CODEWITHSUNDEEP
macosnotarize
satinder singh
satinder singh

Reputation: 449

Mac is unable to verify the application I downloaded

I have created a Mac application and now I wish to distribute it. However, no matter what I do whenever I try to install the application it says Apple could not verify “<application_name>” is free of malware that may harm your Mac or compromise your privacy.

I followed the instructions from Apple developer Forum

  1. Generated the Mac application using nuitka
  2. Signed the application using codesign,
codesign --deep --force --verify --verbose --sign "Developer ID Application: <developer id>" \
--entitlements entitlements.plist --options runtime "<application>.app"
  1. Verified the signing process,
codesign --verify --verbose "<application>.app"
<application>.app: valid on disk
<application>.app: satisfies its Designated Requirement
  1. Zipped the application and sent it for notarization
/usr/bin/ditto -c -k --sequesterRsrc --keepParent <application>.app <application>.zip
xcrun notarytool submit <application>.zip --keychain-profile "key_chain_notarization_profile" --wait
  1. It says accepted. I then staple the notarization ticket to the app.
xcrun stapler staple "<application>.app"
  1. Checked the notarization status
spctl -a -vvv -t install <application>.app
<application.app>: accepted
source=Notarized Developer ID
origin=Developer ID Application: <developer_id>
  1. I created a dmg from this using dmgbuild and then signed the dmg as well.
  2. Now I upload the dmg to my file server and when I download and try to install it, it says verification failed. I tried checking the notarization status of this dmg(using spctl) and it was ok.

Stackoverflow post suggested signing the app, notarizing it, preparing the dmg out of it, then signing the dmg and getting it notarized. I tried this but no luck.

My settings have Allow applications from app store and verified developers checked.

I also checked the logs of my accepted notarization. It says accepted but the logs say that there were some warnings like

{
      "severity": "warning",
      "code": null,
      "path": "<application>.dmg/<application>.app/Contents/MacOS/mediapipe/modules/face_detection/face_detection_short_range.tflite",
      "message": "The archive at <application>.dmg/<application>.app/Contents/MacOS/mediapipe/modules/face_detection/face_detection_short_range.tflite could not be unpacked. Any executables contained in the archive will not be notarized.",
      "docUrl": null,
      "architecture": null
    },

Can these warnings be causing the issue?

I am running a M2 Mac Air with mac os version 15.0.
Any help is highly appreciated.

Upvotes: 1

Views: 3293

Answers (1)

satinder singh
satinder singh

Reputation: 449

If it helps anyone, the steps worked for me. After restarting my laptop, everything functioned as expected. I also read on some Apple developer forums that Gatekeeper caches results, so it could have been related to that. Either way, since the restart, it has worked perfectly every time. Just to recap, here are all the steps I followed:

  1. Create the app
  2. Sign the app using codesign
  3. create a DMG out of it
  4. Submit the DMG for notarization
  5. Staple the notarization ticket to the app
  6. Again create a DMG. This DMG is ready to be distributed.

Upvotes: 1

Related Questions