DEV Community: ..

Signing an xOS App for another Apple Developer Account

.. — Thu, 31 Mar 2022 02:59:31 +0000

There are situations when an app is developed by Bob using his Apple Developer account but the app is published with Alice's Apple Developer account. In this case Bob shares the app archive to Alice for distribution. This post shows how, with Xcode, Bob prepares an archive for Alice and how Alice prepares for distribution.

Version: Xcode 12.4, macOS 10.15.7

Bob Archives His App

Disable Automatic Signing

Disabling automatic signing generates an archive which does not contain provisioning profile and certificate information. Failing to do so will prevent signing the archive with a different Apple Developer account.

To disable automatic signing, choose the (1) project name at the top of the Project Navigator, choose the (2) Target (if there are more than one target), navigate to the (3) Signing & Capabilities tab, then disable the (4) Automatically manage signing checkbox.

Compress archive

Bob now needs to compress the archive into a zip file to share with Alice. To locate the archive file, right-click on the archive and choose Show in Finder.

The Finder window launches showing the .xcarchive. Right-click on the xcarchive then choose Compress file.xcarchive to create a zip file with the archive inside.

Bob sends the zip file to Alice for distribution.

Alice Signs the App for Distribution

Uncompress and Open the Archive

Alice uncompresses the zip file by double-clicking the file. The xcarchive will be in the same folder as the zip file. Double-click the xcarchive to open the archive in the Organizer.

Preparing for Distribution

Check that the file does not contain signing information as described in the Archive section. Then click on the Distribute App button to start the distribution process.

The next steps are not shown as it will depend on the distribution target. If the app is a macOS app, you may refer to Distributing a macOS App Outside the Mac App Store if this is your preferred distribution method.

Distributing a macOS App Outside the Mac App Store

.. — Tue, 29 Mar 2022 09:40:43 +0000

This post covers publishing of macOS applications outside the Mac App Store. The different distribution methods are described by Apple. At this point it is assumed that the decision has been made to distribute outside the App Store. Distributing installers is not covered however the steps are fundamentally the same.

Version: Xcode 12.4, macOS 10.15.7

Requirements

Before beginning the app export process, ensure the following are installed and present.

Xcode 10.2 or later

Although Xcode 10 will work, Xcode adds the secure timestamp from Xcode 10.2.

Apple ID

To enable automatic signing, Xcode needs to connect to the Developer portal with an Apple ID registered to a Developer account. Your Apple ID must be registered to the same Developer account where the Developer ID came from. This post describes how to check if your Apple ID is setup correctly.

Developer ID certificate

The Developer ID private key must be installed on your Mac keychain.

Apple describes a Developer ID certificate as...

A Developer ID certificate lets Gatekeeper verify that you’re a trusted developer when a user opens your app, plug-in, or installer package downloaded from outside the Mac App Store.

Only an Account Holder can generate a Developer ID certificate. Once the certificate is generated and the private key exported from the Account Holder's keychain, the exported key (with a .p12 extension) can be installed on any Mac machine.

You can check if you have a Developer ID certificate in your keychain by running the following command from the Terminal.



$ security find-certificate -c "Developer ID Application"

Deployment Target

Notarization only works for binaries linked against macOS 10.9 or later. Set your Xcode project's Deployment Target to at least 10.9

Archiving

When you are ready to distribute your app, the first step is to archive the application.

From the Xcode menu, choose Product > Archive. The Organizer window launches showing the archive. You are now ready for the next step: notarization.

Notarization

Apple describes notarization as...

Notarization gives users more confidence that the Developer ID-signed software you distribute has been checked by Apple for malicious components. Notarization is not App Review. The Apple notary service is an automated system that scans your software for malicious content, checks for code-signing issues, and returns the results to you quickly. If there are no issues, the notary service generates a ticket for you to staple to your software; the notary service also publishes that ticket online where Gatekeeper can find it.

Start Distribution

From the Organizer, click on the Distribute App button to start the distribution process.

Destination

Though there is an option to export without notarizing, always choose to notarize as notarization enables automated scans of your app. Choose Upload in the destination window.

Signing Option

Choose Automatically manage signing in the signing options window.

Review package content

If the Summary and Entitlements are as expected, click Upload to upload the app to Apple's notarization service.

Upload Complete

You can monitor the upload progress as shown.

Once the upload is complete, wait for Apple's notification.

Notarization Complete

You will receive a notification and an email to your Apple ID once the notarization is complete. For this post, notarization only took about 30 mins.

Export Notarized App

From the Organizer, choose the archive, and scroll down. If the Organizer is closed, open it from the Xcode menu. Choose Window > Organizer.

Click on Export Notarized App to save the app to your chosen location.

You now have an app that can be distributed outside the Mac App Store.

Verification

Verifying if an app is notarized

Verifying notarization is not a mandatory step after exporting a notarized app. It can be useful when you have an app or installer package and you want to know if it is notarized. The post on How to Check if a macOS App is Notarized describes the verification steps.

References

If you have questions or issues with notarization, Apple's references is a good starting point for investigation.

How to Check if a macOS App is Notarized

.. — Tue, 29 Mar 2022 08:31:44 +0000

Version: macOS 10.15.7

You can check if a macOS application is notarized by using the spctl command-line utility. spctl evaluates if the system allows execution, installation, and other operations on files.

The first example is an app that is not notarized. spctl shows the status as rejected and the source indicates Unnotarized Developer ID.

$ spctl -a -vvv -t install MacApp.app
MacApp.app: rejected
source=Unnotarized Developer ID
origin=Developer ID Application: <redacted developer account>

The second example is a notarized app. spctl shows the status as accepted.

$ spctl -a -vvv -t install Project1.app
Project1.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: <redacted developer account>

The table below describes the spctl options.

Option	Description
`-a`	Stands for assess and requests `spctl` to perform an assessment of the given file.
`-vvv`	Specifies increased output verbosity.
`-t install`	Specifies the type of assessment. `install` assesses installation.

How to Check an Apple ID is Registered to a Developer Account

.. — Mon, 28 Mar 2022 13:04:43 +0000

This post is valid for an organization that is a member of the Apple Developer Program.

Registration to an Apple Developer account and having the Developer role is required when using automatic signing in XCode.

Checking Accounts

To check, launch Xcode. From the menu items, click Xcode > Preferences and choose the Accounts tab.

Your Apple ID is registered to a developer account if the Team shows the correct Apple Developer account and the Role is Developer.

Assigning Developer Role

To assign a user to the Developer role, sign-in to App Store Connect. Only an Apple ID with Account Holder or Admin role can edit a user's role.

In App Store Connect, navigate to Users and Access and choose the user's Apple ID. Under Roles, tick Developer and under Additional Resources, enable Access to Certificates, Identifiers & Profiles.