PNS export - unidentified developer

[ajl1606]

As far as I know, notarization is actually only required for apps, and does not truly works for plug-ins.

You might be right. I know it's possible to notarize a zip file, but as the end-user would only be unzipping and then dragging the plugin into the appropriate folder, the notarization might be redundant. Perhaps I need to work on making an installer then!

After sucessful .dmg notarization I also do "staple", like this:
xcrun stapler staple -q "${DMG_FULL_PATH}"

Thanks, that's a good point. Would you mind sharing your process for dmg creation, specifically how to create a link to the end-user's ~/Library/Audio/Plug-Ins/Components folder? I know how to make the dmg, but I haven't been able to make a generic alias for them to drag 'n drop the plugin file into the right place.

[Blue Cat Audio]

I think you should not make .zip, but rather .dmg or installer file, those can only be properly notarized (if I'm correct). After sucessful .dmg notarization I also do "staple", like this:
xcrun stapler staple -q "${DMG_FULL_PATH}"

You can staple a dmg file? I thought you could only do this with executable files such as installers.

[ilyaorlov]

As far as I know, notarization is actually only required for apps, and does not truly works for plug-ins.

You might be right. I know it's possible to notarize a zip file, but as the end-user would only be unzipping and then dragging the plugin into the appropriate folder, the notarization might be redundant. Perhaps I need to work on making an installer then!

After sucessful .dmg notarization I also do "staple", like this:
xcrun stapler staple -q "${DMG_FULL_PATH}"

Thanks, that's a good point. Would you mind sharing your process for dmg creation, specifically how to create a link to the end-user's ~/Library/Audio/Plug-Ins/Components folder? I know how to make the dmg, but I haven't been able to make a generic alias for them to drag 'n drop the plugin file into the right place.

It's been a while since I was writing scripts for DMG building etc, so cannot go into the details,
but i was using "dmgbuild" tool:
https://dmgbuild.readthedocs.io/en/latest/
it has settings that allow inserting icons, folders etc. Though in latest OS you still can't simply drag a plugin onto a plugins folder due to security settings, so you have do double click it to open, and then drag.

[ilyaorlov]

I think you should not make .zip, but rather .dmg or installer file, those can only be properly notarized (if I'm correct). After sucessful .dmg notarization I also do "staple", like this:
xcrun stapler staple -q "${DMG_FULL_PATH}"

You can staple a dmg file? I thought you could only do this with executable files such as installers.

Seems like you can, yes!