User Profile

Posts

Posts

Post not yet marked as solved
0 Replies
1.7k Views

syspolicyd network request to apple-cloudkit.com on app/command line tool first launch

Hello,(This is based on a recent long thread on Hacker News about developers experiencing sluggishness running command line tools in latest versions of macOS.)When I create a new executable locally (for example, a one-liner shell-script or a C program), the first execution even from Terminal causes a network request by syspolicyd to apple-cloudkit.com.The posts below appear to suggest that Gatekeeper shouldn't be firing unless I am running a downloaded item marked with the quarantine xattr, and even then only from Finder.https://forums.developer.apple.com/thread/127709https://forums.developer.apple.com/thread/127694There was discussion if this network hit is expected behavior. How can we disable it for local, non-end user distributed binaries? Is the behavior notarization-specific, or something entirely different like XProtect?Thank youDavid
Posted
by dvar.
Last updated
.
Post marked as solved
2 Replies
325 Views

Notarization of .app bundles enclosed in disk images/installer packages

Hello,I am the author of xcnotary, an open source tool to help developers automate their notarization workflow. I wanted to clarify the following behavior to make sure I'm providing users with correct instructions.I can see that the notarization service inspects the content inside .pkg/.dmg submissions. For example, if I attempt to notarize a signed package containing an improperly signed .app bundle, the service correctly fails.The service does also appear to notarize the enclosed bundle (checked using "spctl -a -t exec -v"). However, the bundle isn't stapled, and so would need a network request on the first run (checked using stapler validate -v with network turned off.)My question is: what is the general "contract" the notarization service expects to provide:Will it always notarize enclosed bundles?Is it expected that it won't be stapling them?If so, in the interest of shipping bundles that are already stapled, should the build process always be two-step as follows?Notarize and staple the .app bundle.Package it into a container (.dmg/.pkg), and then notarize and staple that container.Thank you,David
Posted
by dvar.
Last updated
.