2

This question is prompted by the new Notarization requirements that Apple will enforce for Mac Apps distributed outside of the Mac App Store targeting Mojave (in the near future.)

I maintain a suite of self-hosted, Developer ID Application certificate-signed apps, using a custom runtime (Excelsior JET for Mac Java JIT Compiler / Runtime); custom bash scripts (are used as part of the apps in the installation process) and automate the builds. Therefore, there are no XCod` projects per-se involved in this process.

After consulting the developer docs, I wasn't able to find a way to activate and customize this "hardened mode" (described here) by using any kind utilities from XCode, but from the CLI (instead of the IDE GUI). Is there any way to accomplish this?

  • 1
    Should we assume you do not have services as part of a paid Apple developer or a business relationship with Apple? I don’t want to suggest working with a team if you’re solo. – bmike Apr 22 at 17:29
  • The best I can answer this is: I am "the guy that handles all desktop builds". We do have an Apple Developer Account as a company, but my colleagues handling the iOS development & builds use the Apple tools as they come. Since I deal with Java bytecode which becomes a native executable through a custom Java compiler that is then packaged and signed with our Developer ID (purchased from Apple through the aforementioned program), I don't use XCode. IOW, we pay our dues, and I'm paid to make sure the Java-based apps become well-behaving Mac apps. – elder elder Apr 22 at 18:17
  • Sorry, obviously the compiler is not packaged...bad edit on my part. – elder elder Apr 22 at 18:24
2

This is documented by Apple for using the command line tools xcode-select, xcrun and altool

sudo xcode-select -s /path/to/Xcode10.app

xcrun altool --notarize-app --primary-bundle-id "com.example.ote.zip" --username "AC_USERNAME" --password "@keychain:AC_PASSWORD" --file OvernightTextEditor_11.6.8.zip

So you should be able to incorporate this into whatever packaging or CI tools you use. We’ll be using this heavily at work as we start to dig into how we’ll need to notarize our various DIY toolsets and scripts.

This doesn’t exactly cover the hardening / entitlements, but I expect you’ll get JSON back from the notarization request that helps you craft the correct plist for your exceptions to the general hardening that is applied when the OS runs a notarized app.

  • 1
    If I’m wrong on the assumption that hardening happens for all notarized assets, I’ll make an edit if needed. My initial impression is that Xcode uses the “harden” to let Xcode know to make the altool request to notarize - not that it builds anything differently as a result of that flag. – bmike Apr 22 at 17:51
  • Thank you, I'll need to test this, before voting it as an answer (which may take a little while, as I'm overhauling my setup). I found that article, but I was very confused about the hardening per-se. As for the plist you mention...would that be the app bundle's Info.plist, and these: developer.apple.com/documentation/security/… the keys? – elder elder Apr 22 at 18:05
  • It seems like the "runtime" (as an option per-se) comes into play at codesign time:stackoverflow.com/questions/53112078/… stackoverflow.com/questions/53101626/… – elder elder Apr 23 at 14:38
-1

I have several executables in my app. Hardening takes place when all of them are signed with the --options runtime. In the end, of course, I sign the app bundle itself the same way (see the links I provided in my last comment above).

  • Comments should be assumed to be deleted also answers should be understandable without links. Links are just used to provide sources or more detail in your answer – Mark Jun 3 at 20:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .