I have a Mac app which can't be sandboxed due to using Apple Events and therefore it can't be released through the Mac App Store.
I've made a website, added a payment gateway and everything seems to be ok but I keep getting feedback from testers who can't open the app even with the right mouse button method.
First it was the raw app from Xcode without any kind of signing, after that I tried exporting after archiving using my developer certificate, the I even notarized the app with Apple but still there are people who can't open the app (even though they was able to use it before signing).
Currently I'm using the Mac App Distribution certificate (no provisioning profile). Is this correct? Should I use "Mac Installer", "Mac developer", "Apple developer", "Apple distribution"… why is this so confusing?
You should use the Developer ID Application certificate to distribute a Mac app outside the Mac App Store that does not use an installer. Most Mac apps do not use an installer.
Apple provides a decent explanation of the different certificates when you create a new certificate from Apple's Certificates, Identifiers, and Profiles page. To keep people reading this from having to go there, I'll explain them now.
The Developer ID Installer certificate is for distributing Mac apps outside the App Store that use an installer to install the app.
The Mac Development certificate is for signing development versions of a Mac app.
The Mac App Distribution certificate is for distributing a Mac app on the App Store that does not use an installer. The Mac Installer Distribution certificate is for distributing a Mac app on the App Store that uses an installer.
In Xcode 11, Apple added the Apple Development and Apple Distribution certificates so people could sign their apps for all Apple platforms with one certificate. These certificates are for apps that will end up on the App Store.
Related
I'm distributing my macOS app outside the App Store and so far I've never code-signed it. My app targets advanced users who know how to configure macOS to allow the app to run.
With the arrival of the Apple M1 computers, however, things have changed as code-signing seems to be mandatory now for native Apple Silicon apps. That's why I'd like to ask: Is it sufficient to sign my app using a self-signed certificate when distributing it outside the App Store? Will it be possible for users who download an app that was signed using a self-signed certificate to run that app?
I'd expect that Gatekeeper will probably block such an app first because it was signed using a self-signed certificate but will users be able to override Gatekeeper's veto in the security settings (as it was previously the case with non-signed apps)?
Or do all apps built for Apple Silicon have to be signed with an official Apple certificate? I'd like to avoid that because last time I checked this was $99 per year.
You can codesign with ad-hoc feature. codesign -s - -f /path/to/filename. This doesn't need certificate.
What is the purpose of Apple Development and Apple Distribution certificates for macOS application?
It is quite new types of certificates in addition to existing iOS/Mac Development/Distribution.
According to the documentation:
Apple Development — For macOS apps, use app services during development and testing.
Apple Distribution — For macOS apps, sign an app before distributing it through the Mac App Store.
https://help.apple.com/xcode/mac/current/#/dev154b28f09?sub=dev23755c6c6
What does it mean sign an app before distributing because for distributing it through the Mac App Store I have to use Mac App Distribution (the name is 3rd Party Mac Developer Application) and Mac Installer Distribution (the name is 3rd Party Mac Developer Installer).
Awesome but a bit outdated explanation: https://stackoverflow.com/a/29040068/1785926
Is it necessary to notarize app before uploading to Apple App Store? I come across some article says that notarization is needed for non-app store distribution, while apple will run notarization before approving an app store version.
Anyone can confirm?
The reason I ask this question is because I notarized the app for outside Mac App Store distribution and it works fine. For the Mac app store build, I can upload and distribute it and it works fine on Mac, only have issue on Catalina(beta) when user try to open, see attached pic. Wonder if it's related to notarization.
Update: the issue was not due to notarization, but due to code signing. One of the node binary is not signed before uploading to MAS, maybe Catalina has a more strict rule checking it.
No, it's not required. Apps downloaded from the app store are not notarized. You can verify it using spctl command.
spctl -a -v /Applications/Pages.app
/Applications/Pages.app: accepted
source=Mac App Store
Gatekeeper will check notarization only if the app is downloaded from outside the App Store.
From Safely open apps on your Mac
When you install Mac apps, plug-ins, and installer packages from
outside the App Store, macOS checks the Developer ID signature and
notarization status to verify that the software is from an identified
developer and that it has not been altered.
Notarization is only required for distribution outside the Mac App Store. See Distribute outside the Mac App Store (macOS), which says:
In some cases, you may want to distribute an app outside of the Mac App Store [...] Users gain additional assurance if your Developer ID-signed app is also notarized by Apple.
The macOS User Guide has this to say:
App Store: [...] All the developers of apps in the Mac App Store are identified by Apple, and each app is reviewed before it’s accepted
App Store and identified developers: [...] Identified developers are registered with Apple and can optionally upload their apps to Apple for a security check. If problems occur with an app, Apple can revoke its authorization.
We currently have problems with the download versions (ZIP) of our applications under the new operating system MacOS Sierra from Apple. It is a (non-native) video tutorial app with external data and different startfiles (certificate signed) for Mac and Windows (originally created for DVDs).
Although the Mac startfile of the download version was properly signed with a valid Apple Developer ID certificate, an authorization problem now appears and the application can no longer load external data. The same application on DVD still works impeccably.
My researches have shown that under "macOS Sierra" developer ID signed apps (outside the App Store) are not allowed to use external libraries, external code or external data:
https://developer.apple.com/library/content/releasenotes/MacOSX/WhatsNewInOSX/Articles/OSXv10.html
Starting in macOS 10.12, you can not get any longer. An app distributed outside the Mac App. To provide secure execution, code your disk image is using the codesign tool, or distribute your app through the Mac App Store. For more information, see the updated revision to macOS Code Signing In Depth.
https://developer.apple.com/library/content/technotes/tn2206/_index.html
Is our described type of application no longer compatible with macOS Sierra?
Is there any solution to continue offering our applications as a download for macOS Sierra outside the App Store?
Possibly one could encapsulate here in the individual trainings over an automatism all necessary files in an app, afterwards sign and to prepare as DMG !?
Have solved the problem.
With a signed DMG everything works again as before. This is now possible under macOS Sierra (and from Mac OS X 10.11.5.)
I must sign my application with a 3rd party mac developer certificate, but I want to distribute it to my clients without going on the Mac Store. Certificates have a validity period of 1 year.
My question is: Will my application stop working when my certificate expires if I distribute it outside of the Mac Store?
Or the expiration date is only for the signing process and not for running the application?
For distributing your app outside the mac app store (From mountain lion OS) you should sign it with developer ID certificate which you can get from apple and then it will work fine.