5

This question is prompted by the new Notarization requirements that Apple will enforce for Mac Apps distributed outside of the Mac App Store targeting Mojave (in the near future.)

I maintain a suite of self-hosted, Developer ID Application certificate-signed apps, using a custom runtime (Excelsior JET for Mac Java JIT Compiler / Runtime); custom bash scripts (are used as part of the apps in the installation process) and automate the builds. Therefore, there are no XCod` projects per-se involved in this process.

After consulting the developer docs, I wasn't able to find a way to activate and customize this "hardened mode" (described here) by using any kind utilities from XCode, but from the CLI (instead of the IDE GUI). Is there any way to accomplish this?

Improve this question
3
  • 1
    Should we assume you do not have services as part of a paid Apple developer or a business relationship with Apple? I don’t want to suggest working with a team if you’re solo.
    – bmike ♦
    Commented Apr 22, 2019 at 17:29
  • The best I can answer this is: I am "the guy that handles all desktop builds". We do have an Apple Developer Account as a company, but my colleagues handling the iOS development & builds use the Apple tools as they come. Since I deal with Java bytecode which becomes a native executable through a custom Java compiler that is then packaged and signed with our Developer ID (purchased from Apple through the aforementioned program), I don't use XCode. IOW, we pay our dues, and I'm paid to make sure the Java-based apps become well-behaving Mac apps.
    – elder elder
    Commented Apr 22, 2019 at 18:17
  • Sorry, obviously the compiler is not packaged...bad edit on my part.
    – elder elder
    Commented Apr 22, 2019 at 18:24

3 Answers 3

Reset to default
4

Are you looking for codesign's --options runtime argument? I believe that's all you need to enable the hardened runtime.

Apple has a couple of documents that make it pretty easy to figure out your own notarization flow:

Improve this answer
1
  • Yes, @seph. Thank you - I have found in the mean time this to be the answer I was looking for (reason why I provided my own below). Upvoted anyway.
    – elder elder
    Commented Feb 12, 2020 at 16:11
2

This is documented by Apple for using the command line tools xcode-select, xcrun and altool

sudo xcode-select -s /path/to/Xcode10.app

xcrun altool --notarize-app --primary-bundle-id "com.example.ote.zip" --username "AC_USERNAME" --password "@keychain:AC_PASSWORD" --file OvernightTextEditor_11.6.8.zip

So you should be able to incorporate this into whatever packaging or CI tools you use. We’ll be using this heavily at work as we start to dig into how we’ll need to notarize our various DIY toolsets and scripts.

This doesn’t exactly cover the hardening / entitlements, but I expect you’ll get JSON back from the notarization request that helps you craft the correct plist for your exceptions to the general hardening that is applied when the OS runs a notarized app.

Improve this answer
4
  • 1
    If I’m wrong on the assumption that hardening happens for all notarized assets, I’ll make an edit if needed. My initial impression is that Xcode uses the “harden” to let Xcode know to make the altool request to notarize - not that it builds anything differently as a result of that flag.
    – bmike ♦
    Commented Apr 22, 2019 at 17:51
  • Thank you, I'll need to test this, before voting it as an answer (which may take a little while, as I'm overhauling my setup). I found that article, but I was very confused about the hardening per-se. As for the plist you mention...would that be the app bundle's Info.plist, and these: developer.apple.com/documentation/security/… the keys?
    – elder elder
    Commented Apr 22, 2019 at 18:05
  • 1
    It seems like the "runtime" (as an option per-se) comes into play at codesign time:stackoverflow.com/questions/53112078/… stackoverflow.com/questions/53101626/…
    – elder elder
    Commented Apr 23, 2019 at 14:38
  • 1
    Just attempting to notarize does nothing to enable the hardened runtime. In fact, attempting to notarize just points out the fact that you haven't enabled the hardened runtime as you get a failed notarization (Status: invalid) and with the log stating { "severity": "error", "code": null, "path": "app.zip/app.app/Contents/MacOS/applet", "message": "The executable does not have the hardened runtime enabled.", "docUrl": null, "architecture": "x86_64" },
    – ThatOneDude
    Commented Jul 23, 2019 at 19:00
2

I have several executables in my app. Hardening takes place when all of them are signed with the --options runtime. In the end, of course, I sign the app bundle itself the same way (see the links I provided in my last comment above).

Improve this answer
4
  • Comments should be assumed to be deleted also answers should be understandable without links. Links are just used to provide sources or more detail in your answer
    – mmmmmm
    Commented Jun 3, 2019 at 20:32
  • @Mark: With all due respect, I am somewhat confused and hope you can clarify, so that I will avoid such mistakes in the future. Should I assume that I will delete my own comment, regardless of having no intention to do so? Also, what exactly in my answer seems to be lacking, as I provided the required flag and the context of its use (signing)? The link does provide a source that details the full command involving said flag.
    – elder elder
    Commented Aug 1, 2019 at 16:04
  • You are moderators could delete comments they are not ment to be kept. They are meant to clarify Q or A so that the answer ort question is edited with the new information.
    – mmmmmm
    Commented Aug 1, 2019 at 17:09
  • 1
    The comment has gone so I can't see why I made the comment re links.
    – mmmmmm
    Commented Aug 1, 2019 at 17:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .