I've spent altogether too long, at various moments in the past year or so, trying to understand the code-signing, runtime entitlements, and 'notarization' requirements that are now involved when packaging software for Apple macOS 10.15 Catalina. (I put notarization in quotes because it doesn't carry the word's general meaning; it appears to be an Apple coinage.)
In particular I've had difficulty understanding how one should package plugins — shared libraries that are distributed separately from their host application, possibly by different authors, and that are loaded from a general library path on disc rather than from within the host application's bundle. In my case I'm dealing mostly with Vamp plugins, and the main host for them is Sonic Visualiser, or technically, its Piper helper program.
Catalina requires that applications (outside of the App Store, which I'm not considering here) be notarized before it will allow ordinary users to run them, but a notarized host application can't always load a non-notarized plugin, the tools typically used to notarize applications don't work for individual plugin binaries, and documentation relating to plugins has been slow in appearing. Complicating matters is the fact that notarization requirements are suspended for binaries built or downloaded before a certain date, so a host will often load old plugins but refuse new ones. As a non-native Apple developer, I find this situation… trying.
A continental breakfast is a light morning meal. It's served buffet style, and it typically has fewer offerings than a traditional breakfast at a restaurant. Normally, it consists of bread products, fruit, fruit juice, coffee, and tea. Most often, you'll find continental breakfasts at hotels, motels, and events. A continental breakfast is a light morning meal typically consisting of pastries and baked goods, fruits, toast, and coffee. It is usually served buffet-style and modeled after the European breakfast, similar to what one would enjoy in France or the Mediterranean.
Macbook, Mac OS X (10.4.6) Posted on Jul 10, 2006 11:43 AM Reply I have this question too I have this question too Me too Me too. Continental Breakfast Standard Continental Freshly Baked Muffins and Breakfast Pastries Fresh Seasonal Fruit Display Chilled Orange, Apple, and Cranberry Juice Regular and Decaffeinated Coffee and Assorted Hot Tea $12.95 Per Person Deluxe Continental Freshly Baked Muffins and Breakfast Pastries Assorted Bagels with Cream Cheese and Preserves. A continental breakfast can be a thing of beauty – a healthy, nutritious and satisfying alternative to a cooked meal – or a dull disappointment, a choice between an old apple or prepackaged muffin with your Styrofoam cup of coffee.
Anyway, this week I realised I had some misconceptions about how notarization actually worked, and once those were cleared up, the rest became obvious. Or obvious-ish.
(Everything here has been covered in other places before now, e.g. Apple docs, KVRaudio, Glyphs plugin documentation. But I want to write this as a conceptual note anyway.)
What notarization does
Here's what happens when you notarize something: https://betcasino-deposit-palace-no-sun-cpb-bonus.peatix.com.
- Your computer sends a pack of executable binaries off to Apple's servers. This may be an application bundle, or just a zip file with binaries in it.
- Apple's servers unpack it and pick out all of the binaries (executables, libraries etc) it contains. They scan them individually for malware and for each one (assuming it is clean) they file a cryptographic hash of the binary alongside a flag saying 'yeah, nice' in a database somewhere, before returning a success code to you.
Later, when someone else wants to run your application bundle or load your plugin or whatever:
- The user's computer calculates locally the same cryptographic hashes of the binaries involved, then contacts Apple's servers to ask 'are these all right?'
- If the server's database has a record of the hashes and says they're clean, the server returns 'aye' and everything goes ahead. If not, the user gets an error dialog (blah cannot be opened) and the action is rejected.
Simple. But I found it hard to see what was going on, partly because the documentation mostly refers to processes and tools rather than principles, and partly because there are so many other complicating factors to do with code-signing, identity, authentication, developer IDs, runtimes, and packaging — I'll survey those in a moment.
For me, though, the moment of truth came when I realised that none of the above has anything to do with the release flow of your software.
The documentation describes it as an ordered process: sign, then notarize, then publish. There are good reasons for that. The main one is that there is an optional step (the 'stapler') that re-signs your package between notarization and publication, so that users' computers can skip ahead and know that it's OK without having to contact Apple at all. But the only critical requirement is that Apple's servers know about your binary before your users ask to run it. You could, in fact, package your software, release the package, then notarize it afterwards, and (assuming it passes the notarization checks) it should work just the same.
Notarizing plugins
A plugin (in this context) is just a single shared library, a single binary file that gets copied into some folder beneath $HOME/Library and loaded by the host application from there.
None of the notarization tools can handle individual binary files directly, so for a while I thought it wasn't possible to notarize plugins at all. But that is just a limitation of the client tools: if you can get the binary to the server, the server will handle it the same as any other binary. And the client tools do support zip files, so first sign your plugin binary, and then:
Mac Os Mojave
Caesars casino no deposit bonus code. (See the Apple docs for an explanation of the authentication arguments here.)
[Edit, 2020-02-17: John Daniel chides me for using the 'zip' utility, pointing out that Apple recommend against it because of its poor handling of file metadata. Use Apple's own 'ditto' utility to create zip files instead.]
Wait for notarization to complete, using the request API to check progress as appropriate, and when it's finished,
The above incantation seems to be how you test the notarization status of a single file: pretend it's an installer (-t install), because once again the client tool doesn't support this use case even though the service does. Note, though, that it is the dylib that is notarized, not the zip file, which was just a container for transport.
A Glossary of Everything Else
Signing — guaranteeing the integrity of a binary with your identity in a cryptographically secure way. Carried out by the codesign utility. Everything about the contemporary macOS release process, including notarization, expects that your binaries have been signed first, using your Apple Developer ID key.
Developer ID — a code-signing key that you can obtain from Apple once you are a paid-up member of the Apple Developer Program. That costs a hundred US dollars a year. Without it you can't package programs for other people to run them, except if they disable security measures on their computers first.
Entitlements — annotations you can make when signing a thing, to indicate which permissions, exemptions, or restrictions you would like it to have. Examples include permissions such as audio recording, exemptions such as the JIT exemption for the hardened runtime, or restrictions such as sandboxing (q.v.).
Hardened runtime — an alternative runtime library that includes restrictions on various security-sensitive things. Enabled not by an entitlement, but by providing the --options runtime flag when signing the binary. Works fine for most programs. The documentation suggests that you can't send a binary for notarization unless it uses the hardened runtime; that doesn't appear to be true at the moment, but it seems reasonable to use it anyway. Note that a host that uses the hardened runtime needs to have the com.apple.security.cs.disable-library-validation entitlement set if it is to load third-party plugins. (That case appears to have an inelegant failure mode — the host crashes with an untrappable signal 9 following a kernel EXC_BAD_ACCESS exception.)
Stapler — a mechanism for annotating a bundle or package, after notarization, so that users' computers can tell it has been notarized without having to contact Apple's servers to ask. Carried out by xcrun stapler. It doesn't appear (?) to be possible to staple a single plugin binary, only complex organisms like app bundles.
Quarantine — an extended filesystem attribute attached to files that have been downloaded from the internet. Shown by the ls command with the -l@ flags, can be removed with the xattr command. The restrictions on running packaged code (to do with signing, notarization etc) apply only when it is quarantined.
Mac Os Download
Sandboxing — a far more intrusive change to the way your application is run, that is disabled by default and that has nothing to do with any of the above except to fill up one's brain with conceptually similar notions. A sandboxed application is one that is prevented from making any filesystem access except as authorised explicitly by the user through certain standard UI mechanisms. Sandboxing is an entitlement, so it does require that the application is signed, but it's independent of the hardened runtime or notarization. Sandboxing is required for distribution in the App Store.
Re-index the drive: Spotlight- How to re-index folders or volumes - Apple Support. The display is not reliable unless the drive has been re-indexed.
There is no such thing as a normal 'system' size since it varies widely from user to user. If you need to clear files from the drive then see this:
How to Free Up Space on The Hard Drive
- You can remove data from your Home folder except for the /Home/Library/ folder.
- Visit The XLab FAQs and read the FAQ on freeing up space on your hard drive.
- Also, see Freeing space on your Mac OS X startup disk.
- Free up storage space on your Mac.
- See Where did my Disk Space go?.
- Be sure to Empty the Trash to recover the space.
- Replace the drive with a larger one. Check out OWC for drives, tutorials, and toolkits.
- Use OmniDiskSweeper or GrandPerspective to search your drive for large files and where they are located.
My advice is to stay away from system files and never delete files unless you know what they are for.
Jan 1, 2017 10:03 AM
