I must be missing something obvious, but why do I either have to use a third party app or a terminal to code sign and notarize? Why isn’t it built in and streamlined into Xojo? It would save us all so much grief.
2 Likes
You’d still need to be a registered Apple Developer and have the relevant certificates. Given that there is such a 3rd party app, I’d rather Xojo got on with what it’s doing now. YMMV.
2 Likes
Yes, one has to be a registered apple developer, but I don’t understand why there isn’t an area where one can type/connect to existing app certificates. I really miss the days of yore when I was done after compiling the app from Xojo/RealStudio/RealBasic, but now have to go through all these processes just to put it on a website. I am sure the Xojo developers could make quick work out of the process and save all of us so much time and trouble.
You can always send in a Feedback with a feature request 
1 Like
For better or for worse, Xojo refuses to embrace what sets the platforms apart. When we discussed this ages ago, the reason is that signing must be done on the target platform. So it would prohibit building for Windows on Mac, and Mac on Windows, for example. Well we already lost the ability to build for Mac from Windows, so… maybe it matters less now.
Given the amount of setup work required regardless of wether or not Xojo does the actual signing for you, it was decided not to bother. It’s easily enough to include a build step to do the signing, if you need.
Honestly just let App Wrapper do it. I don’t see this changing in the future. Xojo may need to self-sign debug runs in the future, but I imagine it would not do this at build time.
2 Likes
It seems foolish to me that since it cannot be done on every platform it will not be done at all. We all make OS targeted apps and I don’t see why Xojo cannot just have a pane for Mac users making Mac apps. It’s like selling a TV, but you need to go out and buy a special power plug to make it work.
Disclaimer: I am the creator of App Wrapper. I understand where you come from, and I would relish the opportunity of being able to provide a solution that is integrated into the Xojo development environment (and getting paid for it of course).
Code signing is a deceptively simple task. There’s no magic one fits all solution. There’s several layers of security, that must be appeased for each and every single component inside the application.
For instance:
- It’s possible to sign an application that meets the code signing rules, but is rejected by Gate Keeper.
- It’s possible to sign an app that meets code sign and Gate Keeper, but is rejected by runningboardd.
- It’s possible to sign for code sign, Gate Keeper and runningboardd, but gets rejected by Notarization.
- It’s possible do all of the above, but be rejected by the App Store.
- It’s possible to meet all of Apple’s security requirements, but the app won’t run.
Then there’s Apple. Who change their rules whenever they feel like it, sometimes they provide warning and clear documentation, other times we only know about changes, because we can no longer ship apps.
When a change happens to the code signing rules, the tool that does the signing, needs to be updated very quickly, because customers cannot ship their apps until that happens.
Code signing is the last task before archiving, meaning the tool has to be prepared for all of the changes that must be made before signing. Notarization is the last step after archiving, which means the tool must be able to create the archives to submit for Notarization.
Developer who use Apple’s own tools, don’t always get an easy ride either. There’s a great deal of Apple customers who struggle with code signing and there appears to only be one or two people at Apple who assist.
Presuming that all customers ship simple apps, as the complexity of the application increases, the more complex the code signing becomes, and being able to deliver a tool that can handle hundreds, if not thousands of apps on varying levels of complexity every year, is enough work to keep a developer employed full time.
As it is, and I say this in attempt to better explain the scenario and not as a dig at Xojo. Right now localized console apps, break a code signing rule (which AFAIK is undocumented), preventing them from being included in a desktop macOS application without forgoing localization or building a custom localization solution.
Then there’s the Mac App Store, which has an entirely different set of rules.
I hope that this long winded thing actually makes some form of sense, and helps to paint a clearer picture as to why things are the way they are in terms of code signing and Notarization.
1 Like
We can tell anything, but the OP question is genuine.
Imagine if someone release an application optimizer that remove unneeded code/data/whatever in our built application and so strip it size to the minimum and sold that.
The OP question will also be genuine: if that person is able to do so, why Xojo don’t do it by itself ?
What is the meaning of IDE ?
Integrated Development Environment…
All is in the acronym !
And this, at least to me, is a primary reason why having an effective tool like App Wrapper is so helpful vs needing to wait for a Xojo point release – even if Xojo were to try to integrate it. Not to mention that Xojo may have to rush out point releases for numerous versions.
And I don’t want to jump through those hoops either, or try to figure out why something no longer works when Apple does not even document it well. For better or for worse, code signing has seemingly become a necessary evil. I, for one, would rather spend my time working on my apps. Let Xojo spend time on the language and compiler. And let Sam spend time on code signing for the rest of us.
And if you hurry, you can still get a license to App Wrapper included with Omegabundle 2020.
3 Likes
I’m waiting for this bundle to finish.
Hi
Can I ask a follow up question on this topic?
I am a hobby programmer, using Xojo to keep my ageing brain active. I sometimes give copies of my program to Mac using friends and family. I am not a registered programmer, and for what I do, I don’t need to be. I also confess I don’t fully understand all this talk of notarisation etc.
From what I do understand, I can carry on doing what I currently do on my computer, which is Intel based. Passing my code on to a family member might be a little more complicated.
If I get a M1 based Mac things should be a lot more difficult. All code, it seems must be signed. I don’t need, nor could I justify the cost of an App Wrapper license.
If Xojo had the option to sign code for people in my position things would get a lot simpler. The danger here is that the entire hobby market could go.
What are my options, and I guess I’m not alone?
Jack
1 Like
While I would also like to see basic codesigning built into the IDE, App Wrapper is a great value at $49.99 and saves tons of headaches that you would otherwise likely have. The IDE probably wouldn’t incorporate everything the way App Wrapper does, so you’d still be fiddling with tons of settings trying to find the “Sweet Spot” for your app.
When I finally decided to start signing my packages, App Wrapper made it super simple. I was up and running in about 20 minutes. It gives tons of feedback to help you make sure you’re doing everything right. @Sam_Rowlands has really done a great job, and App Wrapper is severely underpriced for the power and ease it provides.
If you really don’t want to invest in App Wrapper, you’ll spend tons of time reading docs and working in Terminal to try and get your app signed and rely on Shell and IDE Scripts which aren’t nearly as accommodating or informative.
6 Likes
First of all, to code-sign at all you need a code-signing certificate, which is a non-trivial purchase. In the case of Apple this means joining their developer program, whence you get your Apple certificates. It is also through this account that you upload your already-signed packages for notarization.
After this investment, the purchase of AppWrapper will seem trivial. But the point is that you need the certificate installed before any tool can help you sign your app.
I will join the list of those plugging AppWrapper. Indeed, when I purchased it I abandoned my own signing-app project, because I wasn’t going to top it. This was even before the additional step of notarization.
1 Like
PS: one workaround for you would be to simply compile your app for Intel. It will run just fine on an M1, using Rosetta. Then the usual methods for bypassing Gatekeeper should work just fine 
Xojo does ad hoc signatures for this reason.
1 Like