Support for notarization for apple code signing #381
Labels
Comments
indygreg
added
apple-codesign
|
Yes, it would be nice! The main blocker to this is I'm unsure the technical mechanism at play. It appears adding notarization to a bundle is as simple as writing the Apple-produced notarization ticket/file to the bundle. However, getting that ticket is a bit more complicated. I think notarization is effectively uploading an archive to Apple servers and then waiting for them to notarize it. It appears that under the hood notarization is using Apple's Transporter app for doing the remote server interactions (https://help.apple.com/itc/transporteruserguide/#/apdA17fcd7d1). But this is as far as I've gotten. I'm not sure what the HTTP requests look like and how much effort is required to re-implement this functionality outside of Transporter. I believe Transporter is Java and can run on other platforms. So worst case we could instruct people to install that program and script its execution. Although I'd prefer to implement functionality in pure Rust to keep things simpler. If anyone could help by providing details of how notarization works at a technical level, it would be greatly appreciated. Pointers to other open source tools implementing the functionality would also help. |
|
Unfortunately I only know about the (Mac) command line incarnations like |
|
I just pushed code to main (look at commit 386f5d2 and preceding commits) that implements notarization and stapling for macOS It currently relies on Apple Transporter to upload an asset to Apple for notarization. But that tool is available for Linux and Windows. So in effect this means that it is now possible to sign, notarize, and staple from !macOS using this crate. I think that modern Apple tools like There are currently a ton of rough edges. No support for non-macOS |
|
Example output (from a Linux machine): (Transporter's output is very verbose. I should find a way to make it quieter.) The notarized and stapled |
|
Great work, thanks! Really exciting new feature. The |
I suppose it isn't. 🤷♂️ |
|
I just pushed support for stapling XAR archives ( Still no support for signing or notarizing them. The latter is likely trivial. The former is a much thornier problem. |
|
And 43fbf29 adds support for notarizing (some) This repo also now has an |
|
I forgot to mention it, but the 0.10 release included support for signing I believe at this point the I'm going to consider this issue closed. If there are remaining bugs or feature gaps in notarization/stapling, please file new issues. https://pyoxidizer.readthedocs.io/en/latest/apple_codesign_debugging.html contains instructions for filing good bug reports regarding signing. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
It would be great to have a means to notarize on non-mac platforms.
The text was updated successfully, but these errors were encountered: