FYI: Notarizing Your App Before Distribution (macOS 10.14.5 and beyond)

Paulo_Vargas · June 9, 2019, 2:17am

Hi Thom.

I am not worried about the cost, but with the difficulty and possible problems in this notorization, first I have no idea how to do this because I never needed it before, other than that I have Apps that I have made for years and are very difficult to change, and as I am alone this could demand a time and effort that I do not have.

Gavin_Smith · June 9, 2019, 2:30am

Difficulty? You’re pre-supposing this. It’s really not difficult at all. You have several choices.

Figure this out from the command-line yourself. There are many tutorials.
Just let AppWrapper deal with it. That’s what I’ve been doing, apart from one case that I probably need to report to Sam, and I just used the command line.
Follow Christoph’s excellent steps at https://forum.xojo.com/conversation/post/440614

Sam_Rowlands · June 9, 2019, 5:37am

Just to be clear; Notarization does require the use of “Hardend Runtime” which applies some security restrictions to applications. I’ve only got a couple of developers who can’t Notarize applications, but most are able to do so without any changes.

When you’re ready; let me know and I’ll see what I can do.

Jeff_Tullin · June 9, 2019, 5:55am

I know a build exists that ‘does this’, but it doesnt seem to be on general release.
My copy says it is up to date, but doesn’t have the feature. (3.8.8)
Its also still 32bit… did you get the 64 bit build finished @Sam ?

Sam_Rowlands · June 10, 2019, 12:42am

[quote=440685:@Jeff Tullin]My copy says it is up to date, but doesn’t have the feature. (3.8.8)
Its also still 32bit… did you get the 64 bit build finished @Sam ?[/quote]
Yes I did; and I am afraid that I am guilty of poor communication.

In the last few months my website was compromised (Thanks @Gavin Smith & @Tim Parnell for noticing and reporting to me), it was an interesting hack designed to redirect any incoming search engine traffic to an alternative site (so I never saw it).

I removed the hack and in trying to prevent any further infection, I ended up breaking my update system and In-App-Purchase system. I have a fixed update system, but it can only work going forwards, so people need to manually download version 3.9.

https://www.ohanaware.com/appwrapper/appWrapper3.dmg

Right now I have a great deal of things going on; once I can complete this current phase, things should calm down significantly and service should return to some normality.

DaveS · June 10, 2019, 4:07am

Ok… then what am I doing wrong? I’ve been having to pay $99 PER YEAR else they expire

KarenA · June 10, 2019, 4:15am

See:

[quote]Developer ID certificates are valid for 5 years from the date of creation and Developer ID provisioning profiles generated prior to February 22, 2017* are valid until your Developer ID certificate expires.
[/quote]

DaveS · June 10, 2019, 4:21am

So confused… I just checked and all my certificates were created 07/30/2018 … .just I just renewed by developer account two months ago…

Are you saying that I DON’T have to spend $99 a year, but only once every 18 years?
or is the once a year just for the added privilege of being able to submit to App store as well?

Edwin_Lau · June 10, 2019, 4:39am

If you just need the Developer ID to Codesign and Notarize your apps to be distributed outside of the Mac App Store then you do not need to pay Apple anything for it. It is free.

The $99 you pay a year is to be able to market your app through the Mac App Store.

Thom_McGrath · June 10, 2019, 4:42am

[quote=440774:@Dave S]So confused… I just checked and all my certificates were created 07/30/2018 … .just I just renewed by developer account two months ago…

Are you saying that I DON’T have to spend $99 a year, but only once every 18 years?
or is the once a year just for the added privilege of being able to submit to App store as well?[/quote]
If the only thing you need is a developer id for sandboxing/gatekeeper/notarization, then yes you can spend only $99 every 5 years.

If you need more, such access to beta software and the ability to submit your apps to Apple for sale in their stores, the you need the $99 per year version.

DaveS · June 10, 2019, 6:05am

[quote=440775:@Edwin Lau]If you just need the Developer ID to Codesign and Notarize your apps to be distributed outside of the Mac App Store then you do not need to pay Apple anything for it. It is free.

The $99 you pay a year is to be able to market your app through the Mac App Store.[/quote]
Thanks

Jeff_Tullin · June 10, 2019, 6:20am

I got AW3.9 (thanks Sam)
Trying the notarisation out, I get a message that says I need to log in using an app specific password.
a/ Which app? (AW or mine?)
b/ I can create a password, but it doesnt ask which app it is FOR
c/ Where would I enter it?

ChristopheDV · June 10, 2019, 6:23am

As far as I know Appwrapper cannot notarise with an app specific password. If you want to do this, for now you will need to use the above steps.

Sam_Rowlands · June 10, 2019, 12:10pm

[quote=440781:@Jeff Tullin]Trying the notarisation out, I get a message that says I need to log in using an app specific password.
a/ Which app? (AW or mine?)
b/ I can create a password, but it doesnt ask which app it is FOR
c/ Where would I enter it?[/quote]
In the Notarization window; click on the account menu and select “Add account”; in here is where you create the developer user ID and the app specific password. There’s a quick guide on how to set it up also.

I had to change this when App-specific passwords were enforced for all accounts, not just a select few as before.

ChristopheDV · June 10, 2019, 12:18pm

[quote=440813:@Sam Rowlands]I had to change this when App-specific passwords were enforced for all accounts, not just a select few as before.

[/quote]

That’s odd because I never added an App-Specific password in Appwrapper and it always returns everything went ok.

Sam_Rowlands · June 11, 2019, 12:30am

The whole thing is odd if you ask me; App Wrapper was working fine without it and then all of sudden; mass users including myself started getting rejections from the Notarization because it now needs an App Specific password. So I assumed they flicked a switch and now everyone needs one.

Oliver_Osswald · June 11, 2019, 12:16pm

AppWrapper 3.9 claims that the account is already existing (of course it is) and is not allowing me to use it for notarizing my app:

What next?

Oliver_Osswald · June 11, 2019, 12:36pm

I’m trying the command-line approach:

xcrun altool --notarize-app -f /Users/oliver/Desktop/SeminarProBeta.pkg --primary-bundle-id com.osswald.pro.seminar -u oliver@osswald.com -p wplr-lynx-****-****

I’m expecting an answer like this:

2019-04-30 09:55:53.384 altool[4444:457969] No errors uploading '/Users/oliver/Desktop/SeminarProBeta.pkg'. RequestUUID = 5032eacb-8f1f-481e-b077-89ecd94b****

But I’m getting this:

[code]<…> Package Summary:

1 package(s) were not uploaded because they had problems:
/var/folders/b0/jnshwx0x6x35tvz9ntwlnh8h0000gn/T/9A2CCED7-B503-4D11-A733-753D7C0A00EC/Untitled.itmsp - Error Messages:
To use this application, you must first sign in to iTunes Connect and sign the relevant contracts. (1048)
2019-06-11 14:32:06.297 altool[11450:2586973] *** Error: To use this application, you must first sign in to iTunes Connect and sign the relevant contracts. (1048)[/code]

This whole thing sucks. ITUNES CONNECT!?? I don’t want to sell books…

Sascha_S · June 11, 2019, 1:23pm

There have been contract changes after WWDC2019, which you need to agree to first.

Oliver_Osswald · June 11, 2019, 2:18pm

Yes, after accepting a bunch of “agreements”, I received a “package approved” and then I was able to staple the ticket to my distribution:

But then, after running the installer and starting the app on macOS 10.14.3, the app hangs and in the console I find the error log below. It says “Code Signature Invalid” and it seems to originate from a XojoScript which runs at startup of the app (The script is running a database query).

Once again, I have no clue what and why this notarization thing is preventing here (???)

[quote]Process: Seminar Pro [781]
Path: /Users/USER/Documents/*/Seminar Pro.app/Contents/MacOS/Seminar Pro
Identifier: com.osswald.pro.seminar
Version: 2019 (1.0.0.2.3073)
Code Type: X86-64 (Native)
Parent Process: ??? [1]
Responsible: Seminar Pro [781]
User ID: 501

Date/Time: 2019-06-11 16:07:44.584 +0200
OS Version: Mac OS X 10.14.3 (18D109)
Report Version: 12
Anonymous UUID: 7F8C7BA8-984E-1301-F21C-FA0F1FBF2588

Time Awake Since Boot: 87 seconds

System Integrity Protection: enabled

Crashed Thread: 0 Dispatch queue: com.apple.main-thread

Exception Type: EXC_BAD_ACCESS (Code Signature Invalid)
Exception Codes: 0x0000000000000032, 0x000000011a0b6000
Exception Note: EXC_CORPSE_NOTIFY

Termination Reason: Namespace CODESIGNING, Code 0x2

kernel messages:

VM Regions Near 0x11a0b6000:
VM_ALLOCATE 000000011a0b5000-000000011a0b6000 [ 4K] r–/r-- SM=PRV
→ VM_ALLOCATE 000000011a0b6000-000000011a0b8000 [ 8K] r-x/rwx SM=COW
CoreUI image data 000000011a0bf000-000000011a0d5000 [ 88K] rw-/rwx SM=PRV

Thread 0 Crashed:: 0 ??? 1 RBScript.dylib 2 RBScript.dylib 3 com.osswald.pro.seminar 4 com.osswald.pro.seminar 5 com.osswald.pro.seminar 6 com.osswald.pro.seminar 7 com.osswald.pro.seminar 8 com.osswald.pro.seminar 9 com.osswald.pro.seminar 10 com.xojo.XojoFramework 11 com.apple.CoreFoundation 12 com.apple.CoreFoundation 13 com.apple.CoreFoundation 14 com.apple.CoreFoundation 15 com.apple.CoreFoundation 16 com.apple.HIToolbox 17 com.apple.HIToolbox 18 com.apple.HIToolbox 19 com.apple.AppKit 20 com.apple.AppKit 21 com.xojo.XojoFramework 22 com.xojo.XojoFramework 23 com.osswald.pro.seminar 24 com.xojo.XojoFramework 25 com.xojo.XojoFramework 26 com.apple.AppKit 27 com.xojo.XojoFramework 28 com.osswald.pro.seminar 29 com.osswald.pro.seminar 30 com.osswald.pro.seminar 31 libdyld.dylib Dispatch queue: com.apple.main-thread
0x000000011a0b6000 0 + 4731920384
0x000000011615d8fe 0x1150cc000 + 17373438
0x000000011615a4ca 0x1150cc000 + 17360074
0x000000010e7295dc XojoScript.Run%%o + 44
0x00000001100ab668 imScript.ImRunScript%%ob + 6424
0x000000010ee6d1aa WindowLoginClass.WindowLoginClass.imDoDBConnect%%o<WindowLoginClass.WindowLoginClass> + 42522
0x000000010ee8bca4 WindowLoginClass.WindowLoginClass.imOpen_WindowLoginInitialize%%o<WindowLoginClass.WindowLoginClass> + 14004
0x000000010ee847ab WindowLoginClass.WindowLoginClass.imOpen%%o<WindowLoginClass.WindowLoginClass> + 6971
0x000000010ed218b6 App.importDatabase%%o + 16982
0x000000011070f166 hlp.commTimer.Event_Action%%o<hlp.commTimer> + 4278
0x0000000111a8a6a1 0x111828000 + 2500257
0x00007fff4c435c25 CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION + 20
0x00007fff4c4357d8 __CFRunLoopDoTimer + 871
0x00007fff4c43530d __CFRunLoopDoTimers + 333
0x00007fff4c4168b4 __CFRunLoopRun + 2187
0x00007fff4c415dd6 CFRunLoopRunSpecific + 467
0x00007fff4b69fab5 RunCurrentEventLoopInMode + 293
0x00007fff4b69f7eb ReceiveNextEventCommon + 618
0x00007fff4b69f568 _BlockUntilNextEventMatchingListInModeWithFilter + 64
0x00007fff4995a363 _DPSNextEvent + 997
0x00007fff49959102 -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 1362
0x00000001118fd2f5 0x111828000 + 873205
0x00000001118fd339 0x111828000 + 873273
0x000000010e6a16a5 Application._CallFunctionWithExceptionHandling%%op + 181
0x0000000111a824bb CallFunctionWithExceptionHandling(void (*)()) + 262
0x00000001118fd2a2 0x111828000 + 873122
0x00007fff49953165 -[NSApplication run] + 699
0x0000000111a8082d RuntimeRun + 42
0x000000010e776f43 REALbasic._RuntimeRun + 19
0x0000000110b79fa8 _Main + 536
0x0000000110b78613 main + 19
0x00007fff79701ed9 start + 1

Thread 1:
0 libsystem_pthread.dylib 0x00007fff798f43f8 start_wqthread + 0
1 ??? 0x0000000054485244 0 + 1414025796

Thread 2:
0 libsystem_pthread.dylib 0x00007fff798f43f8 start_wqthread + 0
1 ??? 0x0000000054485244 0 + 1414025796

Thread 3:
0 libsystem_pthread.dylib 0x00007fff798f43f8 start_wqthread + 0
1 ??? 0x0000000054485244 0 + 1414025796

Thread 4:
0 libsystem_pthread.dylib 0x00007fff798f43f8 start_wqthread + 0
1 ??? 0x0000000054485244 0 + 1414025796

Thread 5:: com.apple.NSEventThread
0 libsystem_kernel.dylib 0x00007fff7983b17a mach_msg_trap + 10
1 libsystem_kernel.dylib 0x00007fff7983b6d0 mach_msg + 60
2 com.apple.CoreFoundation 0x00007fff4c417158 __CFRunLoopServiceMachPort + 336
3 com.apple.CoreFoundation 0x00007fff4c4166a6 __CFRunLoopRun + 1661
4 com.apple.CoreFoundation 0x00007fff4c415dd6 CFRunLoopRunSpecific + 467
5 com.apple.AppKit 0x00007fff49962f89 _NSEventThread + 160
6 libsystem_pthread.dylib 0x00007fff798f5305 _pthread_body + 126
7 libsystem_pthread.dylib 0x00007fff798f826f _pthread_start + 70
8 libsystem_pthread.dylib 0x00007fff798f4415 thread_start + 13

Thread 0 crashed with X86 Thread State (64-bit):
rax: 0x000000011a0b6000 rbx: 0x00007ffee15dc640 rcx: 0x00000000000120a8 rdx: 0x0000000000000000
rdi: 0x0000600002547540 rsi: 0x00000000000120a8 rbp: 0x00007ffee15dc670 rsp: 0x00007ffee15dc638
r8: 0x00000000000130a8 r9: 0x0000000000000000 r10: 0x0000600002547560 r11: 0x0000600002547558
r12: 0x0000000111a8a640 r13: 0x000060000091da58 r14: 0x000000011a0b6000 r15: 0x0000600000e6a760
rip: 0x000000011a0b6000 rfl: 0x0000000000010246 cr2: 0x000000011a0b6000

Logical CPU: 0
Error Code: 0x00000015
Trap Number: 14[/quote]