Sign, Notarize and Staple MacOS for distribution in ZIP

General
1

Hi All,

I let my Apple Developer subscription lapse because I wasn’t using it. Now I’m back to where I’ll likely need to start it up again.

Some of my projects have multiple scripts and executables. To add to the fun, I combine everything in a zip file for MacOS, Windows and Linux. My primary concern is to sign, Notarize and Staple the MacOS stuff.

The question because I have not used Xojo to sign and notarize anything, how well does Xojo do the job? Since I may also have some AppleScripts in my project, would it be better to just use a script to handle the signing?

I want everything in a single zip file in order to simplify distribution since I include versions for each OS. Is anyone else doing something similar?

I’m also hoping this will prevent issues with the files being marked as dangerous if downloaded.

Suggestions?

2

Wow! 85 Views, 5 Days and nobody has any feedback? Maybe this just got overlooked, so just wanted to bump this :slight_smile:

4

Well, AppWrapper can create and notarize zips (as well as .pkg files), and can also make Intel and Apple Silicon-specific ones from a single Universal build. Offhand, I would guess that you could do this, then in turn archive those into a bigger zip or tar.gz containing the versions for your other platforms.

5

I have never downloaded a zip file with apps for Mac, Windows and Linux in the same zip. If I had to distribute software I will never zip together.

I guess no one in this group has done something similar. Maybe I’m wrong and someone will comment.

Good luck.

6

Nor I. But the gentleman said what he wanted to do, and I gave my best shot at an answer. :slight_smile:

7

Besides convenience of having it all in a single zip file, there’s a reason I do it that I won’t go into here.

8

If your app comes alone, you could zip it. Then after download Safari unzips it and people can launch it or move it to applications folder.

In any other case you better go with the disk image.
Custom background, additional files included and multiple applications possible. Just like the Xojo download.

9

Ok, we will forget the zip for now. I see your questions are:

I have seen some users having problems figuring out the certificates and how everything needs to be configured but once they have a good configuration they can do the job within Xojo.

I guess it depends if your scripts are shipped within the Xojo mac bundle or separate to it.

No idea on that. I guess it may depend on platform.

I hope someone can give you better answers.

10

Convenient for whom? Not for the user. I doubt this will work correctly with signing. If there is an unsigned .exe in a ZIP, this will give issues with AV.

11

Don’t do this, for whatever reason. Period.

Use dmg instead as macOS users expect this.

The main reason why no-one reacted in the first place.

12

Agree with others that zipping all 3 apps (macOS, Windows, Linux) together does not sound like a great idea.

But if you must do that, I would recommend you do something like this:

Zip file
  macOSapp.dmg
  Windows App.zip
  Linux App.zip

In other words, include the macOS app as a DMG file within the zip file, and the other platforms as their own zip files.

13

Here’s a specific reason this is a bad idea:

This will likely[*] cause Microsoft SmartScreen to fail to gain “trust” for your EXE Zip file (since it’s looking for a windows EXE inside the zip, but is going to see all sorts of other things).

[*] Note I say “likely” because nobody (including Microsoft) seems to know how their SmartScreen actually works, you can read more about it here: Microsoft SmartScreen and OV Certificates - #12 by Mike_D