Mac App Store or Direct Download: What the Choice Decides
Sandboxing, updates and notarisation — and why one of these two utilities could not ship through the store.
There are two normal ways to ship a macOS application: through the Mac App Store, or as a signed disk image people download from a website. The decision is usually presented as a business one — commission, discovery, review delays — but the part that settles it first is technical, and it is the sandbox.
The sandbox decides most of it
Every App Store application runs sandboxed. It gets its own container and cannot read or write outside it except through explicitly granted entitlements or a file the user personally picked. That is a genuine security property and it is why the store can make meaningful promises about what an app can do.
It also rules out entire categories of software. Anything whose purpose is to inspect or modify the rest of the system — backup tools, disk utilities, window managers, uninstallers — needs exactly the access the sandbox exists to prevent.
The two utilities on this site land on opposite sides of that line, which makes the point concretely. KOCaffeine holds a power assertion and needs nothing else, so the sandbox costs it nothing and it ships through the store. Klaar removes files other applications left in shared Library folders, which is precisely what a sandboxed app cannot reach — so it ships as a direct download. Neither choice was about commission.
What each route actually involves
| Mac App Store | Direct download | |
|---|---|---|
| Sandbox | Required | Optional |
| Review | Human review before every release | Automated notarisation only |
| Updates | Handled by the system | Your problem to build |
| Commission | 15–30% of revenue | Payment processor fees only |
| Discovery | Store search and charts | Entirely on you |
| Trust signal | Apple's review | Developer ID signature |
Notarisation is not optional either way
A common misconception is that shipping outside the store means shipping unchecked. It does not. Since macOS 10.15, software distributed outside the store must be signed with a Developer ID certificate and notarised — uploaded to Apple, scanned automatically for malicious content, and issued a ticket that is stapled to the disk image.
Without it, Gatekeeper refuses to open the app, and the message the user sees does not suggest a workaround. So the difference is not "checked versus unchecked"; it is automated scanning versus human review, with the same signing requirement underneath.
Updates are the underrated cost
The store updates apps silently and reliably. Outside it, you build that: a version check, a download, a signature verification, and a replacement of a running application with a new copy. Frameworks exist for this, and it is still a real component with real failure modes — and the consequence of getting it wrong is users stranded on an old build.
For a free utility that is a meaningful reason to prefer the store when the sandbox allows it.
The short version
Work out whether the app can do its job inside the sandbox. If it can, the store is usually the easier path — updates and discovery come free. If it cannot, the choice has already been made for you, and the work is notarisation plus an update mechanism.