xcrun altool (What does these arguments mean?)

The Apple Documentation "Upload Your App to the Notarization Server" shows code using

xcrun
to invoke the
altool
command with the
notarize-app
flag:


In Terminal:

xcrun altool --notarize-app --primary-bundle-id "com.example.ote.zip" --username "AC_USERNAME" --password "@keychain:AC_PASSWORD" --file OvernightTextEditor_11.6.8.zip


See documentation at:

https://developer.apple.com/documentation/security/notarizing_your_app_before_distribution/customizing_the_notarization_workflow#3087734


Please note that my app is a 4D merged app: XCode is not used to create a 4D merged app.


QUESTIONS:


  1. What "username" do I use?
  2. What "password" do I use?
  3. What does "AC_USERNAME" signify?
  4. What does "@keychain:AC_PASSWORD" signify?

Replies

Here’s how I submit an app for notarisation:

$ xcrun altool --notarize-app --username eskimo1 --password "@keychain:altool-eskimo1" --asc-provider QuinnQuinnXXX --primary-bundle-id com.example.apple-samplecode.Test118304 --file Test118304.zip

In this example:

  • The argument to

    --username
    is my Apple ID [1].
  • The argument to

    --password
    breaks down as follows:
    • @keychain
      tells the tool to look in my keychain for the password.
    • altool-eskimo1
      is the name of an app-specific password in the keychain. Once you’ve created that password in Keychain Access, choose File > Get Info and verify that the Account field is your Apple ID and the Where field matches this value.

    Note The structure this name,

    altool-eskimo1
    , is to remind me which keychain items are which. This structure is not required by
    altool
    . The only requirement is that name needs to match the Where field.
  • I need

    --asc-provider
    because I’m a member of multiple teams. See this post for more background about that.

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

[1] This may look a little bit weird to you because, for external folks, Apple IDs are now email addresses (although that wasn’t always the case).

Quinn, thanks for responding.


Question — What user name do I use?


I created an app-specific password, and entered the password in Keychain Access (#1):



To determine if my password is being retrieved from the Keychain Access, I tried the following (#2) without success:



From the error message above, it appears that the specified item "altool-notarize" is not found in the keychain.


Then I tried using a different user name—my computer's account user name. The keychain item now appears to get found (#3).



But after allowing keychain access, I get an error message saying my Apple ID or password is entered incorrectly (#4):



What am I missing?


Note: In composing mode, snap shots #1, #2, #3 and #4 render. But when I click SAVE REPLY, the images no longer appear. What's happening?


Here are links to images:

#1 https://i.postimg.cc/VNJBtDjw/p01-app-specific.png

#2 https://i.postimg.cc/Kc1WrDD0/p02-with-apple.png

#3 https://i.postimg.cc/W4990dFR/p03-user.png

#4 https://i.postimg.cc/vHRYwBPt/p04-user-error.png

In composing mode, snap shots #1, #2, #3 and #4 render. But when I click SAVE REPLY, the images no longer appear. What's happening?

This is a long-standing limitation of DevForums )-: You’ve already found the recommended workaround: Post a link to your screen shots and wait for a moderator approve your post.

What user name do I use?

Your Apple ID, and specifically the Apple ID you use to log in to the Accounts section of the developer web site.

Then I tried using a different user name—my computer's account user name.

Yeah, that’s not right. This user name must be your Apple ID.

Looking at screenshot 1, I notice the Account field of the password item isn’t set to your Apple ID. It must be.

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

I am having the same problem, the only difference I am trying to upload my iOS app to the store in Xcode server post-integration script.



That is the thing as my AppleID is an email address. So I do not have an @apple.com id that I can use.

And the other thing is that after going to the appleID site generating an app-specific password this password is no-were to be found in the system keychain. Do we need to manually add it ??



..... moments later.



So I just did that. and that is the missing part as the password generated on the website did not propagate to the key chain. so you need to manually add it.