How to notarize on MAC.

[raresn]

So, in the past i had a set of commands that just worked, but now i moved on from altool to the notarytool, and i can't get the app signed.
Here is what i used to do:
1 & 2
AdobeAIRSDK/bin/adt -package -storetype pkcs12 -tsa none -keystore androidMarket.p12 -storepass *** -target bundle Agenda.app Agenda-Desktop.xml AgendaDesktop.swf icons images data -extdir extensions
AdobeAIRSDK/bin/adt -sign -storetype KeychainStore -alias "Developer ID Application: On Time Agenda SRL" -target bundle Agenda.app OnTimeAgenda.app
3
make dmg with the DROP DMG APP
4
xcrun altool --type osx --file OnTimeAgenda.dmg --primary-bundle-id ro.fxstudio.AgendaDesktop --notarize-app --username my_email@mail.com --asc-provider team_id
5
enter this password when prompted: APP SPECIFIC PASSWORD
pass here
6
If no errors uploading On Time Agenda:
xcrun stapler staple OnTimeAgenda.dmg

Now, i changed step 4, because altool failed to this:
xcrun notarytool submit --keychain-profile PROFILE OnTimeAgenda.dmg

Note:
The profile PROFILE was created using this:
xcrun notary tool store-credentials PROFILE --apple-id my@mail --team-id my_team_id

After running step 4, the upload is a success, but when i run:
xcrun notarytool history --keychain-profile PROFILE, my submission status is: "Invalid"
I did a xcrun notarytool log ID_OF_SUBMISSION_HERE
and i got:
statusSummary: "Archive contains critical validation errors"

@ajwfrost or anyone who has been through this process do you have any clue what i can try next? (i've been at this for 5 hours now :) )

[ajwfrost]

Hi @raresn

Which AIR SDK version are you using? And which macOS version?
Just wondering, if you run java -version, what version you're getting?

Are you able to check the output of ADT when you do the -sign command, from the adt.log file or the SDK Manager troubleshooting page? We should just be calling the native codesign process here, but perhaps something's not quite set up right..

The new notarytool steps look okay but the error is definitely suggesting a problem with the signing part. (You can probably check that with codesign -v -vvv OnTimeAgenda.app prior to creating the DMG file...)

thanks

[pol2095]

1. create a Notarization directory
   adt -sign -storetype KeyChainStore -alias "Developer ID Application: developer name (R--------S)" -target bundle ../myApp.app myApp.app

2. ditto -c -k myApp.app myApp.app.zip
xcrun notarytool submit myApp.app.zip --keychain-profile myProfile
   wait a moment...

3. xcrun stapler staple myApp.app

[raresn]

FINALLY! it worked, here is what i did:

1. find OnTimeAgenda.app -name "*.framework" -exec codesign -v -vvv {} ;
   This shows that a framework is not signed.

2. I used codesign to sign that framework that was not signed like this:
   codesign -s "Developer ID Application: On Time Agenda SRL" --timestamp --options runtime --force OnTimeAgenda.app/Contents/Resources/META-INF/AIR/extensions/com.distriqt.Core/META-INF/ANE/MacOS-x86-64/Core.framework

3. convert to dmg

4. Submit the file again using:
   xcrun notarytool submit --keychain-profile PROFILE OnTimeAgenda.dmg

5. Doing this, i get an id, that i then use to check what happens with that submission
   And now, i check that submission
   With this:
   xcrun notarytool log --keychain-profile PROFILE (submission_id)

And I get a list of other frameworks/files/folders that have not been signed.
I took one by one (i had around 5), and i repeated steps 2-5 untill step 5 did not show any errors.

6. After it showed no more errors i used this command to check,
   xcrun notarytool history --keychain-profile PROFILE

7. then staple the result using:
   xcrun stapler staple OnTimeAgenda.dmg

Although I was able to notarize, i find it super strange that the -sign command i ran did not sign everything.
I think this is wrong, and should sign everything inside the .app file without us going to the files one by one, right @ajwfrost?

Thank you for all the support @ajwfrost , @pol2095 , @marchbold ! #community

[ajwfrost]

Although I was able to notarize, i find it super strange that the -sign command i ran did not sign everything.
I think this is wrong, and should sign everything inside the .app file without us going to the files one by one, right @ajwfrost?

Yes, definitely odd that this didn't work! Originally I think that --deep option was meant to sign a bundle and all its contents, but that was changed a while back. Hence our use of "find" which should mean that the codesign command is executed for all of these embedded framework bundles. The only thing I am wondering is whether our use of an entitlements file is causing problems... but you're not using a new macOS/Xcode version, and I believe that I'm right in thinking that some frameworks appeared to be signed and some didn't?

Will have to see if we can get some extra debugging/output into this and see what's happening in more detail... just to check, you weren't logged in via ssh or similar when you did the ADT sign command?

thanks

[raresn]

Correct, some where signed and some weren't. I wasn't logged in via ssh, and yes i am not using the new macOS/Xcode. Just a virtual mac with ventura 13.6. If i can help in any way, i am here!

[raresn]

Btw, maybe this will help you narrow things down - did a test, without any extensions, and the sign/notary processs just worked. So there is a problem when adding extensions in the xml.