Issues with notarizing a bundle

Question

iClemens OP

Created Oct ’23

Replies 4

Boosts 0

Participants 2

I'm trying to notarize a plug-in for Autodesk Maya (project type: Mach-O Bundle).

Over the past few years I was able to successfully notarize my plug-ins via command line scripts. I usually build the bundles outside XCode with a scripted process which then also automates the notarization procedure. This has been a solid and working workflow.

Since yesterday, October 23rd 2023 the prior working 'altool' is now refused because of the new notarization process which starts November 1st, 2023!!!

While trying to follow the new procedure outlined here: https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/customizing_the_notarization_workflow

I performed the following steps:

Create a ZIP archive suitable for notarization.

/usr/bin/ditto -c -k --keepParent "$APP_PATH" "$ZIP_PATH"

Upload for notarization.

xcrun notarytool submit $ZIP_PATH --keychain-profile "Notarization" --wait

The result is:

$ xcodebuild[2514:78653] Requested but did not find extension point with identifier Xcode.IDEKit.ExtensionSentinelHostApplications for extension Xcode.DebuggerFoundation.AppExtensionHosts.watchOS of plug-in com.apple.dt.IDEWatchSupportCore
$ xcodebuild[2514:78653] Requested but did not find extension point with identifier Xcode.IDEKit.ExtensionPointIdentifierToBundleIdentifier for extension Xcode.DebuggerFoundation.AppExtensionToBundleIdentifierMap.watchOS of plug-in com.apple.dt.IDEWatchSupportCore
Conducting pre-submission checks for myPlugin.bundle.zip and initiating connection to the Apple notary service...
Submission ID received
  id: ***-***
Successfully uploaded file
  id: ***-***
  path: /Users/***/myPlugin.bundle.zip
Waiting for processing to complete.
Current status: Invalid........
Processing complete
  id: ***-***
  status: Invalid

My current assumption is that it's necessay to archive the bundle in XCode first as mentioned in the documentation:

"To prepare an app for notarization, you must export the app from Xcode."

But when I try to export the bundle after archiving I am not presented with the necessary options. The Organizer only gives me the button to Distribute Content which leads to another window allowing me to select either Build Products (which only exports the archive's built products) or Archive (which only creates a copy). Unfortunately neither then contains the necessary ExportOptions.plist, which is required as by the documentation.

I would very much appreciate of someone could shed some light on what's necessary to perform a successful notarization. Thank you.

Answered by DTS Engineer in 769730022

My current assumption is that it's necessay to archive the bundle in Xcode first

No. The doc is misleading here. It should say “To prepare an app that’s built using an Xcode project for notarisation”. That comment doesn’t apply to apps, or other code, built outside of Xcode.

For advice for how to sign and package code outside of Xcode, see:

I’m not sure why the notary service doesn’t like your current product. I recommend that you fetch the notary log and see what it’s complaining about. See Fetching the Notary Log.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Boost

Answer 1

DTS Engineer OP

Apple

Oct ’23

Accepted Answer

My current assumption is that it's necessay to archive the bundle in Xcode first

No. The doc is misleading here. It should say “To prepare an app that’s built using an Xcode project for notarisation”. That comment doesn’t apply to apps, or other code, built outside of Xcode.

For advice for how to sign and package code outside of Xcode, see:

I’m not sure why the notary service doesn’t like your current product. I recommend that you fetch the notary log and see what it’s complaining about. See Fetching the Notary Log.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

1

Answer 2

iClemens OP

Nov ’23

Thank you so much for your answer and tips.

After going through the provided info by Quinn (and otherwise very useful additional documentation) I was able to fix the problem. However, in order to get the notarization log I needed to change the given command:

xcrun notarytool log CREDENTIALS REQUEST_UUID

to

xcrun notarytool log --keychain-profile "Notarization" REQUEST_UUID

Otherwise the command got refused.

The log eventually revealed that the code signing was missing. This has been part of my automated script I used in the past. But it's not mentioned in any of the process documentations for manual building and signing. Therefore, before archiving it's necessary to code sign the compiled bundle with:

codesign -s IDENTITY_STRING -f "$APP_PATH"

IDENTITY_STRING is the exact string the developer certificate appears in the user's keychain. After this and archiving finally running the notarytool was successful and the bundle got accepted.

Thank you so much again for your effort and time. I hope this helps others having similar issues.

0

Answer 3

DTS Engineer OP

Apple

Nov ’23

in order to get the notarization log I needed to change the given command:

Right. Fetching the Notary Log says:

CREDENTIALS is your notary service credentials, the same credentials you used to submit your request

which turns out to be --keychain-profile "Notarization" in your case.

Therefore, before archiving it's necessary to code sign the compiled bundle with:

I’d like to clarify this point. I read this as:

You have a main app bundle that you build with Xcode.
Inside that main app bundle is another app bundle.
You don’t build that nested app bundle from source code; rather, you embed a pre-built binary.
When you do a Product > Archive and then export the main app from that archive, the main app is signed but the nested app is not.

Is that correct?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 4

iClemens OP

Nov ’23

Thanks for getting back to me.

For clarification, it's much more simple than that:

The "app" is a Mach-O Bundle to work as a plug-in for another application.
Only coding and debug building is done in Xcode. Nothing else. Not even archiving.
There isn't any form of nested apps or alike. A couple of c++ and header files.
The main building is performed with Python and shell scripts. No Xcode is involved.
The result is a single myPlugin.bundle file in a folder. This is the starting point for notarization.

0