HOWTO macOS notarization (plugins, app, pkg installers)

DSP, Plugin and Host development discussion.
Post Reply New Topic
RELATED
PRODUCTS

Post

After managing to get everything sorted out regarding notarization I decided to publish a howto to make other developers life easier in order to comply with latest macOS requirements.

Requirements: Notarization is indeed needed for plugins, but if you are distributing through a PKG or DMG (which contains a PKG), you can just notarize the PKG or the DMG, and everything inside will be notarized.

If you distribute your plugins using a simple ZIP file, you still need to notarize it (you're actually notarizing the contents of the ZIP). You can't staple a ZIP file, but you can staple the contents after they have been notarized.

PLUGIN FILES

Signing via terminal is simple. Team name should be your Name and Surname followed by Team ID number like 87UBP9ZN95 using parenthesis:

Code: Select all

codesign -s "Developer ID Application: Team Name (Team ID)" "/path/plugin.component" --timestamp
codesign -s "Developer ID Application: Team Name (Team ID)" "/path/plugin.vst" --timestamp 
codesign -s "Developer ID Application: Team Name (Team ID)" "/path/plugin.vst3" --timestamp
For AAX, it's recommended to use Developer ID Application on Code Signing Entitlements and add --timestamp to Other Code Signing Flags. Source: viewtopic.php?p=7672836#p7672836

- If you are using an installer, use the method as described below.
- If you are distributing a .vst / .component without installer, notarize the plugin.

You can do this by creating a zip file containing the plugin. Then run:

Code: Select all

xcrun notarytool submit --apple-id "you apple id" --password "your notarytool password"  --team-id "your team id" --wait "plugin.zip"
After it's accepted, staple using:

Code: Select all

xcrun stapler staple "plugin.zip"
APP NOTARIZATION

The notary service generates a ticket for the top-level file that you specify, as well as each nested file. For example, if you submit a disk image that contains a signed installer package with an app bundle inside, the notarization service generates tickets for the disk image, installer package, and app bundle.
  • Your app must get code signed and get Hardened Runtime enabled, it workes for signing from command line:

    Code: Select all

    codesign --deep --force --options runtime --sign "Developer ID Application: Your Name" "Application.app"
  • ZIP and submit it for notarization (following steps NOT required if you are going to submit a PKG):

    Code: Select all

    xcrun notarytool submit --apple-id "you apple id" --password "your notarytool password"  --team-id "your team id" --wait "MyApp.app"
  • After it's accepted, it's time to staple the .app

    Code: Select all

    xcrun stapler staple "/Users/you/MyApp/MyApp.app"
    with a The staple and validate action worked! message.
  • For verification purposes you use the commnad

    Code: Select all

    spctl --assess --verbose "MyApp.app"
    with a message like

    Code: Select all

    /path/MyApp.app: accepted
    source=Notarized Developer ID
  • The app can be distributed now.

PKG INSTALLER NOTARIZATION

I use the app WhiteBox Packages to distribute the plugins and it works great. Make sure you set the Apple Developer certificate to your PKG:

Image
Image
  • Submit the signed PKG to Apple servers:

    Code: Select all

    xcrun notarytool submit --apple-id "your apple id" --password "your notarytool password"  --team-id "your team ID" --wait "Install.pkg"
    and after a few minutes you should receive a notification via terminal.
  • Staple the PKG:

    Code: Select all

    xcrun stapler staple /Users/home/Desktop/signedPKG/Install.pkg"
  • Verify everything is OK:

    Code: Select all

    spctl -a -vvv -t install "/Users/home/Desktop/Install.pkg"
    should give you a valid message

    Code: Select all

    /Users/home/Desktop/signedPKG/Install.pkg: accepted
    source=Notarized Developer ID
    origin=Developer ID Installer: Your Name (IDXXXXXX)
  • And that's all! Ready to get distributed.
2023 Nov 23 Update: Revised text, removed deprected altool, updated with new notarytool notarization service.
Last edited by discoDSP on Fri Nov 24, 2023 11:06 am, edited 23 times in total.

Post

A very big thank you for your contribution, George.

Talking just for the PLUGINS, the signing process doesn't involve Xcode, so Xcode10 is not a requirement, right?

I ask this because I'm on Xcode7 and I don't want to update / change anything (once it works... :))
bruno @ Xhun Audio || www.xhun-audio.com || Twitter || Instagram
Image

Post

You’re welcome. I think so Bruno, but for notarizing DMG/PKG/app then XCode 10 command line tools or the built in tools should be used.

By the way it’s very easy to sign plugins in XCode 10 and it has a new compilation system, so I’d recommend giving at least a try ;)

Post

My fear with Xcode10 is that WDL-OL doesn't like it...

...or maybe it should be better to wait until IPlug2 will be out (and production-ready). By the way thank you again !
bruno @ Xhun Audio || www.xhun-audio.com || Twitter || Instagram
Image

Post

discoDSP wrote: Sat Sep 14, 2019 12:26 pmI use the app Packages to distribute the plugins and it works great. However right now the digitally signed build from it are NOT compatible with Apple notarization.
What version are you using? The latest one (v1.2.6) works perfectly fine with the notarization here.
AudioThing (VST, AU, AAX, CLAP Plugins)
Instagram | Twitter | Discord Server

Post

audiothing wrote: Sat Sep 14, 2019 11:33 pmWhat version are you using? The latest one (v1.2.6) works perfectly fine with the notarization here.
Current Packages version 1.2.6 doesn't build a signed secure timestamp PKG. I was in talk with the developer these days. Version 1.2.7 of Packages which is going to be released before the end of September should be able to do so.

At least for me, checking the stapled PKG code signed with Packages 1.2.6 resulted in a rejected file. Right now the only way to add a secure timestamp is using product sign command line tool as described on the howto.

Cheers,
George.

Post

discoDSP wrote: Sun Sep 15, 2019 7:57 amCurrent Packages version 1.2.6 doesn't build a signed secure timestamp PKG. I was in talk with the developer these days. Version 1.2.7 of Packages which is going to be released before the end of September should be able to do so.

At least for me, checking the stapled PKG code signed with Packages 1.2.6 resulted in a rejected file. Right now the only way to add a secure timestamp is using product sign command line tool as described on the howto.
I've just retested and I can notarize and staple my PKGs without issues using Packages v1.2.6 in our build script using packagesbuild.
I've verified the PKG signature before submitting it for notarization with:

Code: Select all

pkgutil --check-signature installer.pkg
Status: signed by a certificate trusted by Mac OS X
   Certificate Chain:
    1. Developer ID Installer: XXXXX 
Then notarized/stapled and verified with:

Code: Select all

spctl -a -vvv -t install installer.pkg
installer.pkg: accepted
source=Notarized Developer ID
origin=Developer ID Installer: XXXXX
If the current version of Packages doesn't add the timestamp I guess it would be a huge mess :dog:
AudioThing (VST, AU, AAX, CLAP Plugins)
Instagram | Twitter | Discord Server

Post

I'm referring to Whitebox Packages and it looks like you're pointing to packagesdev/packages which BTW added timestamp embedded in the CMS signature around 1 month ago.

I contacted the WhiteBox Packages developer and he answered 1.2.6 doesn't set a secure timestamp and will be added on 1.2.7 this September. After using productsign on the PKG I was able to notarize without issues.

OP has been clarified to avoid any confusions. Thanks for the feedback!

Post

discoDSP wrote: Sun Sep 15, 2019 9:22 am I'm referring to Whitebox Packages and it looks like you're pointing to packagesdev/packages which BTW added timestamp embedded in the CMS signature around 1 month ago.
I'm really confused. According to the Whitebox Packages page, that repo is the source code of Packages. I'm just using the command line to build the PKGs, and the command is packagesbuild.

From http://s.sudre.free.fr/Software/Packages/about.html
Integrating Packages into an automated production workflow is easy with the packagesbuild command line tool. Once you have created your Packages project, the packagesbuild tool will let you build it from the Terminal, a shell script or an Xcode Run Script Build phase.
So, I've tested again, removing and adding the certificate (Project > Set certificate), building from the GUI this time (no command line, no build script, everything manually), notarized and stapled with no issues. :shrug: I hope I'm not doing anything wrong...
AudioThing (VST, AU, AAX, CLAP Plugins)
Instagram | Twitter | Discord Server

Post

It doesn't work here when building from GUI and CMS signature not supported by app is confirmed by the dev himself, so no idea what's going on :shrug: From what I understand the command line tool correctly CMS signs the PKG.

Post

Hi Thank you so much for this nice tutorial!
  • What will happen for updates? If we notarized an installer with a Bundle Identifier and a altool password; when we want to update it, do we have to upload and notarize the new version again? With the same Bundle Identifier and specific altool password?
  • Does this specific altool password has to be individual for different software installers?
  • I use Whitebox Packages 1.2.6 too. When I Staple the PKG, there is nothing happening. But when I check it, it seems to ok.
Best Regards...

Post

daniel_noiseash wrote: Thu Sep 19, 2019 1:34 pm Hi Thank you so much for this nice tutorial!
  • What will happen for updates? If we notarized an installer with a Bundle Identifier and a altool password; when we want to update it, do we have to upload and notarize the new version again? With the same Bundle Identifier and specific altool password?
I think any files should be notarized.
  • Does this specific altool password has to be individual for different software installers?
Nope.
  • I use Whitebox Packages 1.2.6 too. When I Staple the PKG, there is nothing happening. But when I check it, it seems to ok.
Yeah, it happened the same here and after deeper investigation notarization wasn't OK. What I did is detailed on the OP. 1.2.7 will add CMS timestap which is not supported right now (not the command line tool from what it was reported thought).

Post

Ok thanks! I should better wait for the 1.2.7 release.

Post

Today I rebuilt Packages installer. Signed, Notarized and retried timestamp. This time I saw successful message in Terminal after timestamp attempt (yesterday there was no message after timestamp attempt).

I think this issue can be Apple's notarization system. Yesterday it didn't but today it is ok. I am using Packages 1.2.6

Weird!

Post

So I may need to upload a multiple gigabyte big app everytime to notarize it? That's really hilarious :D

Post Reply

Return to “DSP and Plugin Development”