Apple Gatekeeper notarised distributables

MacOSX and iOS
82

This is the script I’m using to notarise and staple my installer (not built with Packages, but I’ve used the same script for my day job which is using a Packages based installer)

#!/bin/bash

USERNAME="<my apple id username>"
PASSWORD="<the generated password>"

echo "Submitting to Apple..."
xcrun altool --notarize-app -f "$1" --primary-bundle-id $2 --username $USERNAME --password $PASSWORD &> notarisation.result

ASSET_UUID=`grep RequestUUID notarisation.result | cut -d" " -f 3`

echo -n "Checking result of notarisation.."

while true; do
	echo -n '.'
	if [[ `xcrun altool --notarization-info $ASSET_UUID --username $USERNAME --password $PASSWORD 2>&1  >/dev/null | grep -c "Package Approved"` == "1" ]]; then
		break
	fi
	sleep 30
done

echo
echo "Stapling package..."

xcrun stapler staple "$1"

I then call this script with 2 arguments, the first being the path to the signed .pkg, and the 2nd being com.mycompanyname.thepluginname, but that 2nd argument corresponds to nothing in any of the installers (either in the individual .pkg for each plugin target, nor in the overall installer), so I think it could even just be some nonsense like com.installer.package (although perhaps should be unique for each product).

It’s not really best practice to have the password embedded in the script, however my reasoning for not having to bother with Key Chain is that I can revoke the app specific password should I ever end up in a situation where a 3rd party manages to access my git repos.

The only things I can offer for the method you’re using at the moment are:
a) you showed -password @keychain:DAVE_H_NOTARIZATION, it should be --password, but I assume this is just a typo
b) perhaps the password should be wrapped in quotes when you do security add-generic-password -a "my Apple ID" -w "dcba-abcd-efgh-ijkl" -s "DAVE_H_NOTARIZATION"?

But honestly I’m not sure either of those are going to be much help.

Hope you get it working soon, it is quite a pain getting this right, took me almost a whole day before I finally nailed it. Feel free to use my script, it works great for me!

1 Like