It is built using pkgbuild and productbuild from an ant build script.
Something very weird is going on here. Consider this:
-
I downloaded your disk image from the link above.
-
I mounted the disk image.
-
I copied Apache NetBeans 13.pkg to my hard disk.
-
I removed quarantine from that.
-
I dropped it on Pacifist.
-
Pacifist spits out the following error:
The file “cpp-13.pkg” couldn’t be opened because there is no such file.
[Stop Extraction] [Continue]
That’s not a good sign.
-
I clicked Continue.
-
I used Pacifist to extract Apache NetBeans 13.app.
-
I checked its code signature:
% codesign -d -vvv "Apache NetBeans 13.app"
Apache NetBeans 13.app: code object is not signed at all
So, there are two issues here:
I can’t help with the first one. I have a basic knowledge of the installer but I’m not an expert on setting up complex installer packages. And likewise for the Specifying [allow-external-scripts='true'] is deprecated. message. So, I’m going to focus on the second issue.
Consider this:
% codesign -d -vvv Apache-NetBeans-13-bin-macosx.dmg
Apache-NetBeans-13-bin-macosx.dmg: code object is not signed at all
% codesign -d -vvv "/Volumes/Apache NetBeans 13/Apache NetBeans 13.pkg"
/Volumes/Apache NetBeans 13/Apache NetBeans 13.pkg: code object is not signed at all
This is super weird. Neither your disk image nor your installer are actually signed. And that brings me back to something you wrote earlier:
I reran the staple on the DMG and got
How does that work if the disk image isn’t signed? To investigate this I ran stapler for myself:
% stapler staple validate -vvv Apache-NetBeans-13-bin-macosx.dmg
…
Signing information is {
cdhashes = (
{length = 20, bytes = 0xe8c895384c939910dc83eb774fe9377c943a97ef}
);
…
identifier = ADHOC;
…
}
…
Downloaded ticket has been stored at file:///var/folders/ts/89wlmlw971x8k8ds6y_48kn80000gp/T/e41e37f0-d80f-4428-aa1f-a0d748f74403.ticket.
…
There’s a couple of things to note here:
-
identifier = ADHOC indicates that the notarisation infrastructure has decided to use an ad hoc signature for this disk image.
-
e8c895384c939910dc83eb774fe9377c943a97ef is the code directory hash (cdhash) it’s consed up. A cdhash uniquely identifies a code item and its critical to how the notarisation infrastructure works. Indeed, a notarised ticket is simply a list of cdhashes that’s been signed by Apple.
-
I then dumped the ticket:
% NotarizationTicketDump /var/folders/ts/89wlmlw971x8k8ds6y_48kn80000gp/T/e41e37f0-d80f-4428-aa1f-a0d748f74403.ticket
e8c895384c939910dc83eb774fe9377c943a97ef
Note NotarizationTicketDump is a tool I wrote myself to dump the cdhashes in a ticket. I can’t share that tool but you, as the person who did the notarisation, can get the same information from the notarisation log. More on this below.
So, the only cdhash in the ticket is the one for the ad hoc signature of your disk image. In short, neither your installer package nor any of your code are notarised O-: That explains why it won’t pass Gatekeeper.
At this point my best guess is that something is wonky about your installer package construction and that has caused the notary service to not look inside it. To investigate further I recommend that you get the notarisation log to see if it’s flagged any issues.
How you do this depends on how you notarise:
-
If you’re using altool, run the --notarization-info subcommand, grab the LogFileURL from its output, and then fetch that.
-
If you’re using notarytool, run the log subcommand.
IMPORTANT altool has been deprecated for the purposes of notarisation. Switch to notarytool; it’s better, stronger, and faster. For the details, see WWDC 2021 Session 10261 Faster and simpler notarization for Mac apps.
Look in the contents and issues entries in the log. The contents entry should include items for every piece of code in your installer package, and the installer package itself. I suspect that it’ll be empty, or may have a single entry for the disk image, and that issues will explain why.
Also, I’d appreciate you posting the log here so that I can see this for myself. Use the text attachment feature (click the paperclip icon and then choose Add File) to avoid clogging up the timeline. You may need to change the extension from .json to .txt.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
