Notarize a .zip file

user_5136425 0
Viewed 620

I am trying to write a script to notarize an app for distribution outside the Mac App Store. I have (in the past) successfully notarized a .dmg but for some reason I am running into trouble with a .zip file. The error I am receiving in the log file from notarization is that there is no code signature present.

So here is my notarization code:

cd app && zip MyZip.zip Test.app
cd -

xcrun altool --notarize-app \
   --file "app/Myzip.zip" \
   --username "abcabcabc" \
   --password "abcabcabc" \
   --asc-provider "abcabcabc" \
   --primary-bundle-id "a.b.c.com"

When I check to verify the code signature on the Test.app, it appears to be fine:

codesign -vvv --deep --strict app/Test.app
app/Test.app: valid on disk
app/Test.app: satisfies its Designated Requirement

Running the same on the .zip file--as expected, returns an error:

codesign -vvv --deep --strict app/MyZip.zip
app/MyZip.zip: code object is not signed at all

Which is correct, as I did not sign the zip file. However, when I read other people's experiences, they seem to talk about uploading .zip files for notarization as if there is no problem (for example, steps 2 and 3 here: What is the most efficient way to notarize and staple a .zip containing a .app?). Has something changed since 2019--do I now need to manually use the codesign tool to sign my zip file using the same identity that the app is signed with? I even tried the following, as requested by Apple in the documentation (https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/customizing_the_notarization_workflow):

/usr/bin/ditto -c -k --keepParent "app/Test.app" "app/MyZip.zip"

but running codesign -vvv --deep --strict app/MyZip.zip still returns code object is not signed at all.

Do I need to custom code sign? Or is there a way to zip it but somehow preserve the codesign signature? Thank you.

codesign macos
1 Answers

This works for me (just tested):

codesign --force \ 
   --timestamp \
   --options runtime \ 
   --sign "Developer ID Application: <USER> (<TEAMID>)" project1.app

zip -r test.zip project1.app

xcrun altool --notarize-app \
   --primary-bundle-id "com.company.project1" \
   -u "<EMAIL>" \
   -p "<PWD>" \ 
   -t osx \
   -f test.zip

As to what has changed since 2019: On 3 September 2019 Apple announced that until January 2020 developers could get new versions of applications notarized even though they were not hardened or fully compliant with the normal requirements. That deadline was later extended to 3 February 2020. After that, you need to meet all the prerequisites:

  • Enable code-signing for all of the executables you distribute.
  • Enable the Hardened Runtime capability for your application and command line targets.
  • Use a “Developer ID” application, kernel extension, or installer certificate for your code-signing signature.
  • Include a secure timestamp with your code-signing signature
  • Don’t include the com.apple.security.get-task-allow entitlement with the value set to any variation of true.
  • Link against the macOS 10.9 or later SDK.
user_68206970
Related