undefined | Better HN

0 pointsa_t4812h ago0 comments

Maybe I'm too dumb, but I haven't figured out a good way to sign just a binary (or a tar/zip containing a few binaries). I zipped up the binaries, sent them off to Apple, Apple comes back and says "yup, notarized!", and they still trigger the popup. I'm probably missing a step. I guess I'm not currently stapling the ticket to the binary, but supposedly you don't have to if you are running with a network connection.

0 comments

mixologic5h ago

Theres two different steps, there is signing and there is notarization. You sign with the developer certificate using productsign/codesign, and then there is notarization, which you use notarytool to submit your signed binaray to apple to notarize.

finally you then take their response and staple it to your binary. Its a lot of steps.

a_t48OP4h ago

Yup I do the first two - https://github.com/zig-for/snfm/blob/main/.github/workflows/...

The documentation implies the last step is optional https://developer.apple.com/documentation/security/customizi... but it might be inaccurate

pjc5012h ago

You have to distribute a "bundle" in a particular directory layout.

novok11h ago

you need to pay the tax, they are doing the 'pay money to reduce spam' solution

a_t48OP11h ago

This was with payment to Apple

j / k navigate · click thread line to collapse