Understanding Mac App Store App Restrictions

[For my first take on the Mac App Store, check out my previous article.]

Apps you install from the Mac App Store (MAS) are different from other applications on your drive. Even if an MAS app is an apparent duplicate of a program you previously downloaded from the Web or installed from a disc, the apps are not exactly the same.

As such, the Mac App Store app can recognize if an app was acquired from the Store. The Store app will offer to update MAS-acquired apps but not the same app acquired outside of the Store.

Mac OS X can similarly tell if an app came from the Store or not. For example, using the Finder, you can copy a non-App Store app from one drive to another and it will work the same in both locations. Not so with Mac App Store apps.

How exactly are MAS apps different from other apps? How do the App Store and Mac OS X treat the distinctions? What Mac OS X software handles recognizing these differences? Perhaps most importantly, if you have a choice between an MAS and non-MAS version of the same app, which should you prefer? Read on…

Non-MAS vs. MAS versions of apps: What’s the difference?

To find the answer here, you need to peer inside an MAS app. To do so, access the Contextual Menu for an MAS app and select Show Package Contents. Next, open the Contents folder. In the list that appears, you’ll see a folder named _MASReceipt. This is the key difference between MAS apps and non-MAS apps. Every MAS app should have this folder. Non-MAS apps will not.

MAS Receipt

Inside the _MASReceipt folder is a file named receipt. Also referred to as a certificate file, this is the essential item for implementing copy-protection. When you launch an MAS app, the app checks the receipt to see if your computer has been authorized to run it. If not, the app will not run. Non-MAS apps do not have this receipt checking.

According to Apple’s Developer documentation, there are five checks that an app can perform. The first check is to simply look for the receipt. The last is to compute the “hash of your computer’s GUID. If the result does not match the hash in the receipt, verification fails.” In other words, the receipt file is modified when you first install the app from the MAS; this is what allows the app to validate and run on your computer.

A developer has the option to decide the extent of receipt checking for an app. The gamut runs from essentially no checking (eliminating any copy-protection) to checking multiple times while the app is running. As a result, exactly how an app responds to copy-protection challenges will vary depending upon how the developer decided to handle receipt checking. Further, if a developer fails to implement receipt checking properly, users may be able to “pirate” a purchased app (as has been covered in this TUAW article).

In case you’re wondering: No, deleting the _MASReceipt folder from the app will not remove its copy-protection. Instead, the app will refuse to launch anymore.

Techie note: When you install any software on your Mac, a receipt is often placed in the /var/db/receipts directory. This has nothing to do with MAS receipts.

Receipt-checking: non-MAS vs. MAS versions of apps

Assuming you have a choice, there are reasons to prefer the non-MAS version of an app as compared to its MAS twin. The main one is that you can freely copy non-MAS apps to any other computer with no restrictions — especially so for freeware. For the most part, they will immediately and successfully launch, just as they do on the originating computer.

With MAS apps, you will likely run into various copy-protection problems — even with freeware. Most notably, after copying an MAS app to a different computer via the Finder, it likely won’t launch. It will typically either trigger a message asking for your Apple ID/password or simply refuse to launch with no alert given.

Sign in

That said, there are reasons why you may yet prefer the MAS app. The App Store app keeps track of all your purchases, alerts you to updates and lets you reinstall purchased apps for free. Further, unlike software that requires a registration code, you can install MAS apps on any other machine that uses your Apple ID, without having to remember and enter a different code for each such app.

Mac OS X requirement: non-MAS vs. MAS versions of apps

The App Store app and its associated software are installed as part of Mac OS X 10.6.6. The App Store only runs in Mac OS X 10.6.6 or later. Similarly, apps installed via the App Store app won’t run on Macs running an earlier version of Mac OS X. If you copy an MAS app from a Mac running 10.6.6 to an Mac running an earlier version of OS X, you will receive this message when you try to open the app.

10.6.6 requirement

This becomes another reason to prefer non-MAS versions of apps (assuming they are available). For Macs not yet running Mac OS X 10.6.6 (which only runs on Intel Macs), the non-MAS version of an app is the required choice.

Re-purchasing: non-MAS vs. MAS versions of apps

You purchased an app prior to the MAS Store’s arrival. There is a functionally identical version of the app available for purchase in the App Store. Should you switch to the MAS version?

No. Not unless you consider the advantages of the Mac App Store to be worth paying for the same app twice. As of now, the App Store offers no free upgrading from a non-MAS version of an app to an MAS version.

Apple tacitly agrees with my recommendation. If you already have a non-MAS version of an app installed on your drive, the App Store will list that app as “Installed.” There will be no option to purchase it. This is a protection against duplicate payment for the same app. If you truly want to switch to the MAS version, you have to first remove the non-MAS version (all copies of it!) from your drive. The App Store will then allow you to purchase the app. This was how things worked for me with Apple’s iPhoto.

Unfortunately, the App Store may not always recognize software you have already installed. This was the case for me with Apple’s iWork software (as I covered in my Bugs & Fixes article). This could lead to you (mistakenly?) repurchasing software already on your drive.

[A sidenote: After purchasing the MAS version of iPhoto on my Mac Pro, I shifted to my MacBook Air (which had the non-MAS version of iPhoto already installed). The App Store on the Air did not offer to install the MAS version over the non-MAS version, despite the fact that I had purchased the MAS version. Neither for free nor for purchase. To permit a free install, I would again need to delete the non-MAS version.]

At some point, you may be “forced” to purchase software from the App Store that you already own outside of the Store. This could happen if a developer decides to offer his software exclusively in the App Store. When the next update is released, the only way to obtain the update will be via the App Store. Of course, even without the MAS, a developer could charge for an upgrade.

For now, some developers are sitting on the fence. For example, the developer of Find Any File will continue to offer a free non-MAS version of the app. However, the non-free MAS version is (not surprisingly) what he prefers you choose. Going forward, I expect that he will eventually stop updating the non-MAS version.

Techie note: How does the App Store know what apps are already installed on your drive? By checking for “bundle IDs,” as described more in this Macworld article.

Speaking of updates, be aware that installing a new version of an app via the App Store replaces the existing version. If, for whatever reason, you want to save the older version, you’ll need to make a copy of the app first (and ideally compress it).

AMS Update

Receipt-checking and multiple Apple accounts

As already stated, if you use the Finder to copy an MAS app to another computer, you will likely get a request to enter your Apple ID and password when you launch the app. Without entering the ID and password, the app will not run.

True, if you want the app to run on this second Mac, you could enter the ID as requested. This works fine if the second Mac is one you own and uses the same Apple ID. In this case, you could alternatively avoid the Finder copying altogether and install the app directly from the App Store interface.

But what if the second Mac belongs to another user with their own Apple ID?

For a free app, the solution is simple: Forget the Finder copy and install the app from the App Store using the other user’s Apple ID.

For a purchased app, things get more complicated. You can install the app on the other computer using your Apple ID. Assuming you don’t want the other person to know your password, you’ll have to do this yourself. At this point, the app will run successfully. However, it will only show up in the App Store’s Purchases and Updates lists when signed into your account. This means the app cannot be updated (or reinstalled for free) unless the App Store is signed in to your account.

To be clear, your copied app will continue to run on the second computer regardless of which account is active in the App Store — or even if you are not signed into any account. You only need to enter your ID to install it from the App Store or the first time you attempt to launch the app. The app will even run when logged into another OS X user account on your Mac. It’s just that you can only track the app in the App Store when signed in to the Apple account that purchased it.

To avoid this tracking hassle, each computer owner must purchase their own copy of the app (which, in most cases, is ethically what you should probably do anyway). However, if you already have a copy of the app installed under one Apple ID, you will not be able to purchase it under another ID — because it will be listed as already Installed. To circumvent this, as already noted, you will need to delete the installed copy.

A perhaps more common predicament is this: Suppose you and your spouse share the same Mac, but have different Apple IDs. If you each install MAS software using your own IDs, there will never be one account in the App Store that tracks all of your installed software. To avoid this, I recommend using only one Apple ID for all MAS purchases on a given Mac — unless you prefer to have separate tracking and payments for each user.

[Update: January 14, 2011: The App Store provides more help here that I realized at first. The App Store lists all updates to all MAS apps on your drive. It doesn’t matter which account is currently signed in, or even if you are not signed in at all. You’ll need to sign in to the purchasing account to actually install the update. But at least you needn’t sign in just to check if any updates are available.]

The Apple ID Sign In message: A deeper look

When launching an as yet unverified MAS app, the Sign In message appears in the App Store window — if the App Store is open at the time. Otherwise, the message appears as a standalone window.

This led me to wonder: Where is the origin of this message? The App Store app? Nope. Each individual MAS app? Nope. It turns out the message comes from a new CommerceKit private framework, installed as part of Mac OS X 10.6.6 and located in /System/Library/PrivateFrameworks/. Within the Resources folder of this framework is an app called StoreHelper. By monitoring Activity Monitor, I determined that this app (together with a related StoreAgent Unix executable file) launches when the Apple ID Sign In message pops up. The actual text of the message (titled RenewReceipt) comes from the Localizable.strings file in the Resources/English.lprog folder of the CommerceKit framework.

Bottom line

Despite the attractiveness of the Mac App Store, there are some good reasons to consider staying with non-MAS versions of apps. With an understanding of the points covered here, you should be better prepared to make an informed decision.