3.2 KiB
Create a signed, notarized KJMix Pro DMG
Run these commands from the project folder in Terminal. Do not paste account passwords, private keys or app-specific passwords into chat or source files.
One-time setup
Install a Developer ID Application certificate and its private key in your login Keychain. Apple Development certificates are for development, not this distribution workflow. View available signing identities with:
security find-identity -v -p codesigning
Save notarization credentials interactively:
./scripts/setup-notarization.sh
The helper runs xcrun notarytool store-credentials KJMixPro. Apple prompts for the developer Apple ID, team ID and an app-specific password, then validates and saves the credentials in Keychain. notarytool alone may not be on PATH: use xcrun notarytool, or the helper.
If you already have a profile with a different name, use that name through KJMIX_NOTARY_PROFILE. The profile name is a label you chose when saving the credentials; “Keychain” is not automatically a profile name.
Verified release
./scripts/release.sh
The script builds Release, stages a copy, signs the app with Developer ID and hardened runtime, submits it to Apple, checks Accepted status, staples/validates its ticket, and checks app Gatekeeper assessment. It then creates the compressed DMG with the colourful app/volume/file icon and Applications shortcut, signs and notarizes the DMG, staples/validates its ticket, checks its Gatekeeper assessment and mounts the finished image to recheck the enclosed app. A fresh-Mac launch/install check is still recommended before public distribution.
Outputs are versioned, for example:
dist/KJMixPro-0.6.4-macOS.dmgdist/KJMixPro-0.6.4-macOS.zip(stapled app)- SHA-256 sidecars and
dist/KJMixPro-0.6.4-macOS-verification/reports
The script publishes these files only after the checks succeed. A failed run returns nonzero and never labels that attempt Gatekeeper verified. Existing files from earlier builds can remain in dist; check the current report and successful script completion.
You can configure another saved profile or signing identity without editing the script:
KJMIX_NOTARY_PROFILE='your-profile' ./scripts/release.sh
KJMIX_SIGNING_IDENTITY='certificate SHA-1' ./scripts/release.sh
The script auto-selects a Developer ID identity if all available matching certificates share the same name; otherwise it asks for an explicit identity. It forwards remaining arguments to xcodebuild. Signing/notarization require network access and may take several minutes; reports retain the submission IDs if Apple processing times out.
Explicit local previews
./scripts/release.sh --signed-only
./scripts/release.sh --unsigned
These modes have clearly marked filenames and status reports. They are not notarized or Gatekeeper verified. Signed-only does not need notarization credentials. Unsigned creates the compatibility ZIP as well. Neither mode changes Gatekeeper settings or bypasses macOS security.
References: Apple notarization, packaging for distribution.