I have developed a qt mac app (not using xcode, soi do not have any xcode project) that will be distributed outside the app store.
I have successfully signed it with my developer ID certificate and if i use the following commands:
spctl --assess MyAppBundle.app
and
codesign -d -vvvvvv MyAppBundle.app
I get fine results.
The problem is that if i download it from internet (e.g. DropBox) i get the warning "the file was downloaded from internet are you sure you want to open it"
Is there a way to avoid this warning? from what i gathered from the forum it should be possible.
Btw please note that the application passes the GateKeeper on the target computer so the actual signing seems to be working and being accepted (Gatekeeper is on default configuration: mac store and identified developers)
Related
Is it necessary to notarize app before uploading to Apple App Store? I come across some article says that notarization is needed for non-app store distribution, while apple will run notarization before approving an app store version.
Anyone can confirm?
The reason I ask this question is because I notarized the app for outside Mac App Store distribution and it works fine. For the Mac app store build, I can upload and distribute it and it works fine on Mac, only have issue on Catalina(beta) when user try to open, see attached pic. Wonder if it's related to notarization.
Update: the issue was not due to notarization, but due to code signing. One of the node binary is not signed before uploading to MAS, maybe Catalina has a more strict rule checking it.
No, it's not required. Apps downloaded from the app store are not notarized. You can verify it using spctl command.
spctl -a -v /Applications/Pages.app
/Applications/Pages.app: accepted
source=Mac App Store
Gatekeeper will check notarization only if the app is downloaded from outside the App Store.
From Safely open apps on your Mac
When you install Mac apps, plug-ins, and installer packages from
outside the App Store, macOS checks the Developer ID signature and
notarization status to verify that the software is from an identified
developer and that it has not been altered.
Notarization is only required for distribution outside the Mac App Store. See Distribute outside the Mac App Store (macOS), which says:
In some cases, you may want to distribute an app outside of the Mac App Store [...] Users gain additional assurance if your Developer ID-signed app is also notarized by Apple.
The macOS User Guide has this to say:
App Store: [...] All the developers of apps in the Mac App Store are identified by Apple, and each app is reviewed before it’s accepted
App Store and identified developers: [...] Identified developers are registered with Apple and can optionally upload their apps to Apple for a security check. If problems occur with an app, Apple can revoke its authorization.
I'm a newbie in OSX Development. I built an application in which will be distributed outside the Mac App Store. I have all the other certificates and keys working except for the Developer ID (App and Installer) for production.
I know that this may sound stupid, but for what it's worth, I just wanna make sure.
Will my app still be considered Developer ID - signed if I exported it as a Mac Installer Package instead of selecting Export Developer ID-signed Application, when I install it to its destination devices? Will it be successfully installed or be rejected with GateKeeper-enabled devices?
I have been scratching my head for this since for some weird reason, I cannot add a new Distribution Developer-ID from the Dev Center. I was able to add a Developer ID earlier this week however, I ran into some issues with my private keys. As per suggested by Apple and many other developers, I revoked all the Developer IDs and private keys to start fresh. The problem now is that I can't add any new Developer ID (Distribution). I cannot add in both Dev Center and by requesting through Xcode 5.0.1. I'm stuck.
I have submitted a Bug Report to Apple, but who knows when they'll be able to resolve it.
So now, temporarily, since I don't have any choice (I guess), I'll use the Mac Installer Package, but the question is, will it work?
Any help would be very, very much appreciated.
I've done this recently and have created a third Xcode project configuration to Debug and Release called Archive, which is a copy of Release except the app is signed using the Mac App Distribution / Third Party Mac App Developer and, confusingly there is a third name used for this same certificate.
I then changed the Archive scheme to use the Archive configuration to build.
Before doing this I had errors on some Macs when signing with my Developer ID, in some cases they claimed the app was corrupted, and in other cases I got gatekeeper blocking the app, forcing me to override it in System Preferences > Security & Privacy.
I personally use xcodebuild (from Jenkins) to build the app for distribution to testers, which I package in a .dmg so they only need to drag it to /Applications or ~/Applications and I do all that using a script within the Jenkins configuration. Your experience may differ to mine if you are using the Xcode app instead.
How to share mac desktop application on mountain lion to limited user without using Mac App store?
Can anyone tell me the procedure?
Thanks in advance.!
Compress your application in finder.
Upload to cloud(Dropbox, Sugarsync,IDrive,crashPlane) and share.
The correct way to do this is:
1) In the Apple Developer Portal, under "Certificates and Identifiers" ensure that your developers (and their Mac UUID's are all added to the portal
2) Download their corresponding profiles and make sure that they're installed on their development mac's (the ones which you registered under devices)
3) In Xcode, when you build an app for development testing, make sure that you're code-signing as "Mac Developer"
Once this is done, check that it's code-signed properly by dropping to terminal and testing it (this example I'll check the Apple Mail app):
04:31 $ spctl -vvvv -a /Applications/Mail.app
/Applications/Mail.app: accepted
source=Apple System
origin=Software Signing
If that passed, then it's free to distribute to your development team. In this case, it's not a developer app, but in the case of a developer app it'll appear as:
04:34 $ spctl -vvvv -a ./SomeApp.app
./SomeApp.app: accepted
source=Mac Developer
origin=Mac Developer: Your Details (TEAMID12345)
From here you can zip it up and email it to your development team to run on their machines.
I have a Cocoa Mac App that I don't know if it will on the Mac AppStore.
The application is still in development, and I want few persons to be able to launch it on their devices while the app gets new features.
The situation is the following :
I have a Mac Developer Certificate
Devices are registered in the Mac Member Center.
Every time they launch the app, GateKeeper complain the app doesn't come from the Mac AppStore, nor is provided by a identified developer, no matter if I sign the app or not.
So I tried to sign it and a provisioning profile is embedded into the app. If I don't sign it nothing embedded.
I should mention that the app has a Spotlight importer and QuickLook generator bundled into it.
I didn't find any clear explanation on how to resolve this issue in the Apple documentation, and most (if not all) blog posts, or articles on the Internet are about iPhone apps, not Mac ones (the process/requirements seems to be different on the two platforms).
The documentation is unclear on if all testers should be team members (which seems crazy because some of them aren't developers and don't have Xcode installed).
Can someone provide a clear step-by-step explanation on how to do that ?
Or maybe a article/blog post link or tips ?
Edit :
Here are screenshots of the app bundle structure and plug-in structure :
Everything seems to be right.
The way I obtained that is : I didn't set "Code Signing Identity" build setting, but rather archived the app, and exported it specifying code signing identity at that time.
Edit :
More and more curious, when I run codesign command in the terminal, codesign -vvv MyApp.app, the output tends to suggests that all is rightly done :
MyApp.app: valid on disk
MyApp.app: satisfies its Designated Requirement
Interpreting this question as essentially:
"how do I beta test Mac App Store apps" ?
Apple hasn't yet published an official workflow in the App Distribution Guide, but the following process works:
Tester sends "System Information utility > Hardware tab > Hardware UUID" to developer
Developer updates dev provisioning profile to include the hardware UUID
Developer uses Xcode Organizer Archives tab, Distribute > "Save as Mac Application", then select the updated development signing identity.
Developer sends newly built app to the tester
Note: The development identities have yellow caution ! icons during the re-signing process but they can still be used.
Not only does this avoid the GateKeeper prompt, but the development provisioning profile is also needed for any store technologies you might be using to work during testing, e.g. iCloud, GameCenter, etc.
I have an application (installer, actually) that was built outside of Xcode which I have codesigned using the codesign utility, but when I try to install it after downloading the signed app, Gatekeeper complains that it comes from an unidentified developer. I have tried using the "3rd Party Mac Developer:..." identity, as well as my own "Mac Developer:..." identity; same result in either case. codesign (as far as I can tell) says all is well, so I'm thinking I'm either using the wrong identity (in which case my question is what I should use/make-to-use instead) or the signature is fine, but there is something that needs to be done w/ my developer account (in which case my question is what might that be).
According to Apple, and verified by me :), there is another set of identities specifically for signing apps to satisfy the intermediate security setting in Gatekeeper, but only a Team's Agent can get, which is why I wasn't getting them. My agent got them, I used them, and Gatekeeper is happy.