4 ms·

Smoke-testing your code signing is a good idea, and would probably catch most notarization issues. Aside from those, through, I've encountered numerous issues w

Smoke-testing your code signing is a good idea, and would probably catch most notarization issues. Aside from those, through, I've encountered numerous issues with embedded frameworks and app extensions whose error reporting wouldn't be described as obvious. Catching those right away rather than right before you are trying to deploy a release is critical.

lunixbochs 5y ago
`spctl -v --assess -t execute` is crucial. My app layout is fairly complicated, so I'm sure I'm exercising a lot of the corner cases: https://news.ycombinator.com/item?id=26996223 https://news.ycombinator.com/item?id=26996223 I check that executables don't depend on libraries from outside the app, I check that I successfully shipped everything as universal2, and I check for stuff like .DS_Store and vim .swp files. Here's my final stage check script, which staples notarization and checks the stapled dmg at the end as well: https://gist.github.com/lunixbochs/3d5eaf04e789932f8a19ca0fc04e84c6 https://gist.github.com/lunixbochs/3d5eaf04e789932f8a19ca0fc... I shared notary.sh in another comment: https://news.ycombinator.com/item?id=26996457 https://news.ycombinator.com/item?id=26996457