How to start with signing audio plugins?

Audio Plugins
85

Thanks to the generous, kind, patient help to learn how to perform the plugin signing and notarization I have received from the members of this forum, I have now succeeded, and I think I have the method/process rather clear. I couldn’t have done it without your guidance. This goes also for help in this thread:
https://forum.juce.com/t/terminal-cant-find-notarytool/65339/14

I want to pay it forward to others who are as new to this as I am, so I have written down what I learned from the help I have received in these two threads. Hopefully it will help someone else! :slight_smile:

Signing and Notarizing Plugins in Terminal

Steps:

  1. Get an App Specific Password for each new individual plugin:

https://account.apple.com - sign in with two step verification. Choose a name for the specific password.

  1. Force sign the plugin using developer ID, file location, time stamp.

  2. ZIP the plugin.

  3. Notarize the ZIP file.

  4. Delete the ZIP file.

  5. Staple the plugin file.

The plugin is ready for distribution.

________________________________________________________________________

NOTES:

Moving to a new computer may cause problems with the notarization process.

  1. Remember to add your user account to the new installation of Xcode.

  2. Make sure to move your Developer ID Certificate AND its “Key” file to the new computer.

  3. The new computer may be set to use curly quotes which will screw up the process. Go to System Settings/Keyboard/Input Sources/ Edit and disable all automatic text editing by the computer. If necessary copy straight quotation marks from a source you are confident contains straight quotes.

  4. If your plugin has a space in the name - in the code, add a backslash “\” in front of the space. Or put the complete file location within straight quotation marks.

  5. Newer Xcode versions will automatically sign the plugin with an “adhoc” signature. To remove this and replace with your own signage use the “xcrun codesign --force --verbose” to force removal of the adhoc signage. If you don’t, you will get the message that the plugin is already signed, and notarization will fail.

  6. Make sure to ZIP the plugin file as the last step before notarizing, and always delete the ZIP after notarization. This will prevent that you try to notarize a file that isn’t ready for the process.

  7. When your submission has been accepted processing will start and soon deliver the final status from the process. If the status is “accepted”, your plugin has been properly signed and notarized.

  8. Delete the ZIP file to avoid future confusion.

————————————————————————————————————————

SIGNING the BINARY (plugin)

xcrun codesign --force --verbose -s "Developer ID Application: Your Name (ABCDE12345)" "/Users/“Your Name without quotation marks”/Library/Audio/Plug-Ins/VST3/Plugin Name.vst3" --timestamp

You must put in your computer password twice for processing to go through.

——————————————————————————————————————

NOTARIZING the ZIP file:

xcrun notarytool submit --apple-id "name@domain" --password "abcd-efgh-ijkl-mnop" --team-id "ABCDE12345" --wait /Users/“Your Name without the quotation marks”/Library/Audio/Plug-Ins/VST3/Plugin\ Name.vst3.zip

Backslash is added in front of space in Plugin Name.

—————————————————————————————————

STAPLE the .VST3 FILE:

xcrun stapler staple "/Users/“Your Name without the quotation marks”/Library/Audio/Plug-Ins/VST3/Plugin Name.vst3"

No backslash is here necessary before space in Plugin Name because the whole file location is surrounded by quotation marks.

——————————————————————————————————————

GETTING the Notarization Log

Use Submission ID string, App Specific Password, and your Team ID

xcrun notarytool log “the plugin’s submission ID minus the quotation marks” --apple-id "name@domain with quotation marks" --password "abcd-efgh-ijkl-mnop" --team-id "ABCDE12345" developer_log.json

—————————————————————————————————————

CHECK if Your Plugin has an adhoc signature instead of your signature

codesign -dv --verbose=4 /Users/"name@domain with quotation marks"/Library/Audio/Plug-Ins/VST3/Plugin\ Name.vst3

Backslash is added in front of space in Plugin Name.

—————————————————————————————————————

VERIFYING signage

codesign -vvv --deep --strict "/Users/“Your Name without the quotation marks”/Library/Audio/Plug-Ins/VST3/Plugin Name.vst3"