Mac app notarization and signing checklist

Commands for reference

These are the basic forms of Apple's command-line tools. Replace MyApp and the keychain profile with your own. Your setup may need more options, so check Apple's documentation.

# Verify the signature
codesign --verify --deep --strict --verbose=2 MyApp.app

# Zip the app for upload
ditto -c -k --keepParent MyApp.app MyApp.zip

# Submit for notarization and wait for the result
xcrun notarytool submit MyApp.zip --keychain-profile "notary" --wait

# Staple the ticket, then check it
xcrun stapler staple MyApp.app
xcrun stapler validate MyApp.app

# Make the zip again from the stapled app
ditto -c -k --keepParent MyApp.app MyApp.zip

# Ask Gatekeeper about the app
spctl --assess --type execute --verbose MyApp.app

Common misses

Notarized, but never stapled

The app passes notarization, but the ticket never gets attached. Without a stapled ticket, Gatekeeper has to look it up online. One of Quality.Noted's demo projects has exactly this: a release script that notarized the app but never stapled the ticket.

Zipped before stapling

Stapling changes the app on disk. If the zip you upload was made before stapling, the copy your users download doesn't have the ticket. Staple first, then make the zip.

Unsigned helpers and frameworks

Every piece of code inside the app needs a valid signature with the hardened runtime. Notarization rejects the submission if a helper, framework or tool inside the app isn't signed correctly.

Debug settings in the release build

A debugging entitlement such as get-task-allow left on in the release build causes notarization to fail. Check the entitlements of the build you actually submit.

Testing only on your own Mac

A build you made yourself isn't marked as downloaded, so Gatekeeper doesn't check it the way it checks your users' copies. Test the real download on a clean Mac or a fresh user account.

More from Apple: Resolving common notarization issues