings covers the command-line case: “In the Files & Folders pane, a process without a bundle ID cannot be granted access to specific app data containers or app group containers owned by other developer teams,” and Apple’s workaround is Full Disk Access “for the duration of the requirement.”
• TCC. “Apps can no longer access the local TCC database directly.” The enterprise notes pair that removal with a new query path for administrators: “The new tccutil list command can report current privacy authorizations for specified services or apps on managed devices.”¹⁰ On 26.6.2, tccutil accepts exactly one verb, reset.¹³
• launchd, filed as fixed. Under Launch Daemons and Agents, Resolved Issues, Apple writes: “Fixed: launchd no longer supports loading launchd property list files with the quarantine extended attribute.” Apple uses the “Fixed:” prefix two ways in the same document: for the problem it resolved (Accessory Access, 176815987: “Fixed: Accessory Access does not work inside App Sandbox.”) and for the resolved behavior itself (Foundation, 161588649: “Fixed: +[NSURL URLWithString:] no longer double-encodes the % of valid percent-escape sequences when encoding other invalid characters.”). Read the first way, the launchd line is a beta restriction lifted at GA; read the second way, the restriction is what shipped. The note leaves the shipped behavior ambiguous, and I cannot test it without a 27 machine.
• Gatekeeper. spctl gains a purge command “which will clean up Gatekeeper database entries for apps and executables which are no longer mounted.” Apple’s entry spells the flag with a single dash character, so check the tool’s own help on 27 before typing it; the 26.6.2 tool’s usage text lists no purge command.¹³
• Network security for managed Macs. “Starting in 27.0 operating systems, select system processes now enforce stricter network security (TLS) requirements.” The affected work is MDM, declarative management, Automated Device Enrollment, profile installation, app installation, and software updates, and the bar is “TLS 1.2 at minimum, using cipher suites and certificates that meet App Transport Security (ATS) requirements.” Apple’s support article for administrators adds that SCEP and content-caching connections are exempt.¹¹
• App Attest on the Mac. “App Attest is now available to verify the authenticity of Mac apps.”¹⁰
• Managed packages and legacy update management. Device management “can configure the desired behavior when a managed package is removed,” and “Legacy software update management no longer functions in all 27.0 operating systems,” which retires the old software-update commands, queries, and deferral restrictions in favor of declarative management.¹⁰
• System. The System library “now provides Swift APIs for the C stat, lstat, fstat, and fstatat system calls,” and a Resolved Issue records a beta build break: unqualified stat() calls in your own FilePath or FileDescriptor extensions “might conflict with the new Swift stat() instance methods,” which Apple lists as fixed at GA.
• Disk images. “The new DiskImageKit framework provides Swift APIs for creating and managing standalone and stacked disk images in the Apple Sparse Image Format (ASIF) and raw disk image formats,” for use with the Virtualization framework.
• Mac Catalyst. Catalyst apps “now behave like AppKit apps when you switch to them with no open windows,” so switching to one no longer creates a window unless the activation came from the Dock or Spotlight.
• Startup Disk. A Known Issue for anyone who keeps an old volume around: “When a Mac is running macOS 11.0, you might not be able to select the boot volume of macOS 27.0 or later as the startup disk in System Settings.” Apple’s workaround is the power-button startup options screen.

The Xcode side of the same release is in two places already. The Xcode 27 release post reproduces the ARCHS_STANDARD change on 27A266a, where a macOS deployment target of 27.0 resolves to arm64 alone, and the Intel post traces the three Intel Deprecation sentences; Apple’s GA wording for those entries matches the beta 4 text, including the line that keeps the Intel path open for one more year: “Intel development is still possible with macOS versions that support Rosetta like macOS 27.”¹²

What I could not run

I have no Mac on macOS 27, so every 27 behavior in this post is Apple’s statement. The five this post leans on hardest are: that pinned “Open using Rosetta” apps launch natively after the upgrade; that Rosetta is absent after upgrading a Mac that had it; that Get Info shows a treatment on apps that will not run on 28; that Settings > General lists them; that a bare component package runs its scripts under arm64 on 27. The installer experiment above establishes what packages declare on 26.6.2, not how 27 treats them. When a 27 machine is available, each of those five lines gets a dated section here, the same way the ld64 post gained its GA sections.

What I would do this week

1. Expand every package you ship and every package your build machines install, and grep the distribution for hostArchitectures; treat a missing file or a missing attribute as “arm64 on 27” and read the pre- and post-install scripts with that in mind.⁴⁵
2. If any CI or provisioning step runs an Intel binary, install Rosetta explicitly in the setup script rather than relying on it surviving the upgrade; Apple says it does not.⁴¹⁰
3. List Intel plug-ins the way Apple does, by folder: ~/Library/Audio/Plug-Ins/*, ~/Library/Printers/, ~/Library/ColorPickers/, and wherever your Quick Look and Spotlight extensions live, which Apple names by category rather than by path. Settings may not list them, and macOS 28 will not load them.⁴
4. If you install a launch agent by copying a plist, test it once on a 27 machine with the quarantine attribute still set; Apple files its note on that case under Resolved Issues, and it reads both ways.⁹
5. If you run device management, test your MDM, enrollment, and update servers against the TLS 1.2 and ATS cipher requirements now; Apple says its operating systems “might refuse connections” to non-compliant servers, the same page’s entry for version 27 or later reads “Non-compliant connections are blocked and the log messages appear as errors instead of warnings,” and SCEP and content caching are the only exemptions it lists.⁹¹¹
6. If you worked around the stat() collision on a beta, remove the workaround and rebuild; Apple lists it as fixed at GA.⁹

FAQ

When did macOS 27 come out?

Monday, September 14, 2026, as build 26A428, on the same day as iOS 27.0 (24A437) and Xcode 27 (27A266a). Apple’s releases feed lists all of them under that date.¹

Which Macs can run macOS 27 Golden Gate?

Any Mac with Apple silicon. Apple’s compatibility page lists 35 model entries from the M1 MacBook Air, MacBook Pro, and Mac mini of 2020 through the M5 and M6 machines, plus the MacBook Neo (13-inch, A18 Pro). No Intel Mac is on the list.²

Does Rosetta still work on macOS 27?

Yes. Apple’s support article says Rosetta “is available for any Mac with Apple silicon using macOS 27 or earlier,” and the enterprise notes call it “a general-purpose compatibility tool through macOS 27.” Apple says the upgrade does not restore it, so a Mac that had it may need to install it again.³⁴¹⁰

Will Rosetta work on macOS 28?

Only for games. “Starting with macOS 28, the next major macOS release, Rosetta functionality will be available only for certain older, unmaintained games that rely on Intel-based frameworks,” and the release notes say “All Intel-based software will no longer be compatible with macOS 28.0, excluding legacy games.”³⁴

Which installer packages does the arm64 default affect?

Packages whose distribution file has no hostArchitectures attribute, and bare component packages, which have no distribution file at all. A product archive generated by productbuild on macOS 26.6.2 declares hostArchitectures="x86_64,arm64" and falls outside Apple’s sentence. Check with pkgutil --expand and a grep of the Distribution file.⁴⁵⁶

Do I need to reinstall Rosetta after upgrading?

Apple says that if the Mac had Rosetta before the upgrade, macOS 27 does not bring it back on its own. Per Apple’s install instructions, opening any Intel app brings the prompt back, or you can install it from Terminal with softwareupdate --install-rosetta, the command Apple’s support article gives.³⁴

Sources