85 lines
4.4 KiB
Markdown
85 lines
4.4 KiB
Markdown
# MacOS packaging and distribution
|
|
|
|
We distribute the application as a zipped [MacOS app bundle](https://developer.apple.com/library/archive/documentation/CoreFoundation/Conceptual/CFBundles/BundleTypes/BundleTypes.html#//apple_ref/doc/uid/10000123i-CH101-SW5).
|
|
|
|
## Notes on codesigning and notarization
|
|
|
|
Running a binary on a Mac that was not both codesigned **and** notarized by Apple is a pain. The
|
|
user needs to run it. Get an error message. Go to System preferences > Security > authorize the app.
|
|
Then try again, and finally be presented a button to open the app.
|
|
|
|
In order to avoid that, we've started distributing codesigned binaries starting from version 1.0.
|
|
This is the notes i've taken describing the stepped involved in codesigning the produced macOS
|
|
binary on a Linux machine, for posterity. This is not cleaned up.
|
|
|
|
### Bulk notes from the codesigning experiment
|
|
|
|
Create an account at https://developer.apple.com.
|
|
|
|
Pay to get into the developer program. Going the organization way is cumbersome. Go the personal
|
|
way. They'll ask for a KYC (gov ID). Wait to be accepted.
|
|
|
|
Go to "certificates, ids and profiles". Create a new certificate. Select a Developer ID application
|
|
certificate to distribute apps outside of the store.
|
|
|
|
(We should look into the installer feature later on. Maybe we could bundle a bitcoind there.)
|
|
|
|
They ask for a "Certificate Signing Request (CSR)" that you need to generate on your Mac. I don't
|
|
have a Mac. Generate it using OpenSSL:
|
|
```
|
|
openssl genrsa -out wizardsardine_liana.key 2048
|
|
openssl req -new -sha256 -key wizardsardine_liana.key -out wizardsardine_liana_codesigning.csr -subj "/emailAddress=antoine@wizardsardine.com, CN=Antoine Poinsot, C=FR"
|
|
```
|
|
(Note you have no choice in the size or type of the key here, they expect a RSA(2048) key.)
|
|
|
|
For the profile type select "G2 Sub-CA". We are using an Xcode newer than 11.4.1 and the codesigning
|
|
tool we use supports the new CA.
|
|
|
|
Now you get to be able to download your certificate (I've stored it as
|
|
"antoine_devid_liana_codesigning.cer"). Thankfully `rcodesign` supports various certificate format,
|
|
so we don't even have to convert it to PEM.
|
|
|
|
Download `rcodesign`:
|
|
```
|
|
curl -OL https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign%2F0.22.0/apple-codesign-0.22.0-x86_64-unknown-linux-musl.tar.gz
|
|
tar -xzf apple-codesign-0.22.0-x86_64-unknown-linux-musl.tar.gz
|
|
./apple-codesign-0.22.0-x86_64-unknown-linux-musl/rcodesign --help
|
|
```
|
|
|
|
Sign the packaged application using the `sign` command (mind `--code-signature-flags for the
|
|
necessary hardened runtime):
|
|
```
|
|
./apple-codesign-0.22.0-x86_64-unknown-linux-musl/rcodesign sign --code-signature-flags runtime --pem-source wizardsardine_liana.key --der-source antoine_devid_liana_codesigning.cer Liana.app
|
|
```
|
|
You can see the chain of certificates was applied using the `diff-signatures` command against
|
|
another bundle. The best way to verify the signature is by using the `codesign` command on a Mac.
|
|
|
|
Finally, we need to notarize the app. Follow the instructions at
|
|
https://gregoryszorc.com/docs/apple-codesign/main/apple_codesign_rcodesign.html#notarizing-and-stapling:
|
|
- Create an API key from https://appstoreconnect.apple.com/ (and *not* a key from
|
|
https://developer.apple.com/account/resources/authkeys)
|
|
- Download it and encode it into a JSON file using the `encode-app-store-connect-api-key` command
|
|
- Use the `notary-submit` command to request notarization
|
|
|
|
```
|
|
./apple-codesign-0.22.0-x86_64-unknown-linux-musl/rcodesign notary-submit --max-wait-seconds 600 --api-key-path ./encoded_appstore_api_key.json --staple Liana.app
|
|
```
|
|
According to
|
|
https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/customizing_the_notarization_workflow#3087732
|
|
this can take up to a hour. I've experienced more. You can see the status of an existing request
|
|
using the `notary-log` command.
|
|
|
|
|
|
-------
|
|
|
|
Resources:
|
|
- https://gist.github.com/jcward/d08b33fc3e6c5f90c18437956e5ccc35
|
|
- https://github.com/achow101/signapple
|
|
- https://developer.apple.com/library/archive/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS40007919
|
|
- https://gregoryszorc.com/docs/apple-codesign/main/index.html
|
|
- https://www.apple.com/certificateauthority/
|
|
- https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution
|
|
|
|
Resources on packaging an application for MacOS:
|
|
- https://developer.apple.com/library/archive/documentation/CoreFoundation/Conceptual/CFBundles/BundleTypes/BundleTypes.html#//apple_ref/doc/uid/10000123i-CH101-SW5
|