4 ms·

There's extensive documentation. Examples: https://developer.apple.com/documentation/security/code-signing-services https://developer.apple.com/documentation/s

There's extensive documentation. Examples: https://developer.apple.com/documentation/security/code-signing-services https://developer.apple.com/documentation/security/code-sign... https://developer.apple.com/documentation/security/notarizing-macos-software-before-distribution https://developer.apple.com/documentation/security/notarizin... There are dedicated sections of the developer web forums: https://developer.apple.com/forums/topics/code-signing-topic https://developer.apple.com/forums/topics/code-signing-topic https://developer.apple.com/forums/topics/code-signing-topic/code-signing-topic-notarization https://developer.apple.com/forums/topics/code-signing-topic... ...and there's an apple developer support person, Quinn, who appears to be heavily if not solely dedicated to helping developers do binary signing/notarization/stapling correctly. They have written a slew of Tech Notes about signing and notarization. Main TN is at https://developer.apple.com/documentation/technotes/tn3125-inside-code-signing-provisioning-profiles https://developer.apple.com/documentation/technotes/tn3125-i... Quinn also has their email address in their sig so people can just reach out via email without even needing an Apple account, or if they prefer more confidentiality. I mean, come on.

paradite 2y ago
As someone who actually signs, notorizes and distributes desktop apps for macOS, I can safely say their documentation is less than ideal. Maybe because I'm using Electron framework which makes things more complicated, but I don't really understand why there's is a difference between different types of certificates (Developer ID, Apple distribution, macOS distribution) and I had to guess which one to use everytime I set it up. Also why is notorization a completely different process from code signing, and requires completely different set of credentials from it. Seems odd to me.
- latexr 2y ago
  > Also why is notorization a completely different process from code signing Because they do completely different things. Signing is a proof that you were the one to write and package that software; notarisation is an online security check for malware. If I recall, you still sign but do not notarise when distributing to the Mac App Store.
  - paradite 2y ago
    Ok, so the certificate used to sign the package is generated by Apple, why can't I just use that to prove my identity for notarization? Or maybe simpler, why can't Apple just do code sign and notarization with one single cli call, with one set of credentials? Google Play does this under the hook, I don't even think about it. iOS is similar, Transponder app does everything in one go.
upbeat_general 2y ago
A lot of developers (including myself) don’t want to notarize/sign their binaries that they want to run on their own machine(s).
- bshacklett 2y ago
  OMG, this. I was working on a tool to help integrate password managers on macOS and I got completely blocked by the notarizing requirements. Some things literally cannot be built for macOS as open source software, now.
Etheryte 2y ago
I don't really think saying documentation exists says much when Apple is notorious for having documentation that's either borderline or downright useless. It's generally the norm that some random blog post from a decade ago is more useful than their documentation, and I say this from firsthand experience.
kbolino 2y ago
Can you sign and notarize your own software made for internal use with your own infrastructure? If so, then this is a valid response. If not, then this is an irrelevant response because the issue is going through Apple, not the process being difficult or undocumented. If I own the device, then I should be free to decide what the sources of authority over it are. Edit: I haven't tested it yet, but it does seem that you can sign an executable with your own certificate (self-signed or internal CA-issued) however you can't notarize it. Right now, notarization is only required for certain kinds of Apple-issued developer certificates, but that may change in the future.
- bshacklett 2y ago
  Anecdotally, I was not able to find any way to notarize software for internal use, without paying for a $99 developer account. Though I would have been willing to pay, I know that others who might want to build the software wouldn’t, so I abandoned my project. I suppose I could have maintained it as open source with the developer account required to build, but it seemed disingenuous to me at the time.
bshacklett 2y ago
> I mean, come on. Is that really necessary? Obviously there are enough people who did not know about, or find helpful, the resources you’re referring to, that we have people complaining on Hacker News. This isn’t exactly a novice’s forum. Perhaps the problem lies with visibility and accessibility of the support resources, rather than all of the people who have seen notarization as a hurdle to getting real work done. btw, for those who don’t want to search, Quinn’s signature states: “ Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com"

paradite 2y ago

As someone who actually signs, notorizes and distributes desktop apps for macOS, I can safely say their documentation is less than ideal. Maybe because I'm using Electron framework which makes things more complicated, but I don't really understand why there's is a difference between different types of certificates (Developer ID, Apple distribution, macOS distribution) and I had to guess which one to use everytime I set it up. Also why is notorization a completely different process from code signing, and requires completely different set of credentials from it. Seems odd to me.

latexr 2y ago
> Also why is notorization a completely different process from code signing Because they do completely different things. Signing is a proof that you were the one to write and package that software; notarisation is an online security check for malware. If I recall, you still sign but do not notarise when distributing to the Mac App Store.
- paradite 2y ago
  Ok, so the certificate used to sign the package is generated by Apple, why can't I just use that to prove my identity for notarization? Or maybe simpler, why can't Apple just do code sign and notarization with one single cli call, with one set of credentials? Google Play does this under the hook, I don't even think about it. iOS is similar, Transponder app does everything in one go.

upbeat_general 2y ago

A lot of developers (including myself) don’t want to notarize/sign their binaries that they want to run on their own machine(s).

bshacklett 2y ago
OMG, this. I was working on a tool to help integrate password managers on macOS and I got completely blocked by the notarizing requirements. Some things literally cannot be built for macOS as open source software, now.

Etheryte 2y ago

I don't really think saying documentation exists says much when Apple is notorious for having documentation that's either borderline or downright useless. It's generally the norm that some random blog post from a decade ago is more useful than their documentation, and I say this from firsthand experience.

kbolino 2y ago

Can you sign and notarize your own software made for internal use with your own infrastructure? If so, then this is a valid response. If not, then this is an irrelevant response because the issue is going through Apple, not the process being difficult or undocumented. If I own the device, then I should be free to decide what the sources of authority over it are. Edit: I haven't tested it yet, but it does seem that you can sign an executable with your own certificate (self-signed or internal CA-issued) however you can't notarize it. Right now, notarization is only required for certain kinds of Apple-issued developer certificates, but that may change in the future.

bshacklett 2y ago
Anecdotally, I was not able to find any way to notarize software for internal use, without paying for a $99 developer account. Though I would have been willing to pay, I know that others who might want to build the software wouldn’t, so I abandoned my project. I suppose I could have maintained it as open source with the developer account required to build, but it seemed disingenuous to me at the time.

bshacklett 2y ago

> I mean, come on. Is that really necessary? Obviously there are enough people who did not know about, or find helpful, the resources you’re referring to, that we have people complaining on Hacker News. This isn’t exactly a novice’s forum. Perhaps the problem lies with visibility and accessibility of the support resources, rather than all of the people who have seen notarization as a hurdle to getting real work done. btw, for those who don’t want to search, Quinn’s signature states: “ Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com"