121–130 of 214 posts
Earlier quoted context omitted.
I'm fairly certain that you just need to codesign --deep here, as that's all I've ever done.
That seems to work if you put the entire Python stdlib under Frameworks but not if it's somewhere else. I do the `find` thing because I pre-sign my libraries when I build them to save a bit of time during app build.
Earlier quoted context omitted.
That seems to work if you put the entire Python stdlib under Frameworks but not if it's somewhere else. I do the `find` thing because I pre-sign my libraries when I build them to save a bit of time during app build.
Hmmm, interesting - if nothing else hopefully this comment exchange helps some wayward developer down the road!
Earlier quoted context omitted.
It depends on what you work on. Of course if you work with iOS development your surroundings will be mostly macOS machines since it's a hard requirement, no surprises here hence my comment about bubbles. Otherwise statistically speaking, macs are not the default developer machine as per surveys. It also depends on who you admire. For example Linus, someone I admire, uses a AMD Threadripper 3970x. And the best enginee…
> It depends on what you work on. Of course if you work with iOS development your surroundings will be mostly macOS machines since it's a hard requirement, no surprises here hence my comment about bubbles. Otherwise statistically speaking, macs are not the default developer machine as per surveys. Again, I didn't framed it as default machine, that comes from the comment I was responding to. Personally, I probably wou…
My advice from years of notarizing my apps is to make sure you do it at least once per day for each of your apps. If you only notarize once every release (say, every month or so), you are almost guaranteed to encounter some new cryptic error that you've never seen before, either due to some glitch in signing your app or frameworks, or else some server-side error such as new terms & conditions that you are being "enco…
I auto notarize my app when I push to a release-candidate branch even if I don't deploy it. I also have a general code signing CI test that catches stuff before notarization would. I believe I've never, in thousands of pushes to this branch, hit a non-obvious notarization issue. The main annoying thing so far for me using notarization long term is the terms and conditions signing step, which is silly because they're…
If you're going to rant about details, it helps to actually get the details right. For example, showing a screenshot that doesn't contain the word "malware" and then saying: > Using my application name and the word "malware" in one sentence is suggestive and extremely offensive by Apple. Does not fill me with much hope that the author is detail-oriented. I'll keep reading, and I know already that the notarizing proce…
I had the same initial reaction about misquoting. However, Apple also uses dialog boxes that use the word "malware", specifically: "macOS cannot verify that this app is free from malware." See screenshots at https://support.apple.com/en-us/HT202491
Earlier quoted context omitted.
In python there are a handful of .so files in subdirectories you need to sign. You can basically `find . -name \*.dylib -o -name \*.so` and codesign those.
I'm fairly certain that you just need to codesign --deep here, as that's all I've ever done.
I'm polishing up a macOS app for the store. How much time should I expect to budget for the initial signing/notarizing/submission process?
Earlier quoted context omitted.
I auto notarize my app when I push to a release-candidate branch even if I don't deploy it. I also have a general code signing CI test that catches stuff before notarization would. I believe I've never, in thousands of pushes to this branch, hit a non-obvious notarization issue. The main annoying thing so far for me using notarization long term is the terms and conditions signing step, which is silly because they're…
Smoke-testing your code signing is a good idea, and would probably catch most notarization issues. Aside from those, through, I've encountered numerous issues with embedded frameworks and app extensions whose error reporting wouldn't be described as obvious. Catching those right away rather than right before you are trying to deploy a release is critical.
My app layout is fairly complicated, so I'm sure I'm exercising a lot of the corner cases: https://news.ycombinator.com/item?id=26996223
I check that executables don't depend on libraries from outside the app, I check that I successfully shipped everything as universal2, and I check for stuff like .DS_Store and vim .swp files.
Here's my final stage check script, which staples notarization and checks the stapled dmg at the end as well: https://gist.github.com/lunixbochs/3d5eaf04e789932f8a19ca0fc...
I shared notary.sh in another comment: https://news.ycombinator.com/item?id=26996457
Earlier quoted context omitted.
I'm fairly certain that you just need to codesign --deep here, as that's all I've ever done.
Don’t use codesign --deep, it’s mostly broken. Sign manually from the inside out.
I'm polishing up a macOS app for the store. How much time should I expect to budget for the initial signing/notarizing/submission process?
What kind of app is it? If it’s a new app that you wrote in Xcode, all Objective-C and Swift, and not much customization, then not all that long.