Notarizing after Code-Signing?

Audio Plugins
43

I guess it will cost a lot and not everyone can afford it so…

44

If you notarize the pkg installer it will notarize all the components contained within it. So they do have to be notasrized it’s just that it’s reduced to a single step.

I don’t think that’s true any more.
This is from the apple dev documentation

If you distribute your software via a custom third-party installer, you need two rounds of notarization. First you notarize the installer’s payload (everything the installer will install). You then package the notarized (and stapled, as described in Staple the ticket to your distribution) items into the installer and notarize it as you would any other executable. If you use a network installer, separately notarize both the installer and the items it downloads.

45

I think this might be pertinent. .pkg created using the system tools (and by extension Packages, since it’s more or less a glorified wizard for the system tools) doesn’t count as “custom third-party installer” imo. My understanding of that part is that it’s literally some kind of custom installation .app. Who knows though, Apple documentation I find quite opaque.

1 Like
46

I’m a bit puzzled here, as in my case the notarisation service is complaining about the

  1. pkg not being signed
  2. the VST3 bundle not being signed
    But does not complain about the AU not being signed ( I haven’t treated them any different, though)

I include VST3 and AU in the PKG

47

I think that note is only about third-party installers. From memory it supports dmg, pkg, and zip files. In these cases it should be able to peek inside and include the contents as part of the notarisation.

If you’re getting complaints about signing this is separate from notarisation.

1 Like
48

I was only signing the pkg and with the wrong process. I was using codesign to sign the pkg instead of productsign and I was under the impression that the binaries were already signed but the signature was the ad-hoc one that the build step provides, instead of the one using the apple developer identity and a timestamp. So it was complaining about both

One needs to make sure everything is signed before creating a bundle for notarisation
check the binares with

#signing
codesign --timestamp --force -s "$CERTIFICATE_NAME" --options runtime ${{working_dir }}/Components/my-plugin.component -v
codesign --timestamp --force -s "$CERTIFICATE_NAME" --options runtime ${{working_dir }}/VST3/my-plugin.vst3 -v

# Checking signatures
codesign -vvv --deep --strict ${{ working_dir }}/Components/my-plugin.component -v
codesign -vvv --deep --strict ${{ working_dir }}/VST3/my-plugin.vst3 -v

#pkg signing
productsign --timestamp --keychain "$KEYCHAIN_NAME" --sign "$CERTIFICATE_INSTALLER_NAME" ${target_file} ${target_file_signed}
#checking signature
pkgutil --check-signature ${target_file_signed}

NOTE it’s important to sign the binaries with the Apple developer Application identity and the package with Apple developer Installer identity

4 Likes