How to app distribution for Mac

Lemme start by pointing you at my Signing a Mac Product For Distribution post. This should answer a bunch of your questions. If you still can’t get this working, post back with details about where you got stuck.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

In future, it’d help if you posted long replies as replies. The comment box is best reserved for… well… comments.

Then, to check if the gatekeeper is affected

I recommend against using spctl for checking for Gatekeeper compatibility. Rather, use the process described in Testing a Notarised Product.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Feel free to ignore the comments I left above. The case is an error with the extension app, and it is considered normal, not an error with the actual app.

I also encountered the following problem: I've read all the documentation to fix the issue, but I can't confirm any idea why this is happening?

Case 1

I had an existing Apple Development signed app for distribution.

Command : codesign -dvvv --entitlements - /Users/MyUserID/Desktop/release/SystemExtensions.app

Command : codesign -dvvv --entitlements - /Users/MyUserID/Desktop/release/SystemExtensions.app/Contents/Library/SystemExtensions/My.Domain.SystemExtensions.Extension.systemextension

Command : security cms -D -i /Users/MyUserID/Desktop/release/SystemExtensions.app/Contents/embedded.provisionprofile

Command : security cms -D -i /Users/MyUserID/Desktop/release/SystemExtensions.app/Contents/Library/SystemExtensions/My.Domain.SystemExtensions.Extension.systemextension/Contents/embedded.provisionprofile

However, in order to distribute the app, as mentioned above, you must sign with Developer ID Applications to avoid being blocked by the gatekeeper. Therefore, I re-signed, and the result of code signing is as follows.

Command : codesign -s "Developer ID Application: My Team (Team_id)" --options=runtime --force /Users/MyUserID/Desktop/release/SystemExtensions.app/Contents/Library/SystemExtensions/My.Domain.SystemExtensions.Extension.systemextension

Command : codesign -s "Developer ID Application: My Team (Team_id)" --options=runtime --force /Users/MyUserID/Desktop/release/SystemExtensions.app

Command : codesign -dvvv --entitlements - /Users/MyUserID/Desktop/release/SystemExtensions.app

Command : codesign -dvvv --entitlements - /Users/MyUserID/Desktop/release/SystemExtensions.app/Contents/Library/SystemExtensions/My.Domain.SystemExtensions.Extension.systemextension

embedded.provisionprofile properties are the same as before sign.

And when I run the app, the following error occurs. Also, the square red box is the log being taken by my app. What could be causing this error? Was it my fault?

=======================================================================================

Case 2

As I saw in Case 1, the entitlement property before and after signing is different, so when re-signing, I put the --preserve-metadata=entitlements option to bring the entitlement property as it is.

Command : codesign -dvvv --entitlements - /Users/MyUserID/Desktop/release/SystemExtensions.app

Command : codesign -dvvv --entitlements - /Users/MyUserID/Desktop/release/SystemExtensions.app/Contents/Library/SystemExtensions/My.Domain.SystemExtensions.Extension.systemextension

Command : security cms -D -i /Users/MyUserID/Desktop/release/SystemExtensions.app/Contents/embedded.provisionprofile

Command : security cms -D -i /Users/MyUserID/Desktop/release/SystemExtensions.app/Contents/Library/SystemExtensions/My.Domain.SystemExtensions.Extension.systemextension/Contents/embedded.provisionprofile

Command : codesign --preserve-metadata=entitlements --force --verbose -s "Developer ID Application: My Team (Team_id)" --options=runtime --force /Users/MyUserID/Desktop/release/SystemExtensions.app/Contents/Library/SystemExtensions/My.Domain.SystemExtensions.Extension.systemextension

Command : codesign --preserve-metadata=entitlements --force --verbose -s "Developer ID Application: My Team (Team_id)" --options=runtime --force /Users/MyUserID/Desktop/release/SystemExtensions.app

After that, if you check the information, you can see that everything is normal as shown below.

Command : codesign -dvvv --entitlements - /Users/MyUserID/Desktop/release/SystemExtensions.app

Command : codesign -dvvv --entitlements - /Users/MyUserID/Desktop/release/SystemExtensions.app/Contents/Library/SystemExtensions/My.Domain.SystemExtensions.Extension.systemextension

embedded.provisionprofile properties are the same as before sign.

Then, when you run it, an error different from Case1 is displayed as shown below.

Please don’t post screen shots of things that are fundamentally textual, like Terminal transcripts and log files. This causes a bunch of problems:

• I struggle to read some of your screen shots, particularly the wider ones.

• I can’t copy’n’paste from them.

• I can’t search the text.

It’s better to post text in one of two ways:

• For short stuff, use a code block — Click the Code Block button to get this.

• For long stuff, use a text attachment — Click the paperclip icon and then Add Text.

Also, if you redact things, use the process described in Posting a Crash Report; it makes it easier for me to check that the various strings line up correctly.

With regards case 1, you wrote:

However, in order to distribute the app, as mentioned above, you must sign with Developer ID Applications to avoid being blocked by the gatekeeper. Therefore, I re-signed, and the result of code signing is as follows.

Your re-signing process seems to have dropped the entitlements, but it seems you’ve figured that out already (-:

With regards case 2, I think the issue relates to this:

I had an existing Apple Development signed app for distribution.

and this:

embedded.provisionprofile properties are the same as before sign.

Apple Development and Developer ID signing need different provisioning profiles. See What exactly is a provisioning profile? for an explanation of why.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

In order to sign using your Developer ID, you need to create a provisioning file for it, right?

Naturally, I proceeded as follows to create a custom provisioning on the developer site with the provisioning file.

MAC PC Create .CSR

Generate certificate Account -> Certificates, Identifiers & Profiles -> Certificates -> Add -> Option: Software(Developer ID Application) -> Attach and create .CSR created on MAC PC

Create provisioning file Account -> Certificates, Identifiers & Profiles -> Profile -> Add -> Option: Distribution(Developer ID) -> Enter the Bundle ID and the following screen will be displayed.

I created the certificate, but it says it doesn't exist. Why is this?

Also, my MAC PC logged in is not the owner id of the Apple Developer site and I have the admin role in it.

In other words Apple Developer Site Account: A My MAC login account: B

I've been trying a lot to fix the issue where the certificate is not showing up and I've been to a lot of sites. Also, it turns out that other people besides me also have this problem.

https://stackoverflow.com/questions/71100475/macos-unable-to-create-provisioning-profile-to-distribute-outside-the-mac-app

In order to sign using your Developer ID, you need to create a provisioning file for it, right?

That depends. Developer ID signed code only needs a provisioning profile if it uses an entitlement that must be allowed by that profile. The Entitlements on the Mac section of What exactly is a provisioning profile? explains this.

MAC PC Create .CSR

I was under the impression you already had a Developer ID signing identity. If so, creating a second one should not be required and can cause problems. See my posts on this thread for more background.

With regards the “No Certificates are available”

I’ve also seen that before. Oh, wait, it was your thread!

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Yep that's right I asked the same question.

But the problem still occurs. I've tried it as an account owner and as an administrator, but they all have the same symptoms.