HOWTO macOS notarization (plugins, app, pkg installers)

[quikquak]

Whitebox 'packages' 1.2.10 doesn't seem to work properly in Ventura - the Presentation panel doesn't show for me at all!
Luckily for me I didn't need to edit it this time. But watch out, if you use packages!

[discoDSP]

Thanks for the heads up. Considering how fast the industry is adopting Apple Silicon and latest macOS updates I'd hold Ventura until 2024

[quikquak]

It appears that version 12.11 fixes the Presentation panel problem.
https://github.com/packagesdev/packages ... t-91923575
Direct from dev site:-
http://s.sudre.free.fr/files/Packages_1211_dev.dmg

[Markus Krause]

I've just upgraded to Ventura and you can only install Xcode 14 - which gives warnings about targeting earlier MacOS versions.
And someone has reported that forcing targeting on Xcode 14, to earlier OS produces errors for the latest OS.
So I can’t target to old MacOS at all, and I can’t install Xcode 13 on Ventura. DOH!

I guess I'm only targeting for the latest now.

I had the same issue with some MacOS version and XCode in the past. It was highly annoying. I did get around it with some tool that did fake the installer so that it thinks that an earlier MacOS version is running. I do not remember what the name of the tool was but the older XCode did run flawlessly on the new MacOS version.
Apple is just trying to force us developers to use the latest XCode with no technical reason at all. Sad fact is that this is a very sneaky way of introducing planned obsolescence, as the latest XCode versions mean that we devs need to drop support for older hardware/MacOS versions. And this means money for Apple, as they will sell more new devices to the customers as their current (not-so-really-old) Macs can not longer run the latest software

[Markus Krause]

Warning! Important info:

In September 2023 Apple will switch of notarisation with altool. Then notarytool must be used.

XCode version on the build machine:
- To be able to use notarytool you must use XCode 13 or higher.
- XCode 13 can not be installed on Catalina. XCode 13.2 is the last version that runs in BigSur.
- XCode 14 should be avoided, as you can not target your builds below MacOS 10.13.

MacOS version for the build machine:
- MacOS 13 (Venturta) should be avoided as you can not install XCode 13 there. It only allows XCode 14.
- MacOS 12 (Monterey) or MacOS 11 (Big Sur) should work.
- MacOS 10.15 (Catalina) can not run XCode 13.

I hope this helps to prevent you from running into serious trouble

[quikquak]

Thanks for the info Markus. I personally find Mac OS a pain, and because of cost and space I'm just going to stick with Apple's control freakery, and keep my single Mac dev machine up to date (like a good little dev that I am). But I realise a lot of devs don't.

[syntonica]

I'm currently on a quest to rid myself of controlling IDEs. I'm about 95% done with Eclipse and I'm starting to look at dumping Xcode.

I installed the latest developer tools and have found several old SDKs lurking in /Library/Developer left over from previous versions of Xcode.

My thinking is to use a couple of different Developer folders, from say High Sierra to support 10.6 to 10.14 and then the latest, which goes back to 10.13. It will involve two compilations, of course, but the older-targeting one can just be distributed without getting a note from mommy first.

I'm still learning make, but it appears to be more than adequate to handle compilation and packaging. I just need to work out how to handle the plists since there's too many settings and choices to remember without using Xcode.

As for dropping support for older versions, don't worry about it if adding new features. You may want to back-port bug fixes, however. There's plenty of Mac software out there that offers several older versions based on OS. They all essentially have the same features, however, just using updated APIs.

As a staunch Mac user who digs his heels in in regards to updating and Apple's new "features", I would be happy as a clam running 10.6 if it had a browser that could handle "modern" websites, and by modern, I mean over-engineered and wasteful. If I could turn Javascript off, I eould. If you can't do it in HTML5, you probably shouldn't be doing it at all... /rant off

[Markus Krause]

Today Apple made a change to the notarization process or some server is down. So far it was possible to check the status after an upload by entering:

xcrun altool --notarization-history 0 -u "your@email.com" -p "some-pass-word-1234"

This seems to be not longer possible (randomly?). Instead you need to enter:

xcrun altool --notarization-info RequestUUID -u "your@email.com" -p "some-pass-word-1234"

[discoDSP]

Thanks for the heads up Markus, will update the main post asap.

[audiothing]

You can skip all that if you use the new method. You can save the output directly to a file to check the status of the submission, so you don't need to do convoluted waiting to check if the file has been processed. Easier and quicker.

Something like this:

Code: Select all

  xcrun notarytool submit "$dmgFile" --keychain-profile "AC_PASSWORD" --wait | tee "$tmpNotarizationLog"

  notarizationStatus=$(tail -3 "$tmpNotarizationLog" | grep "status" | sed -e 's/status.*: *//')

  if [[ "$notarizationStatus" == *"Accepted"* ]]; then
    xcrun stapler staple "$dmgFile"
    echo "ok!"
  else
    echo "NOT ok!"
    exit 42;
  fi

[quikquak]

You can skip all that if you use the new method. You can save the output directly to a file to check the status of the submission, so you don't need to do convoluted waiting to check if the file has been processed. Easier and quicker.

Something like this:

Code: Select all

  xcrun notarytool submit "$dmgFile" --keychain-profile "AC_PASSWORD" --wait | tee "$tmpNotarizationLog"

  notarizationStatus=$(tail -3 "$tmpNotarizationLog" | grep "status" | sed -e 's/status.*: *//')

  if [[ "$notarizationStatus" == *"Accepted"* ]]; then
    xcrun stapler staple "$dmgFile"
    echo "ok!"
  else
    echo "NOT ok!"
    exit 42;
  fi

Excellent! So this is all we need to do now?

[audiothing]

Excellent! So this is all we need to do now?

Yes, that's what we are using since they announced the change.

[quikquak]

Cool, thanks. It's still Terminal based then... One day they might make an App for that!

[discoDSP]

For individuals seeking to develop an application from a bash script, I would recommend considering Platypus, which can be found at https://sveinbjorn.org/platypus. This tool offers a straightforward and user-friendly approach to building applications from shell scripts, and may prove to be a useful resource for those looking to create such applications.

[Markus Krause]

Cool, thanks. It's still Terminal based then... One day they might make an App for that!

I just can't see what notarytool does give as an advantage compared to altool except the possibility to dump the notarization result to a file and to break things ... again...
The main 'feature' seems to be that we developers are forced to drop support for older Mac OS versions as we need to use XCode 13 or higher now.