macOS 27 Golden Gate Is Out: What Changes for Developers

macOS 27 Golden Gate shipped on September 14, 2026 as build 26A428, on the same day as iOS 27.0 and Xcode 27, and it installs only on Apple silicon: Apple’s compatibility list runs from the M1 MacBook Air of 2020 to the M6 Mac mini and includes one A-series machine, the 13-inch MacBook Neo with the A18 Pro.¹² For developers the release is the last general-purpose year of Rosetta. Apple’s support article of the same day says Rosetta “is available for any Mac with Apple silicon using macOS 27 or earlier” and that macOS 28 keeps it “only for certain older, unmaintained games that rely on Intel-based frameworks.”³ The GA release notes carry four Rosetta entries: apps a user had set to “Open using Rosetta” launch natively, Rosetta is not restored after the upgrade, installer packages that name no host architecture default to arm64, and Intel plug-ins may not appear in the Settings list or trigger a notification.⁴ When I wrote this post on September 16 I had no Mac on macOS 27, so the claims below are Apple’s text, plus what I could check on macOS 26.6.2: what a stock installer package declares, what the productbuild manual says the installer did with a distribution that names no architecture, and which of the new command-line verbs the 26.6 tools lack. Updates on October 1 and 2 add five first-hand checks on the same Mac after it moved to 27.0, and Apple’s February 1, 2027 deadline for re-signing installer packages.^51314151819

TL;DR

• Dates and builds. Apple’s releases feed, fetched on September 16, listed macOS 27.0 (26A428) on Monday, September 14, beside Xcode 27 (27A266a) and iOS 27.0 (24A437); by October 1 the feed carried 27.0.1 items in place of the macOS and iOS 27.0 ones.¹¹⁷ The compatibility page, published the same day, carries 35 model entries, all Apple silicon, and the upgrade page states the rule in one sentence: “macOS 27 is compatible with any Mac with Apple silicon, which includes any Mac with an M-series chip or A-series chip.”²
• Apple has written Rosetta’s calendar down. The support article and the release notes agree that macOS 28 keeps a games-only subset, and the enterprise notes call Rosetta “a general-purpose compatibility tool through macOS 27.”³⁴¹⁰ On the upgrade itself, Rosetta “is not automatically restored,” and apps a user pinned to “Open using Rosetta” launch natively.⁴
• Installer packages change architecture by default. Apple: “Installer packages which specify no hostArchitecture will now default to arm64.”⁴ On macOS 26.6.2 a component package built with pkgbuild carries no distribution file at all, so it names no architecture, while productbuild --synthesize wrote hostArchitectures="x86_64,arm64" into the distribution it generated for my package; Apple’s archived Distribution XML reference still lists only i386, x86_64, and ppc as valid codes.⁵⁶
• Intel apps carry a label before they stop. Apple says Get Info now displays “a treatment” on “Intel-based applications that will no longer run in macOS 28.0,” and that Settings > General lists them, with a beta-only game-test-tool that disables Rosetta outright and runs legacy games through what Apple calls “the new underlying system behavior.”⁸ (October 2: on this Mac, Get Info shows a warning on the three Intel-only apps I read, quoted in the update below. The Settings list is not among General’s fourteen rows, and I have not opened the sub-panes behind them.¹⁹)
• Five system changes with no Rosetta in them. macOS denies cross-team container reads without a prompt, apps lose direct access to the TCC database, spctl gains a purge command, management-related connections require TLS 1.2 with ATS-grade cipher suites, and App Attest arrives on the Mac.⁹¹⁰¹¹
• A February 1, 2027 deadline for installers. Apple’s October 1 notice: the original Developer ID Certification Authority expires that day, and “.pkg files signed with an affected certificate will no longer install.” All four Developer ID-signed installers in my Downloads folder chain to that authority; the Developer ID post has the commands that tell you which authority your own certificate and packages chain to.¹⁵¹⁶
• Run and not yet run. The native-launch override and the arm64 default for a bare component package are Apple’s statements, not run on this Mac, which has run 27.0 since September 23. Its install history shows the upgrade did not bring Rosetta back, Get Info shows the macOS 28 warning on the three Intel-only apps I read, and the fourteen rows of Settings > General include no entry for Intel apps; I have not opened the sub-panes behind them. The section near the end lists each one.

What shipped on September 14?

The name comes from the release notes’ own overview: “The macOS 27 SDK provides support to develop apps for Mac computers running macOS 27 Golden Gate.”⁴ The A-series entry is the detail worth a second look: the upgrade page’s phrasing, “M-series chip or A-series chip,” describes the platform rather than one chip family, and the MacBook Neo is the only machine on the list that fits the second half of it.²

macOS 27.0.1 (26A434) followed on Monday, September 28. Apple’s update page says only “This update provides bug fixes for your Mac,” and it names no change to the Rosetta or installer entries below.¹⁷

What does macOS 27 do to Rosetta?

Two support articles published on September 14 and the GA release notes describe the same boundary from three angles, and they agree on where it falls.

The support article for Intel apps: “Rosetta is available for any Mac with Apple silicon using macOS 27 or earlier. Starting with macOS 28, the next major macOS release, Rosetta functionality will be available only for certain older, unmaintained games that rely on Intel-based frameworks.”³

The enterprise notes: “If Rosetta was previously installed, it will not be automatically restored upon upgrading to macOS 27. Rosetta will continue as a general-purpose compatibility tool through macOS 27.”¹⁰

The release notes, Rosetta section, which carries one New Features entry and three Deprecations:⁴

• “On launch, Applications previously set to ‘Open using Rosetta’ by a user will have the application launch natively. Any compatibility issues requiring Rosetta from the past should be re-assessed on macOS 27.”
• “If Rosetta was previously installed, it is not automatically restored after upgrading to macOS 27.0.”
• “Installer packages which specify no hostArchitecture will now default to arm64. Ensure any pre and post install scripts behave as intended under arm64. Additionally, audit any remaining installer plugins to ensure compatibility on Apple silicon.”
• “Intel-based plugins and loaders may not appear in Settings or trigger notifications of their incompatibility. All Intel-based software will no longer be compatible with macOS 28.0, excluding legacy games.” The same entry names the folders to check: ~/Library/Audio/Plug-Ins/*, ~/Library/Printers/, and ~/Library/ColorPickers/, for “VSTs, HAL, ARA, PDEs, Color Pickers, Quicklook & Spotlight plugins/extensions/components.”

The first bullet and the support article look contradictory until you read the word “previously.” The support article says a Universal app’s “Open using Rosetta” checkbox still works: “you can use it in macOS 27 or earlier to force the app to open as an Intel-based app, which allows it to use Intel-only plug-ins, extensions, and other add-ons.”³ The release note says apps “previously set” to that mode launch natively. My reading, which I have not tested, is that the upgrade clears the setting once and the user can set it again; Apple’s instruction to “re-assess” the old compatibility issue points the same way. If that reading is right, a user who relied on that checkbox for an Intel plug-in sees the app open native, with the plug-in unloaded, on the first launch after upgrading.

The second change bites earlier than the first. Apple says a Mac that had Rosetta installed upgrades to 27.0 without it, so, per its install instructions, opening any Intel app is how it comes back.³⁴¹⁰ Apple’s text does not say what a script that runs an Intel binary does on a Mac without Rosetta; plan for it to fail until Rosetta is installed, by that prompt or by softwareupdate --install-rosetta.³ Apple’s Rosetta documentation adds the one case that needs no install: “macOS 27 directly integrates support for Intel binary translation, without needing to install Rosetta,” for Intel Linux binaries inside virtual machines and containers; the Xcode 27 Intel post walks through that sentence and the rest of the Rosetta timeline as Apple’s documentation stated it in July.⁷

The games carve-out has a beta-only shape. The Gaming section describes sudo game-test-tool enable, which turns on “support for legacy Intel-based games” and, in the same breath, warns that “enabling legacy game support disables Rosetta, non-game processes might crash or behave unexpectedly, and this feature is intended only for playing legacy Intel-based games and is not available outside of macOS beta releases.”⁸ So the tool is a beta-only switch for what Apple calls “the new underlying system behavior”; the note says nothing about how macOS 28 exposes it.

Which installer packages default to arm64?

Apple’s sentence names a key, hostArchitecture, in the singular; the attribute it matches is hostArchitectures on the <options> element of a Distribution XML, the file inside a product archive, which Apple’s reference describes as “a comma-separated list of supported architecture codes.”⁶ Apple’s “packages which specify no hostArchitecture” are, on my reading, ones whose distribution has no such attribute, or that have no distribution at all.

On macOS 26.6.2 I built the smallest possible package both ways.⁵ A component package from pkgbuild expands to three entries, Bom, PackageInfo, and Payload, and no Distribution file; there is nowhere in it for an architecture to be declared, so a bare component package installed directly is the plainest case of a package that specifies none. A product archive is different: productbuild --synthesize on the same component wrote this options line into the distribution it generated, and the archive built from it carries the same line after pkgutil --expand:

<options customize="never" require-scripts="false" hostArchitectures="x86_64,arm64"/>

So a package produced by a stock productbuild run on 26.6 already declares both architectures, and, on Apple’s wording, the new default does not apply to it. The packages that change are the ones built from a hand-written distribution that omits the attribute, the ones assembled by third-party tools that never emit it, and bare component packages. The archived Distribution XML reference makes the gap visible: its list of valid codes is “i386, x86_64, and ppc,” with no arm64, so a distribution written against that reference had no arm64 code to name.⁶

The productbuild manual on 26.6.2 supplies the “before” that Apple’s note leaves out. “On Apple Silicon, the macOS Installer will evaluate the product’s distribution under Rosetta 2 unless the arch key includes the arm64 architecture specifier,” and “If the distribution is evaluated under Rosetta 2, any package scripts inside of product will be executed with Rosetta 2 at install time.” The same page describes the requirements key behind the attribute I saw, arch, which on my reading productbuild writes out as hostArchitectures: “Starting on macOS Big Sur (11.0), productbuild will automatically specify support for both arm64 and x86_64 unless a custom value for arch is provided.”¹⁴ So the default Apple says it is changing was evaluation under Rosetta 2, scripts included; on 27, by Apple’s note, a distribution that names no architecture defaults to arm64 instead.

To check a package you ship or install:

pkgutil --expand YourProduct.pkg /tmp/expanded
grep -o 'hostArchitectures="[^"]*"' /tmp/expanded/Distribution

No Distribution file, or no match, on Apple’s wording means the package inherits the new arm64 default on 27, and the scripts inside it run under arm64. That is the part of Apple’s note that changes behavior rather than metadata: a preinstall or postinstall script that branches on uname -m would take the arm64 branch, and one that launches a helper built for x86_64 needs Rosetta on a machine that may no longer have it installed at all.⁴ Apple’s note ends with the audit it wants: “audit any remaining installer plugins to ensure compatibility on Apple silicon,” because Apple’s Rosetta documentation rules out the mixed case: “The system prevents you from mixing arm64 code and x86_64 code in the same process.”⁷

Update, October 1: an installer-signing deadline on February 1, 2027

Apple’s developer news on October 1 adds a deadline to the installer story above, and it has nothing to do with architecture: “The original Developer ID Certification Authority (Sub-CA) expires on February 1, 2027. Certificates issued by this authority will stop working on that date.” The two halves of Developer ID distribution fare differently. For packages: “Starting February 1, 2027, .pkg files signed with an affected certificate will no longer install. Re-sign all packages with your new certificate before this date.” For apps: “Previously signed and notarized Mac software (with a secure timestamp) will keep working,” and no action is needed.¹⁵

pkgutil --check-signature YourProduct.pkg prints the chain a package was signed with, and the original authority’s entry in it reads Expires: 2027-02-01 22:12:15 +0000. All four Developer ID-signed installers in my Downloads folder, from two vendors, show that line.¹⁶ The notice names no macOS version, so the deadline is not a Golden Gate change and has its own post: Developer ID Certification Authority Expires Feb 1, 2027 covers how to tell which authority issued your certificate, what the apps and installers on one Mac show, and the order to re-sign in.

What else changed for developers?

The rest of the GA notes that touch code you ship, with Apple’s wording where the wording is the point:⁹

• Cross-team containers. “Accessing files in other developer teams’ app data containers and app group containers no longer prompts the user for authorization; such accesses are denied by default and can be managed by the user in Privacy & Security settings.” My August post covers the failure mode: the API still returns a URL, and the denial lands at read time. A second entry adds that “XProtect may now restrict access to app data that is commonly targeted by malicious software.” A Known Issue under Privacy & Security Settings covers the command-line case: “In the Files & Folders pane, a process without a bundle ID cannot be granted access to specific app data containers or app group containers owned by other developer teams,” and Apple’s workaround is Full Disk Access “for the duration of the requirement.”
• TCC. “Apps can no longer access the local TCC database directly.” The enterprise notes pair that removal with a new query path for administrators: “The new tccutil list command can report current privacy authorizations for specified services or apps on managed devices.”¹⁰ On 26.6.2, tccutil accepts exactly one verb, reset.¹³ (On an unmanaged Mac running 27.0 the binary carries list but still answers with the reset usage line; see the October 1 update.)
• launchd, filed as fixed. Under Launch Daemons and Agents, Resolved Issues, Apple writes: “Fixed: launchd no longer supports loading launchd property list files with the quarantine extended attribute.” Apple uses the “Fixed:” prefix two ways in the same document: for the problem it resolved (Accessory Access, 176815987: “Fixed: Accessory Access does not work inside App Sandbox.”) and for the resolved behavior itself (Foundation, 161588649: “Fixed: +[NSURL URLWithString:] no longer double-encodes the % of valid percent-escape sequences when encoding other invalid characters.”). Read the first way, the launchd line is a beta restriction lifted at GA; read the second way, the restriction is what shipped. The note leaves the shipped behavior ambiguous, and I have not tested it. (October 1: this Mac now runs 27.0; that test is still to run.)
• Gatekeeper. spctl gains a purge command “which will clean up Gatekeeper database entries for apps and executables which are no longer mounted.” Apple’s entry spells the flag with a single dash character, so check the tool’s own help on 27 before typing it; the 26.6.2 tool’s usage text lists no purge command.¹³ (On 27.0 the tool lists spctl --purge; see the October 1 update.)
• Network security for managed Macs. “Starting in 27.0 operating systems, select system processes now enforce stricter network security (TLS) requirements.” The affected work is MDM, declarative management, Automated Device Enrollment, profile installation, app installation, and software updates, and the bar is “TLS 1.2 at minimum, using cipher suites and certificates that meet App Transport Security (ATS) requirements.” Apple’s support article for administrators adds that SCEP and content-caching connections are exempt.¹¹
• App Attest on the Mac. “App Attest is now available to verify the authenticity of Mac apps.”¹⁰
• Managed packages and legacy update management. Device management “can configure the desired behavior when a managed package is removed,” and “Legacy software update management no longer functions in all 27.0 operating systems,” which retires the old software-update commands, queries, and deferral restrictions in favor of declarative management.¹⁰
• System. The System library “now provides Swift APIs for the C stat, lstat, fstat, and fstatat system calls,” and a Resolved Issue records a beta build break: unqualified stat() calls in your own FilePath or FileDescriptor extensions “might conflict with the new Swift stat() instance methods,” which Apple lists as fixed at GA.
• Disk images. “The new DiskImageKit framework provides Swift APIs for creating and managing standalone and stacked disk images in the Apple Sparse Image Format (ASIF) and raw disk image formats,” for use with the Virtualization framework.
• Mac Catalyst. Catalyst apps “now behave like AppKit apps when you switch to them with no open windows,” so switching to one no longer creates a window unless the activation came from the Dock or Spotlight.
• Startup Disk. A Known Issue for anyone who keeps an old volume around: “When a Mac is running macOS 11.0, you might not be able to select the boot volume of macOS 27.0 or later as the startup disk in System Settings.” Apple’s workaround is the power-button startup options screen.

The Xcode side of the same release is in two places already. The Xcode 27 release post reproduces the ARCHS_STANDARD change on 27A266a, where a macOS deployment target of 27.0 resolves to arm64 alone, and the Intel post traces the three Intel Deprecation sentences; Apple’s GA wording for those entries matches the beta 4 text, including the line that keeps the Intel path open for one more year: “Intel development is still possible with macOS versions that support Rosetta like macOS 27.”¹²

Update, October 1: three checks on a Mac running macOS 27.0

The Mac this post was written on moved to macOS 27.0 (26A428) on September 23, so three of the claims above can be checked against it. Two give a clear answer; the third is inconclusive on an unmanaged Mac.¹⁸

Rosetta was not restored by the upgrade. /Library/Receipts/InstallHistory.plist on this Mac records every macOS update since 2023, and from June 2023 through 26.6.2 each one is paired, within seconds, with a RosettaUpdateAuto entry written by bootinstalld: the system updated Rosetta alongside every update. The macOS 27.0 entry of September 23 is the first since then with no partner. Rosetta returned a week later, on the evening of September 30 Pacific time, in an entry written by CoreServicesUIAgent, the same process that recorded this Mac’s first Rosetta install in 2023, 87 seconds before the first of a printer vendor’s installer packages ran. That matches Apple’s sentence: “If Rosetta was previously installed, it is not automatically restored after upgrading to macOS 27.0.”⁴ The history records which process installed Rosetta, not what was on screen, so I read the October entry as the install prompt on my own inference.

spctl has the purge command, with two dashes. On 27.0, spctl with no arguments lists spctl --purge # purge unmounted policy scan cache entries, and the manual page says it purges “old policy scan cache entries. Currently those which were on volumes which are no longer mounted. Requires root access.” The release note printed the flag with a single dash character; the tool’s usage and manual list it with two. I have not run it.

tccutil list is in the binary but refuses on this Mac. The 27.0 tccutil binary carries the verb and its usage text, tccutil list (-s SERVICE | -b BUNDLE_ID | -s SERVICE -b BUNDLE_ID). Run here as an ordinary user, bare or with -s, -b, or both, it prints the same single line it printed on 26.6.2, tccutil: Usage: tccutil reset SERVICE [BUNDLE_ID], and the manual page does not mention the verb. This Mac is not enrolled in device management, and Apple’s enterprise notes say the command reports “for specified services or apps on managed devices,”¹⁰ so the result is consistent with a command gated on enrollment. The binary does not say what the gate is, I did not run it as root, and I cannot test the managed case here.

Update, October 2: the Get Info warning, and a first look for the Settings list

Two more of the five Apple claims listed under “What I could not run” below, read on the same Mac (macOS 27.0, 26A428) through the Accessibility API.¹⁹

Get Info shows the warning. On three Intel-only apps, Finder’s Get Info window gives Kind as “Application (Intel)” and, below it, a warning icon and two sentences: “Intel-based apps requiring Rosetta will not open in macOS 28, the next major release. Check with the developer for an Apple silicon version.” A “Learn more…” link follows them. Two Universal apps show “Application (Universal),” no warning, and an “Open using Rosetta” checkbox, unchecked on both. An app built only for Apple silicon shows “Application (Apple silicon)” with neither. In the six windows I read, then, the treatment in Apple’s note is a warning icon and text on apps with no arm64 slice, and the checkbox the support article describes is still present for Universal apps on 27.0.³⁸ Of the 116 apps in my Applications folder whose main executable I could read, 21 have no arm64 slice.

The Settings list is not on General’s top level. Apple’s note says “Settings > General now lists Intel-based apps that will be incompatible with macOS 28.0.”⁸ On this Mac the General pane has fourteen rows, read by their accessibility identifiers, and none of them is an entry for Intel apps. I did not open the sub-panes behind those rows, where the list may sit, so this is a search of one screen that came up empty, not evidence that the list is missing.

What I could not run

When I wrote this on September 16 I had no Mac on macOS 27, so every 27 behavior in the original post was Apple’s statement. The five the post leans on hardest are: that pinned “Open using Rosetta” apps launch natively after the upgrade; that Rosetta is absent after upgrading a Mac that had it; that Get Info shows a treatment on apps that will not run on 28; that Settings > General lists them; that a bare component package runs its scripts under arm64 on 27. The installer experiment above establishes what packages declare on 26.6.2, not how 27 treats them.

October 1 and 2: the same Mac has run macOS 27.0 since September 23, and the updates above take up three of those five claims. The missing Rosetta shows in the install history. The Get Info treatment is there. The Settings list is not among General’s fourteen rows; the sub-panes behind them are not read yet. The other two are not run: the pinned-app behavior needs an app pinned to Rosetta before the upgrade, and the component-package check needs a test package installed. Each gets a dated section here if I run it, the same way the ld64 post gained its GA sections.

What I would do this week

1. Expand every package you ship and every package your build machines install, and grep the distribution for hostArchitectures; treat a missing file or a missing attribute as “arm64 on 27” and read the pre- and post-install scripts with that in mind.⁴⁵
2. If any CI or provisioning step runs an Intel binary, install Rosetta explicitly in the setup script rather than relying on it surviving the upgrade; Apple says it does not.⁴¹⁰
3. List Intel plug-ins the way Apple does, by folder: ~/Library/Audio/Plug-Ins/*, ~/Library/Printers/, ~/Library/ColorPickers/, and wherever your Quick Look and Spotlight extensions live, which Apple names by category rather than by path. Settings may not list them, and macOS 28 will not load them.⁴
4. If you install a launch agent by copying a plist, test it once on a 27 machine with the quarantine attribute still set; Apple files its note on that case under Resolved Issues, and it reads both ways.⁹
5. If you run device management, test your MDM, enrollment, and update servers against the TLS 1.2 and ATS cipher requirements now; Apple says its operating systems “might refuse connections” to non-compliant servers, the same page’s entry for version 27 or later reads “Non-compliant connections are blocked and the log messages appear as errors instead of warnings,” and SCEP and content caching are the only exemptions it lists.⁹¹¹
6. If you worked around the stat() collision on a beta, remove the workaround and rebuild; Apple lists it as fixed at GA.⁹
7. Added October 1: run pkgutil --check-signature on every package you ship. If the authority’s entry reads Expires: 2027-02-01 22:12:15 +0000, re-sign the package before February 1, 2027; the Developer ID post has the order.¹⁵¹⁶

FAQ

When did macOS 27 come out?

Monday, September 14, 2026, as build 26A428, on the same day as iOS 27.0 (24A437) and Xcode 27 (27A266a). Apple’s releases feed listed all of them under that date when I fetched it on September 16.¹

Which Macs can run macOS 27 Golden Gate?

Any Mac with Apple silicon. Apple’s compatibility page lists 35 model entries from the M1 MacBook Air, MacBook Pro, and Mac mini of 2020 through the M5 and M6 machines, plus the MacBook Neo (13-inch, A18 Pro). No Intel Mac is on the list.²

Does Rosetta still work on macOS 27?

Yes. Apple’s support article says Rosetta “is available for any Mac with Apple silicon using macOS 27 or earlier,” and the enterprise notes call it “a general-purpose compatibility tool through macOS 27.” Apple says the upgrade does not restore it, so a Mac that had it may need to install it again.³⁴¹⁰

Will Rosetta work on macOS 28?

Only for games. “Starting with macOS 28, the next major macOS release, Rosetta functionality will be available only for certain older, unmaintained games that rely on Intel-based frameworks,” and the release notes say “All Intel-based software will no longer be compatible with macOS 28.0, excluding legacy games.”³⁴

Which installer packages does the arm64 default affect?

Packages whose distribution file has no hostArchitectures attribute, and bare component packages, which have no distribution file at all. A product archive generated by productbuild on macOS 26.6.2 declares hostArchitectures="x86_64,arm64" and falls outside Apple’s sentence. Check with pkgutil --expand and a grep of the Distribution file.⁴⁵⁶

Do I need to re-sign my installer packages before February 2027?

If they were signed with a Developer ID Installer certificate from the original authority, yes. Apple’s October 1 notice says “.pkg files signed with an affected certificate will no longer install” starting February 1, 2027, while notarized apps signed with a secure timestamp keep working. pkgutil --check-signature on the package shows which authority it chains to: the original one expires on 2027-02-01. The Developer ID post has the full check.¹⁵¹⁶

What does Get Info show for an Intel app on macOS 27?

On macOS 27.0 (26A428), Finder’s Get Info window for each of the three Intel-only apps I checked shows Kind “Application (Intel)” with a warning: “Intel-based apps requiring Rosetta will not open in macOS 28, the next major release. Check with the developer for an Apple silicon version.” The two Universal apps I checked showed no warning and kept the “Open using Rosetta” checkbox, unchecked.¹⁹

Do I need to reinstall Rosetta after upgrading?

Apple says that if the Mac had Rosetta before the upgrade, macOS 27 does not bring it back on its own. Per Apple’s install instructions, opening any Intel app brings the prompt back, or you can install it from Terminal with softwareupdate --install-rosetta, the command Apple’s support article gives.³⁴

Sources