Xojo Post Build Script Example 4u: CodeSign, DMG creation and Notarization

I recently created an example Xojo project with a Post Build Script.
It invokes a Shell Script which will put the built .app into a customized DiskImage. Both .app (the one in the .dmg) and .dmg will be CodeSigned as well.
The DiskImage’s appearance can be easily customized by setting a couple of Variables in the Post Build Script. And of course one can replace the BackgroundImages and VolumeIcons which you’ll find in the folder: (XojoProject)/scripts/resources

As with macOS Sierra distributing (Xojo built) (signed) Apps outside of the App Store in a signed .dmg is the preferred (well, Apple-suggested) way.
Xojo doesn’t offer an easy way - so this Post Build Script may help other Xojo Developers to get started.

I haven’t done much testing yet… especially not much on macOS Sierra… so…
If you’re interested in trying this Post Build Script in order to have your project(s) auto-magically signed and packaged into a .dmg - please do so!
And let me (and/or the forum users) know:

  • if the example works on your build-machine
  • if you can use it for your .app’s as well
  • what doesn’t work (or doesn’t work every time you’re creating a build)
  • what should be improved - and how

The goal is to get this example script improved so that all Xojo Developers can use it.
Sure, it doesn’t compete with or replace all the features of other powerful tools such as AppWrapper or DMGCanvas.
But for a quick “drop in” (the scripts folder, and the PostBuildStep/Script) I hope it’s quite easy-to-use… and we may need that quick and easy way from time to time…

So let me know if you like it, what you think of this approach - and most important: does it work for you?

I appreciate that you’re trying to help, but it wants keychain password in plain text in a project file?
Absolutely not.

Not required at all… read the comment above it :slight_smile:

I updated the example Xojo project so that the CodeSigning part now works with Xcode 8, too.

Perfect for macOS Sierra.
Thank you for your contribution. I appreciate.

Xojo 2016 1.1
OS 10.11.6
Xcode 7.2.1

with keychain unlocked, when I enter my ID App name + surname, or the code associated to it, or both (name + surname + (code)), I get codeSigning error.
Do I guess right that Xcode 7.3 is expected?
Meantime, thank you.

i may have failed to mention that this example does codesign with the “Developer ID”. the example is not intended to sign for MAS (i’ve never done that, and it’s entirely possible that codesigning is different there).

and i’ve never seen “app name” in a “Developer ID certificate”… as it’s a certificate with your name/company which you can use to sign about every app you create (and distribute outside of the MAS).

In “Keychain Access”: have a look at your certificates.
I have one there with name: “Developer ID Application: Juerg Otter (ABCDEF)”

In the example post build - script i just need to fill in the first part:

Dim sCODESIGN_IDENT As String = "Developer ID Application: Juerg Otter"

To get an idea what doesn’t work, you can have a look at what’s going on with the shellscript-output: add this at the end of the PostBuild script:

Print sShellResult

one other thing i failed to mention is that the background pictures need to be 72DPI.
i’ll add that as a comment in the example project sooner or later.

My bad: I did not include “Developer ID Application:”
Thank you.

I’ve updated the example Xojo project «Xojo2DMG v0.9.3» with a minor tweak in the Shell script. The issue fixed is: The DMG’s Volume Icon is now assigned properly if building on macOS High Sierra.

Hi Jürg,

thank you for the sharing.

Unfortunately, I failed to download the example.

Any hint ?

No issues here…

“failed” can mean anything and nothing. so no, I don’t have any idea (what you’re seeing, what the issue you’re having might be) :slight_smile:
One idea though: Use a different Browser at some later time?

Where do I find this line? It’s not in the script. Or how do I add my certificate info and where?

Otherwise this works very well in building the .dmg.

Build Settings -> macOS: Postbuild-Script “Xojo2DMGscript”.
You see it in the last code-line in this Screenshot:

Yes, sorry, just found it and update it. Now I’m getting this error:

Xojo2DMG ERROR: codesign -d -vvvv "/Users/dm/Desktop/Xojo 2 DMG/Builds - Xojo_2_DMG.xojo_binary_project/OS X 64 bit/DMG_Template/Xojo 2 DMG.app" failed. Xojo2DMG: There's something wrong with CodeSign.

That’s the fun part (see your other tread) - to figure out why CodeSign works or doesn’t.
This error/message informs you that the CodeSign-validation isn’t ok. So CodeSigning did fail. Why? I don’t know :slight_smile:

You can try to look at the shell-result: add this somewhere at the bottom of the PostBuildScript (after the shell-script has been called):

Print sShellResult

Or modify the shell-script, and write the code-signing commands to a textfile, so that you look it up and can try in Terminal to see what happens.

Maybe it’s that “locked Keychain” issue. Then you can try to fill in the other variables after the sCODESIGN_IDENT which you’ve modified already.

Sorry again, didn’t have it right. I forgot this part "Developer ID Application: ".

This is awesome. Works good for my purpose. Thanks so much for sharing this.

In xojo2.html, I clicked in the Download button that displays another window, I typed my name in the asked field, then click in Downloads and go to xojo.html web page.

That what I meant by “failed”. If you prefer, I was not able to download the project because I do not found how to do that.
(Maybe a glass change have to be done ?)

I don’t know why - there’s no opening of new browser windows here, and the download button works on all my systems and browsers. Anyway, I’ve sent you a direct link via PN.

Thanks for the feedback. I’m happy if this example helps others - either as a “solution that is working ‘out of the box’”, or as a template to dig into things and modify it for your own needs.
There’s quite a mixture of Scripts in there, so a chance to discover something new.

The goal has been to not having to modify the shell script that does all the heavy lifting when it’s being used in different Xojo projects. All the variables can be set in the Xojo’s (project specific) PostBuildScript.

You’re welcome :slight_smile:

Thanks Jürg.