56 lines
3.6 KiB
Markdown
56 lines
3.6 KiB
Markdown
# Create a signed, notarized KJMix Pro DMG
|
||
|
||
Run these commands from the project folder in Terminal. Do not paste account passwords, private keys or app-specific passwords into chat or source files.
|
||
|
||
## One-time setup
|
||
|
||
Install a **Developer ID Application** certificate and its private key in your login Keychain. Apple Development certificates are for development, not this distribution workflow. View available signing identities with:
|
||
|
||
```sh
|
||
security find-identity -v -p codesigning
|
||
```
|
||
|
||
Save notarization credentials interactively:
|
||
|
||
```sh
|
||
./scripts/setup-notarization.sh
|
||
```
|
||
|
||
The helper runs `xcrun notarytool store-credentials KJMixPro`. Apple prompts for the developer Apple ID, team ID and an app-specific password, then validates and saves the credentials in Keychain. `notarytool` alone may not be on PATH: use `xcrun notarytool`, or the helper.
|
||
|
||
If you already have a profile with a different name, use that name through `KJMIX_NOTARY_PROFILE`. The profile name is a label you chose when saving the credentials; “Keychain” is not automatically a profile name.
|
||
|
||
## Verified release
|
||
|
||
```sh
|
||
./scripts/release.sh
|
||
```
|
||
|
||
The script builds Release, stages a copy, signs the app with Developer ID and hardened runtime, submits it to Apple, checks Accepted status, staples/validates its ticket, and checks app Gatekeeper assessment. It then creates the compressed DMG with the colourful app/volume/file icon and Applications shortcut, signs and notarizes the DMG, staples/validates its ticket, checks its Gatekeeper assessment and mounts the finished image to recheck the enclosed app. A fresh-Mac launch/install check is still recommended before public distribution.
|
||
|
||
The only file in dist is the current versioned DMG, for example `dist/KJMixPro-0.6.4-macOS.dmg`. After all checks pass, old DMGs, ZIPs, checksum sidecars and other output entries are removed. Reports and SHA-256 are kept outside dist under `build-release/release-verification/KJMixPro-0.6.4-macOS/`. The temporary ZIP required for app notarization stays in the private staging folder and is removed automatically.
|
||
|
||
The script publishes the DMG and cleans old output only after the checks succeed. A failed run retains the existing distribution, returns nonzero and never labels that attempt Gatekeeper verified.
|
||
|
||
You can configure another saved profile or signing identity without editing the script:
|
||
|
||
```sh
|
||
KJMIX_NOTARY_PROFILE='your-profile' ./scripts/release.sh
|
||
KJMIX_SIGNING_IDENTITY='certificate SHA-1' ./scripts/release.sh
|
||
```
|
||
|
||
The script auto-selects a Developer ID identity if all available matching certificates share the same name; otherwise it asks for an explicit identity. It forwards remaining arguments to xcodebuild. Signing/notarization require network access and may take several minutes; reports retain the submission IDs if Apple processing times out.
|
||
|
||
## Explicit local previews
|
||
|
||
```sh
|
||
./scripts/release.sh --signed-only
|
||
./scripts/release.sh --unsigned
|
||
```
|
||
|
||
These modes have clearly marked filenames and status reports. **They are not notarized or Gatekeeper verified.** Signed-only does not need notarization credentials. Both modes also keep only their current DMG in dist. Neither mode changes Gatekeeper settings or bypasses macOS security.
|
||
|
||
References: [Apple notarization](https://developer.apple.com/documentation/security/notarizing-macos-software-before-distribution), [packaging for distribution](https://developer.apple.com/documentation/xcode/packaging-mac-software-for-distribution).
|
||
|
||
Run `./scripts/release.sh` or `bash ./scripts/release.sh`; do not source it into your interactive shell. Notarization uses `notary_status`, avoiding zsh’s read-only `status` variable.
|