How to Sign macOS Applications With codesign and Notarization

Choose the Correct Apple Signing Identity

macOS signing identities are provided through Apple's developer ecosystem. For applications distributed outside the Mac App Store, a Developer ID Application certificate is generally used to sign the application.

security find-identity -v -p codesigning

Look for the appropriate Developer ID Application identity before beginning the signing process. Use the exact identity available in the keychain rather than copying an example identity name into production.

Enable Hardened Runtime

Applications intended for notarization generally need to be configured appropriately for Apple's Hardened Runtime requirements. In Xcode, enable Hardened Runtime from the application's Signing & Capabilities configuration.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
</dict>
</plist>

Sign the macOS Application With codesign

Apple provides the codesign command line utility for signing macOS applications. The platform-specific workflow differs from Windows Authenticode signing, so use the tools and validation steps designed for macOS.

codesign --force --deep --options runtime   --sign "Developer ID Application: Your Name"   "MyApp.app"

Sign Nested Frameworks and Components

A macOS application may contain frameworks, dynamic libraries, helper applications, embedded executables, plug-ins and other nested code. These components need to be signed correctly as part of the application signing process.

codesign --force --options runtime   --sign "Developer ID Application: Your Name"   "MyApp.app/Contents/Frameworks/MyFramework.framework"

codesign --force --options runtime   --sign "Developer ID Application: Your Name"   "MyApp.app"

The exact order depends on the application's bundle structure.

Sign With the Required Entitlements

If the application requires entitlements, provide the appropriate entitlements file when signing. The entitlements should correspond to capabilities the application actually needs.

codesign --force --options runtime   --entitlements entitlements.plist   --sign "Developer ID Application: Your Name"   "MyApp.app"

Incorrect entitlements can cause signing, notarization or runtime problems, so keep them minimal and intentional.

Add a Secure Timestamp

A timestamp helps establish when the signature was created. For production releases, timestamping should be part of the normal signing process, with the timestamp evidence checked during verification. The broader code signing timestamping process explains why trusted time evidence matters.

codesign --force --timestamp   --options runtime   --sign "Developer ID Application: Your Name"   "MyApp.app"

Verify the macOS Application Signature

After signing, verify the exact application bundle using codesign. Verification should happen before packaging and again on the final release artifact. Use a consistent code signature verification process to check the exact bundle that will be distributed.

codesign --verify --deep --strict --verbose=2 "MyApp.app"

codesign --display --verbose=4 "MyApp.app"

Check Gatekeeper Assessment

A valid code signature does not automatically mean that macOS will accept an application through every distribution scenario. Gatekeeper assessment is an important release validation step for applicable outside App Store distribution.

spctl --assess --type execute --verbose "MyApp.app"

Package and Notarize the Application

For software distributed outside the Mac App Store, notarization is an important part of Apple's modern distribution workflow. Code signing and notarization are related but are not the same operation.

xcrun notarytool submit MyApp.zip   --keychain-profile "notary-profile"   --wait

Staple the Notarization Ticket

After Apple accepts the submission, staple the notarization ticket to the application or appropriate distribution package.

xcrun stapler staple "MyApp.app"

xcrun stapler validate "MyApp.app"

Verify the Complete Release Artifact

The final artifact should be tested after signing and notarization. Verify the same artifact that will actually be distributed.

codesign --verify --deep --strict --verbose=2 "MyApp.app"

spctl --assess --type execute --verbose "MyApp.app"

xcrun stapler validate "MyApp.app"