How to start with signing audio plugins?

Audio Plugins
83

I have:

  1. Created a new JUCE project (by saving the original project with a different name. The bundle identifier is different.
  2. Changed the plugin code.
  3. Added “Plugin is a synth” check box.
  4. Added Plugin VST3 category “Instrument” check box.
  5. I build the plugin in Xcode.
  6. Created an “App Specific Password”

Still I can’t sign the plugin, because I get the message that it is already signed. So I try to notarize it. The file is accepted. After processing I receive “status: invalid”.

So I download and check the log which says: “The binary is not signed with a valid Developer ID certificate.” and “The signature does not include a secure timestamp.”.

So I verify the binary through the recommended: “codesign -vvv --deep --strict /path/to/binary/or/bundle”
and received: “satisfies its Designated Requirement”.

According to Google AI: “Yes, when a binary “satisfies its Designated Requirement” (DR) on a macOS system, it essentially means the binary is considered signed and verified as authentic”.

But when I try to notarize I still get “status: invalid”, and when I download the log it still says: “The binary is not signed with a valid Developer ID certificate.” and “The signature does not include a secure timestamp.”

I am running round in circles. The binary is verified as signed - still the notarization process says it is not???

I am starting to suspect that these problems have something to do with my duplicating the JUCE project and giving it a new name, and new settings did not prevent built binary from being seen by codesign as the same plugin as the original. That may explain why I get the comment that the new version is already signed.

84

The Bundle ID has to be unique to your project/plugin, and your organization. e.g. “com.myamzingplugincompany.plugins.stereocombobulator”

The Plugin Manufacturer Code has to be unique to you, e.g. “MAPC”

Prior to packaging, sign your bundle with your “Developer ID Application” signing identity - the one you use to develop with, e.g. “Developer ID Application: My Amazing Plugin Company (ABCDEFGH01)”

codesign --force --keychain $SIGNING_KEYCHAIN -s "$DEV_SIGNING_IDENTITY" ${BUILD_DIR}/${PKG_PROJECT_NAME}_artefacts/${BUILD_TYPE}/AU/${PKG_PRODUCT_NAME}.component

(I use a temporary keychain for my codesign’ing, since this is all done in a VM and not on a developers’ macbook … so you may ignore the --keychain option if you find it unnecessary.)

If you’re doing packaging (and you should), then … after packaging (i.e. putting things in a .pkg), sign the .pkg with your “Developer ID Installer” signing identity.

Both of the Developer ID Application and Developer ID Installer identities are unique and are obtained through Apples’ developer portal.

When you get to notarization, be sure you’re using your Apple ID and App-specific password:


xcrun notarytool submit "$SIGNED_PKG" \
    --apple-id "$APPLE_ID" \
    --password "$NOTARIZATION_PASSWORD" \
    --team-id "ABCDEFGH01" \
    --wait --verbose \
    2>&1 | tee "$NOTARIZATION_LOG"

Remember: you are codesigning your local bundle, and then with notarization, sending that bundle to Apple for certification. If you rebuild your bundle, you need to re-sign it. If you get a successful notification from Apple about notarization (–wait command helps with this) … you use the results to ‘staple’ the notarization to your bundle, and then you’re done.

But if you do another build, you need to do all of this again.

1 Like
85

Thanks to the generous, kind, patient help to learn how to perform the plugin signing and notarization I have received from the members of this forum, I have now succeeded, and I think I have the method/process rather clear. I couldn’t have done it without your guidance. This goes also for help in this thread:
https://forum.juce.com/t/terminal-cant-find-notarytool/65339/14

I want to pay it forward to others who are as new to this as I am, so I have written down what I learned from the help I have received in these two threads. Hopefully it will help someone else! :slight_smile:

Signing and Notarizing Plugins in Terminal

Steps:

  1. Get an App Specific Password for each new individual plugin:

https://account.apple.com - sign in with two step verification. Choose a name for the specific password.

  1. Force sign the plugin using developer ID, file location, time stamp.

  2. ZIP the plugin.

  3. Notarize the ZIP file.

  4. Delete the ZIP file.

  5. Staple the plugin file.

The plugin is ready for distribution.

________________________________________________________________________

NOTES:

Moving to a new computer may cause problems with the notarization process.

  1. Remember to add your user account to the new installation of Xcode.

  2. Make sure to move your Developer ID Certificate AND its “Key” file to the new computer.

  3. The new computer may be set to use curly quotes which will screw up the process. Go to System Settings/Keyboard/Input Sources/ Edit and disable all automatic text editing by the computer. If necessary copy straight quotation marks from a source you are confident contains straight quotes.

  4. If your plugin has a space in the name - in the code, add a backslash “\” in front of the space. Or put the complete file location within straight quotation marks.

  5. Newer Xcode versions will automatically sign the plugin with an “adhoc” signature. To remove this and replace with your own signage use the “xcrun codesign --force --verbose” to force removal of the adhoc signage. If you don’t, you will get the message that the plugin is already signed, and notarization will fail.

  6. Make sure to ZIP the plugin file as the last step before notarizing, and always delete the ZIP after notarization. This will prevent that you try to notarize a file that isn’t ready for the process.

  7. When your submission has been accepted processing will start and soon deliver the final status from the process. If the status is “accepted”, your plugin has been properly signed and notarized.

  8. Delete the ZIP file to avoid future confusion.

————————————————————————————————————————

SIGNING the BINARY (plugin)

xcrun codesign --force --verbose -s "Developer ID Application: Your Name (ABCDE12345)" "/Users/“Your Name without quotation marks”/Library/Audio/Plug-Ins/VST3/Plugin Name.vst3" --timestamp

You must put in your computer password twice for processing to go through.

——————————————————————————————————————

NOTARIZING the ZIP file:

xcrun notarytool submit --apple-id "name@domain" --password "abcd-efgh-ijkl-mnop" --team-id "ABCDE12345" --wait /Users/“Your Name without the quotation marks”/Library/Audio/Plug-Ins/VST3/Plugin\ Name.vst3.zip

Backslash is added in front of space in Plugin Name.

—————————————————————————————————

STAPLE the .VST3 FILE:

xcrun stapler staple "/Users/“Your Name without the quotation marks”/Library/Audio/Plug-Ins/VST3/Plugin Name.vst3"

No backslash is here necessary before space in Plugin Name because the whole file location is surrounded by quotation marks.

——————————————————————————————————————

GETTING the Notarization Log

Use Submission ID string, App Specific Password, and your Team ID

xcrun notarytool log “the plugin’s submission ID minus the quotation marks” --apple-id "name@domain with quotation marks" --password "abcd-efgh-ijkl-mnop" --team-id "ABCDE12345" developer_log.json

—————————————————————————————————————

CHECK if Your Plugin has an adhoc signature instead of your signature

codesign -dv --verbose=4 /Users/"name@domain with quotation marks"/Library/Audio/Plug-Ins/VST3/Plugin\ Name.vst3

Backslash is added in front of space in Plugin Name.

—————————————————————————————————————

VERIFYING signage

codesign -vvv --deep --strict "/Users/“Your Name without the quotation marks”/Library/Audio/Plug-Ins/VST3/Plugin Name.vst3"