Code Sign your Application
Code Signing and Notarization is not an easy task and the built in Deployment Tool is too magic for my taste. It did not work for me. So I decided to create my own Code Signing and Notarization Tool - CodeSign.
1. Download CodeSign
CodeSign is just a simple Omnis library to copy Apple commands into memory and you paste manually the code into the Terminal. 17 lines are code signing and the last 2 lines are notarization. The library is Omnis Studio 10.22 and have to be converted to 11 if needed. And this library is not notarized, so you may get a warning :-).
Download CodeSign
2. Make Settings
The settings is just a bunch of paths to resources on your desk. You will find them in the $construct method of the CodeSign library.
# -------------CODE SIGN
Calculate lv_SIGN as 'Developer ID Application: Your Company (ABCDEFG4)' ## created via xcode
Calculate lv_SIGNPKG as 'Developer ID Installer: ADJob Nordic AB (ABCDEFG4)' ## created via xcode
Calculate lv_BUNDLEID as 'se.myapp2.0' ## your own identifier for your app
Calculate lv_PW as 'aqhh-foxd-abcd-abcd' ## from developer.apple.com
Calculate lv_TEAMID as 'ABCDEFG4' ## from developer.apple.com
# -------------SOURCE > TARGET
Calculate lv_PATHAPP as '/Applications/MyApp.app' ## path to your app
Calculate lv_PATHPKG as '/Users/mats/Documents/MyApp_Installer/Installer.pkg' ## path to unsigned pkg
Calculate lv_PATHPKGSIGN as '/Users/mats/Documents/MyApp_Installer/Install_MyApp.pkg' ## path to signed pkg
# -------------ENTITLEMENTS
Calculate lv_PATHSTD as '/Users/you/Documents/entitlements/standard.plist' ## path to entitlement.plist
Calculate lv_PATHXTR as '/Users/you/Documents/entitlements/extra.plist' ## path to extra entitlement.plist
# -------------PATHS INSIDE OMNIS
Calculate lv_OBFRAMEWORK as '/Contents/MacOS/xcomp/obrowser.u_xcomp/Contents/Frameworks/Chromium\ Embedded\ Framework.framework/Libraries/*' ## path to obrowser
Calculate lv_PATHFIRSTRUN as '/Contents/MacOS/firstruninstall/startup/*' ## path to startup folder inside Content
Calculate lv_OBHELP as '/Contents/MacOS/xcomp/obrowser.u_xcomp/Contents/Frameworks/obrowser\ Helper.app/' ## path to framework folder inside Content
Calculate lv_OBXCOMP as '/Contents/MacOS/xcomp/obrowser.u_xcomp' ## path to obrowser xcomp
Calculate lv_PATHNODE as '/Contents/Resources/nodejs/node' ## path to node.js
Calculate lv_PATHGPU as '/Contents/MacOS/xcomp/obrowser.u_xcomp/Contents/Frameworks/obrowser\ Helper\ \(GPU\).app/' ## path to o browser helper
Calculate lv_PATHRENDER as '/Contents/MacOS/xcomp/obrowser.u_xcomp/Contents/Frameworks/obrowser\ Helper\ \(Renderer\).app/' ## path to obrowser renderer
Calculate lv_FRAMEWORK as '/Contents/Frameworks/*' ## path to framework folder
Calculate lv_PATHOMNIS as '/Contents/MacOS/Omnis' ## path to omnis
Calculate lv_SERIAL as '/Contents/MacOS/firstruninstall/serial.txt' ## path to serial.txt
Do iv_LIST.$define(lv_NOTE;lv_STRING)
Do iv_LIST.$add('-------------PRECHECKING';'')
Do iv_LIST.$add('1. Check Entitlements';con('plutil -convert xml1 ';lv_PATHSTD))
Do iv_LIST.$add('2. Check Entitlements';con('plutil -convert xml1 ';lv_PATHXTR))
Do iv_LIST.$add('3. Check ID';'security find-identity -v')
Do iv_LIST.$add('-------------PREPARE';'')
Do iv_LIST.$add('4. Remove Finder stuff';con('sudo xattr -cr ';lv_PATHAPP))
Do iv_LIST.$add('5. Remove OLD codesign?';con('sudo codesign --remove-signature ';lv_PATHAPP))
Do iv_LIST.$add('-------------CODE SIGN';'')
Do iv_LIST.$add('6. Sign oBrowser Framework';con('sudo codesign -f -o runtime --entitlements ';lv_PATHSTD;' --timestamp --verbose -s ';kDq;lv_SIGN;kDq;kSp;lv_PATHAPP;lv_OBFRAMEWORK))
Do iv_LIST.$add('7. Sign Node.js';con('sudo codesign -f -o runtime --entitlements ';lv_PATHXTR;' --timestamp --verbose -s ';kDq;lv_SIGN;kDq;kSp;lv_PATHAPP;lv_PATHNODE))
Do iv_LIST.$add('8. Sign serial.txt';con('sudo codesign -f -o runtime --entitlements ';lv_PATHXTR;' --timestamp --verbose -s ';kDq;lv_SIGN;kDq;kSp;lv_PATHAPP;lv_SERIAL))
Do iv_LIST.$add('9. Sign Firstrun';con('sudo codesign -f -o runtime --entitlements ';lv_PATHSTD;' --timestamp --verbose -s ';kDq;lv_SIGN;kDq;kSp;lv_PATHAPP;lv_PATHFIRSTRUN))
Do iv_LIST.$add('10. Sign Recursive';con('sudo codesign -f --deep -o runtime --entitlements ';lv_PATHSTD;' --timestamp --verbose -s ';kDq;lv_SIGN;kDq;kSp;lv_PATHAPP))
Do iv_LIST.$add('11. Sign Omnis ';con('sudo codesign --sign ';kDq;lv_SIGN;kDq;' --entitlements ';lv_PATHSTD;kSp;lv_PATHOMNIS))
Do iv_LIST.$add('12. Sign oBrowser Helper';con('sudo codesign -f -o runtime --entitlements ';lv_PATHXTR;' --timestamp --verbose -s ';kDq;lv_SIGN;kDq;kSp;lv_PATHAPP;lv_OBHELP))
Do iv_LIST.$add('13. Sign oBrowser GPU';con('sudo codesign -f -o runtime --entitlements ';lv_PATHXTR;' --timestamp --verbose -s ';kDq;lv_SIGN;kDq;kSp;lv_PATHAPP;lv_PATHGPU))
Do iv_LIST.$add('14. Sign oBrowser Render';con('sudo codesign -f -o runtime --entitlements ';lv_PATHXTR;' --timestamp --verbose -s ';kDq;lv_SIGN;kDq;kSp;lv_PATHAPP;lv_PATHRENDER))
Do iv_LIST.$add('12. Sign oBrowser xcomp';con('sudo codesign -f -o runtime --entitlements ';lv_PATHSTD;' --timestamp --verbose -s ';kDq;lv_SIGN;kDq;kSp;lv_PATHAPP;lv_OBXCOMP))
Do iv_LIST.$add('13. Sign root';con('sudo codesign -f -o runtime --entitlements ';lv_PATHSTD;' --timestamp --verbose -s ';kDq;lv_SIGN;kDq;kSp;lv_PATHAPP))
Do iv_LIST.$add('-------------CHECKING CODESIGN';'')
Do iv_LIST.$add('14. Check Sign';con('codesign --verify --deep --strict --verbose=2 ';lv_PATHAPP))
Do iv_LIST.$add('15. Verify';con('codesign --verify --verbose ';lv_PATHAPP))
Do iv_LIST.$add('16. Check Omnis ';con('codesign --verify --verbose ';lv_PATHOMNIS))
Do iv_LIST.$add('-------------INSTALLER';'')
Do iv_LIST.$add('20. Create Installer';con('pkgbuild --install-location ';lv_PATHAPP;' --root ';lv_PATHAPP;' --identifier ';lv_BUNDLEID;kSp;lv_PATHPKG))
Do iv_LIST.$add('21. Code sign Installer ';con('productsign --sign ';kDq;lv_SIGNPKG;kDq;kSp;lv_PATHPKG;kSp;lv_PATHPKGSIGN))
Do iv_LIST.$add('22. Check Installer Sign';con('pkgutil --check-signature ';lv_PATHPKGSIGN))
Do iv_LIST.$add('-------------NOTARIZE';'')
Do iv_LIST.$add('23. Send to Apple';con('xcrun notarytool submit --apple-id ';lv_USER;' --password ';lv_PW;' --team-id ';lv_TEAMID;' --wait ';lv_PATHPKGSIGN))
Do iv_LIST.$add('24. Staple';con('xcrun stapler staple ';lv_PATHAPP))
3. Code Sign your application.
Double click on each row to get a command for pasting into the Terminal and hit enter. Back and forth from Omnis to Terminal.
