3.6 KiB
Create a signed, notarized KJMix Pro DMG
Run these commands from the project folder in Terminal. Do not paste account passwords, private keys or app-specific passwords into chat or source files.
One-time setup
Install a Developer ID Application certificate and its private key in your login Keychain. Apple Development certificates are for development, not this distribution workflow. View available signing identities with:
security find-identity -v -p codesigning
Save notarization credentials interactively:
./scripts/setup-notarization.sh
The helper runs xcrun notarytool store-credentials KJMixPro. Apple prompts for the developer Apple ID, team ID and an app-specific password, then validates and saves the credentials in Keychain. notarytool alone may not be on PATH: use xcrun notarytool, or the helper.
If you already have a profile with a different name, use that name through KJMIX_NOTARY_PROFILE. The profile name is a label you chose when saving the credentials; “Keychain” is not automatically a profile name.
Verified release
./scripts/release.sh
The script builds Release, stages a copy, signs the app with Developer ID and hardened runtime, submits it to Apple, checks Accepted status, staples/validates its ticket, and checks app Gatekeeper assessment. It then creates the compressed DMG with the colourful app/volume/file icon and Applications shortcut, signs and notarizes the DMG, staples/validates its ticket, checks its Gatekeeper assessment and mounts the finished image to recheck the enclosed app. A fresh-Mac launch/install check is still recommended before public distribution.
The only file in dist is the current versioned DMG, for example dist/KJMixPro-0.6.4-macOS.dmg. After all checks pass, old DMGs, ZIPs, checksum sidecars and other output entries are removed. Reports and SHA-256 are kept outside dist under build-release/release-verification/KJMixPro-0.6.4-macOS/. The temporary ZIP required for app notarization stays in the private staging folder and is removed automatically.
The script publishes the DMG and cleans old output only after the checks succeed. A failed run retains the existing distribution, returns nonzero and never labels that attempt Gatekeeper verified.
You can configure another saved profile or signing identity without editing the script:
KJMIX_NOTARY_PROFILE='your-profile' ./scripts/release.sh
KJMIX_SIGNING_IDENTITY='certificate SHA-1' ./scripts/release.sh
The script auto-selects a Developer ID identity if all available matching certificates share the same name; otherwise it asks for an explicit identity. It forwards remaining arguments to xcodebuild. Signing/notarization require network access and may take several minutes; reports retain the submission IDs if Apple processing times out.
Explicit local previews
./scripts/release.sh --signed-only
./scripts/release.sh --unsigned
These modes have clearly marked filenames and status reports. They are not notarized or Gatekeeper verified. Signed-only does not need notarization credentials. Both modes also keep only their current DMG in dist. Neither mode changes Gatekeeper settings or bypasses macOS security.
References: Apple notarization, packaging for distribution.
Run ./scripts/release.sh or bash ./scripts/release.sh; do not source it into your interactive shell. Notarization uses notary_status, avoiding zsh’s read-only status variable.