Agent Wranglers

DSK-1Required

Sign and notarise every Mac build

Sign every Mac app, disk image and installer you hand out with a Developer ID certificate, the hardened runtime and a secure timestamp. Notarise it with Apple and staple the ticket before release.

By Agent Wranglers. Updated .

How to do it

Since macOS 10.15, Gatekeeper refuses to open Developer ID software built after 1 June 2019 that Apple has not notarised. An unsigned or unnotarised app then looks broken to every new user. Sign with codesign --options runtime --timestamp, and leave out the get-task-allow entitlement. Submit with notarytool, since Apple's notary service has refused uploads from altool since 1 November 2023. Staple the ticket with stapler, so Gatekeeper can check it offline. Apps sold only in the Mac App Store skip this, because App Review does the same checks. Run the job in CI as sign release builds only in CI says.

Examples

Shell example

codesign --force --options runtime --timestamp \
  --sign "Developer ID Application: Example Tools AB (TEAM123456)" "Ledgerly.app"
ditto -c -k --keepParent "Ledgerly.app" Ledgerly.zip
xcrun notarytool submit Ledgerly.zip --key "$ASC_KEY_PATH" --key-id "$ASC_KEY_ID" --issuer "$ASC_ISSUER_ID" --wait
xcrun stapler staple "Ledgerly.app"
spctl --assess --type execute -vv "Ledgerly.app"

How to check

On a clean Mac, download the release from its public address and run spctl --assess --type execute -vv on the app. It answers accepted with source=Notarized Developer ID. xcrun stapler validate passes on every disk image and installer package.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/mac-notarisation">Agent Wranglers desktop apps, extensions and CLIs playbook</a>. In code you write, add a comment next to it with the same link.