In the interest of giving back to everyone who has helped me, below is how I take the app out of Processing and then turn it into a signed, notarized, official Apple app that’s “legal” and “legit” as far as Apple is concerned, and can be shared over the internet with anyone. NO HORRIBLE ERROR MESSAGES!
Note - prior to these steps you will need to become an official Apple developer - pay them the $99 and get certificates for yourself. This small guide does not cover this part, and it is a little involved getting the certificates setup and installed correctly on your system. But they give you links how to do this when you become an Apple Developer.
You will need a Developer and and Application certificate, by the way.
OK, onto the steps.
Initial Steps:
-
Update info.plist.tmpl to have updated version, data info for app - this is a little file you can include in the Processing folder for your app that will make the app show the right version. I’m not sure how to share it here, but you can probably google it. It’s not required, but makes your finished app a bit more professional.
-
Export the app from Processing to Apple Silicone or Intel
-
Replace the application.icns file in package Resources. You can make a file called application.icns which includes various sizes of your app logo. Again, this is a little involved, but you can google this part if you want a custom app icon (highly recommended!).
-
Put an “entitlements” file into the same folder as the .app file. An entitlements file lets the app know what it’s allowed to do or not do. You can google for a sample entitlements file. But here’s the one I used:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.security.cs.allow-dyld-environment-variables</key>
<true/>
<key>com.apple.security.cs.allow-jit</key>
<true/>
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
<true/>
<key>com.apple.security.cs.disable-executable-page-protection</key>
<true/>
<key>com.apple.security.cs.disable-library-validation</key>
<true/>
</dict>
</plist>
Note: I highly suggest you make this in Xcode so it works right. I know, “HOW?” - google, my friend, google.
Do all this in a terminal window in the same window as the app:
Code Sign:
codesign --deep --force --verify --verbose --timestamp --options runtime --entitlements "App.entitlements" --sign "Developer ID Application: Your Name (XXXXX - Developer ID)" "AppName.app"
Check code sign:
codesign -vvv --deep --strict AppName.app
Make zip file:
ditto -c -k --sequesterRsrc --keepParent “AppName.app” “AppName.zip”
Submit to Apple for Notarization:
xcrun notarytool submit --apple-id "yourappleid" --password "your app specific password which you get from Apple" --team-id YOURTEAMID --wait "AppName.zip"
- If it fails, get the json log and see what was not signed.
To get json log, run this command after app notarization failure:
xcrun notarytool log --apple-id "yourappleid" --password "your app specific password" --team-id YOURTEAMID [copy/paste code from submission failure] notary-log.json
-
Look through the json file and see what file failed. Probably a binary wasn’t signed, even though it was supposed to be signed.
-
If the unsigned file is not a .jar file, you can just run the notarization on the file inside the .app package.
-
If the unsigned file is a .jar file, you’ll need to unzip the jar file into a folder, copy/paste entitlements into it, sign the unsigned file, delete the entitlements file, delete the original jar file, then rezip the folder back into a .jar file.
Here’s those steps:
unzip jarfilename.jar -d jarfolder
Copy Entitlements into the folder and recode sign:
codesign --deep --force --verify --verbose --timestamp --options runtime --entitlements “App.entitlements” --sign “Developer ID Application: Michael Phillips (XXXXXX)” “filename to sign”
jar cvf jarfilename.jar -C jarfolder/ .
- Need to sign the whole app again after this!! Also need to re-notarize the whole thing again, but it should pass notarization at that point.
To check if App is Correctly Notarized:
spctl -a -t exec -vvv AppName.app
Staple Notarization:
xcrun stapler staple "AppName.app"
Check Staple:
spctl --assess --verbose AppName.app
At this point, your app file will be “official” and “legal” and “Legit” and will pass Apple Gatekeeper. You can upload it to the internet and people can download it, and use it. They will get an error “This file has been downloaded from the Internet. Are you sure you want to open it?” - this only happens the first time, and is totally NORMAL and not an indication you screwed up. Even Apple apps from mega corporations will show this, unless the app is hosted in the App Store.
You could also make your app available to the App Store, but I have not done this, so I will not comment on it except to say it’s going to be fairly similar process.
Make a DMG file
After you get your app file all legal and legit, you might want to package it up into a DMG file for other folks to download easily. You can include things like a EULA, instructions, readme, etc, with the dmg file.
For me, the program DMG Canvas was a godsend. You gotta pay for it, but it’s cheap, and it also will automatically sign and notarize your DMG file once you made it. Also you can make a fancy background and get it looking just amazing too. Note - I’m NOT getting an affiliate commission to share this with you!!!
Now, I totally understand that this is still probably VERY CONFUSING if you’ve never done any of this, and it’s waaaay beyond the scope of what I can offer right here right now to absolutely and clearly explain every step (this deserves a huge blog post, which might take a few hours to do right). I am a teacher after all, so I realize this is FAR from complete!
But I spent dozens of hours figuring this out, with Svan’s help, and tons of hours googling and trying things. Weeks.
I hope if any of you have been struggling with some of this, that this guide will give you the broad strokes outlines of how to proceed.
Thank you,
Mike
