Translocation on Developer-ID Signed DMGs

Hi,

I am part of a team developing an application that we would like to distribute on macOS. The DMG that we would like to distribute consists of an application and a .tar.gz that contains a lot of data (about 1 GB or so).

According to the last paragraph here: https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution/customizing_the_notarization_workflow?preferredLanguage=occ we have decided to separate the application and the .tar.gz as I mentioned earlier. We have successfully notarized the application, created a DMG with the notarized application and the .tar.gz, and signed the DMG with our Developer ID.

Even though the DMG is signed, when the app is executed, it is subject to translocation and the app therefore cannot find our .tar.gz data file. Is notarization of the DMG now required in Catalina and above? If so, why do the docs recommend shipping data beside a notarized app in a disc image without notarization?

Any guidance would be greatly appreciated.

You could distribute an installer instead. When it is run, it will already be properly installing in /Applications, so you won't have any translocation issues. Your installer may be able to find the file on the DMG. If not, your app should be able to find the mounted disk image. If this is a downloaded DMG anyway, maybe just have app download the data on first launch. Then you don't even need the DMG.

Is notarization of the DMG now required in Catalina and above?

I don’t know, but I’m interested in getting to the bottom of this. Unfortunately I don’t have the time to do that in the context of DevForums. If you’d care to open a DTS tech support incident, I can help you out in that context.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@apple.com"
Translocation on Developer-ID Signed DMGs
 
 
Q