Apple notarizing for Mojave (10.14) and beyond

Just to confirm - you are NOT using the "--options runtime" option when you codesign, correct? That's what enables hardened runtime status, and as you can see from earlier in this thread, that's what has broken other people's standalones, at least with Max as it exists currently. We are not currently required to include that for notarization and stapling, as Apple has at least temporarily relaxed its standard, prior to Cortana release.

So just double-checking on that....

Hi Dan, sorry not to give you complete info, here is what I did. I also needed the -v option on the codesign cmd to get it to work, which I think verifies the timestamp (which is a new stated requirement), but as mentioned I can't find complete docs on the command options so Im not sure. The directions stated I only needed the sudo command if I have an older version of Xcode installed too, but I still needed to run the sudo command first. Also I ran the codesign on the .app package, but I couldn't notarize the built .app directly, so I put it in a zip file, that reported success from notarization, then I unzipped it and ran stapler on the contents, as directed above. I wasn't planning to make a .dmg installer, but if there are instructions how to do that for a max build somewhere, of course I could add that too. Also I tried skipping the stapler step, and as suspected, its the stapling which is corrupting the file. So I shared it without stapling. there's no guarantee that won't later be rejected by Apple as stapling was stated to be a requirement, whatever it is.

sudo xcode-select -s full-path-to-xcode 

codesign -f -s "Developer ID Application: certificate-name-and-number-in-parentheses-as-per-instructions"  full-path-and-filename -v --deep

xcrun altool --notarize-app --primary-bundle-id "arbitrary-id" --username "my-Apple-id" --password "function-generated-pwd-as-per-instructions" --file full-path-and-filename 

xcrun stapler staple  full-path-and-filename 

Unsure why you're having trouble with the codesigning/notarizing/stapling then affecting your app functioning, that all seems correct on quick glance.

BTW, the -v option just means "verbose" - it will give you more info when it does its processing.

Well, when I didn't have the -v option, the os only asked for admin username and password in a popup window once, and the result did not include my certificate. Sp I added the -v option to see what was going on, then, it asked for my Apple ID and password five times and the result was successfully codesigned, but it still did not pass Mojave or Catalina beta gatekeeper until also notarized. I don't have High Sierra installed currently. Since then I just run with -v option and it works fine.

HI Dan, I did get kind of a reply from C74 that I 'just need to add the right entitlements' to write files. I looked through the entitlements page, but I couldn't figure it out exactly how to do that without doing a lot more experimentation, and now I am due for heart surgery in a couple of days, I have to drop finishing my two years work for macos and offer Windows only, my remaining time will basically be deleting all my Apple apps from my website. Maybe someone else will want to figure it out now, but as Apple will require hardened runtimes in January, it only makes a difference for a few months. Wishing you happy patching in your own future, cheerio.

Most importantly, good luck with your heart surgery!

Re: writing files entitlement, this is what I use:

com.apple.security.files.user-selected.read-write

Perhaps that helps for you...

Just to clarify, the Max Runtime (which is included in all Max Standalones) is built with "Hardened Runtime" enabled, so there is no other action required related to this aspect of the new Apple requirements when building Max Standalone applications on MacOS. However, you will need to sign, notarize and staple your standalone yourself if you wish to pass these new requirements. You can read more about general Catalina support (and Standalones) here:
https://cycling74.com/articles/max-8-1-mac-os-10-15-catalina-support-and-notarization/

Thanks Ben!

Hello
I'm Christophe Duquesne from Haken Audio and our Continuum Editor is quite a huge Max patch (see here https://www.hakenaudio.com/sound-engine ).
Thanks a lot for all the great info and help in this thread (we went through pretty much all the issues raised here...).
After a lot of tries and fails, we finally manage to get a Notarized “Hardened Runtime”, and since I would never never have managed to get it working without the help I found here I thought it was fair sharing the result we ended with, if it can help others ... So here it is (also as in an attached pdf file ):

Add a standalone object to your patch, set a Bundle Identifier to something like com.yourCompany.yourAppName and of course also create one in your https://developer.apple.com/ (so you need to pay for an Apple developer license).

In the standalone also update the icon path to the proper MacOS Application Icon, and any other info you may need.

Then generate the app standalone

codesign -s [Developer ID] --options runtime --timestamp --deep --entitlements [path/to file.entitlements] -f [path/to/YourAppStandalone.app]

[Developer ID] usually looks like "Developer ID Application: YourName (a number)"

For an application like ours, doing only Midi (no audio, but still requires com.apple.security.device.audio-input ) the minimum file.entitlements file content shall be

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>com.apple.security.device.audio-input</key>
        <true/>
        <key>com.apple.security.cs.disable-library-validation</key>
        <true/>
    </dict>
</plist>

Note that with wrong entitlements, the app may crash, or have weird behavior, so to make sure test it after codesigning it, to stay on the safe side …. If it does not work anymore, then you need additional entitlement (check here, end of the pot, for more https://cycling74.com/articles/max-8-1-mac-os-10-15-catalina-support-and-notarization )

In our case we have extra files (presets, documentation, firmware for the Continuum, etc.) associated to the Max standalone app. But you have to manage this with care due to apple Quarantine and Translocation mechanism.

So first put all your associated files in a folder and Zip it (but don’t put the app standalone in it). In a folder (let’s call it Folder for DMG ) put the Zip and the app standalone.

Your users will have 1) to open a DMG 2) to put the Zip somewhere on their disk and unzip it 3) to manually move the app standalone in the resulting folder (if not moved manually, for example if you move it within a folder… it will be translocated and will not be able to access to external files).

Build the DMG with

hdiutil create -ov -scrub -srcfolder [path/to/Folder for DMG] -volname [your Volume Name] [path/to/XXX.dmg]

For the Notarization, you will need an app specific Apple password (it looks like «abcd-efgh-ijkl-mnop») (see here to get such a password https://support.apple.com/en-mk/HT204397 )

Now you can Notarize

xcrun altool --notarize-app -t osx -primary-bundle-id [YourBundleId, the one you put in the standalone object] -u [Your AppleId: the mail you use to connect to apple developpers] -p [your app specific password looking like abcd-efgh-ijkl-mnop] -f [path/to/XXX.dmg]

It will take time since it will first upload the dmg to Apple (so depending on your bandwidth and the size of your app, that can be really long).

You should finaly get an answer like: RequestUUID = 1cc1503c-c04a-407c-a3ff-dd5354ee29cb

This only means that your request was submitted, you still need to wait for the validation: you can either wait for a mail that Apple will send you, either check the progress with :

xcrun altool --notarization-history 0 -u [Your AppleId: the mail you use to connect to apple developpers] -p [your app specific password looking like abcd-efgh-ijkl-mnop]

Wait for the mail or something like :

Date                      RequestUUID                          Status      Status Code Status Message   
------------------------- ------------------------------------ ----------- ----------- ---------------- 
2019-11-11 12:52:05 +0000 1cc1503c-c04a-407c-a3ff-dd5354ee29cb success     0           Package Approved 

Then you can staple the DMG with:

xcrun stapler staple -v [path/to/XXX.dmg]

You are done… you can send your XXX.dmg to your users !!!