Mac Code Signing

A feature called GateKeeper was added with the release of OS X 10.8 Mountain Lion in 2012. With this feature new apps that are downloaded or copied to a Mac with OS X 10.8 or newer, but that are not digitally signed using an Apple Developer Certificate, display an error when run: "App" can't be opened because it is from an unidentified developer.

On older versions of macOS, this error can be overridden in System Preferences (Security & Privacy), by changing the "Allow applications downloaded from" setting to "Anywhere". Unfortunately, the "Anywhere" option is no longer available with macOS 10.12 Sierra. Alternatively, you can right-click on the app in Finder and click Open in the menu to indicate, "I'd really like to run this app, thank you very much."

Note that this only matters for new apps that you transfer to a Mac running macOS 10.8 or later. You'll be able to run the apps you create on your developer machine without this warning. You'll only run into this warning when you copy the app to another Mac, either by making it available for download or by copying it via a USB stick, the network or anything else.

So even though you don't technically need to sign your Mac applications in order to avoid this warning, you are probably going to want to. The truth is that most people will just leave the setting at the default and will not know that when they get the warning message that they can right-click on the app to open it. You could try explaining all this to them, but either way it is going to be a hassle for your users. Odds are they just won't bother with your app. The solution is to code-sign your app.

Code Signing Configuration

To code sign your apps you need a developer certificate from Apple and the only way to get a Developer Certificate is to sign up for the Apple Developer Program, which costs $100 a year. However, the certificate you get is good for 5 years, so it looks like you do not need to pay the $100 fee each year unless you also want to distribute apps in the Mac App Store.

You can find out more about the Apple Developer Program here:

https://developer.apple.com

Once you have joined, you can create your own certificates using the Certificates, Identifiers & Profiles page of the Apple Developer site. The steps are a bit involved, but essentially you will request a Developer ID certificate from this page.

When you choose to create a new Mac certificate (Developer or Distribution), you are walked through the process of starting Keychain Access and downloading and uploading files until you have the certificate installed. It's a little tedious, but relatively straightforward.

That's the hard part. With the certificate installed, you can now use it to code sign any of your applications. You do this using the Terminal command codesign (pronounced "code sign").

But before you begin, make sure you have the Intermediate Developer ID certificate installed. Go to this page:

http://www.apple.com/certificateauthority/

and download the Developer ID certificate. Double-click it to install it into Keychain Access on your Mac.

Code Signing Your App

Now you are ready to code sign your application. Navigate to its folder using Terminal. There you can enter the commands below to code sign your application and all its libraries. Obviously you want to replace "YourXojo.app" with the name of your application and "Developer ID Application: YourName" with the name of your signing certificate specified in Keychain Access.

   codesign -f -s "Developer ID Application: YourName (345XXYY)" YourXojoApp.app/Contents/Frameworks/*.dylib
   codesign -f -s "Developer ID Application: YourName (345XXYY)" YourXojoApp.app/Contents/Frameworks/*.framework
   codesign -f -s "Developer ID Application: YourName (345XXYY)" YourXojoApp.app

Now you can compress/package your app and transfer it to another computer for installation.

If you are also packaging your app into an installer, you'll need to install the "Developer ID Installer" certificate and then code sign the installer package file as well. You can embed these commands into an IDE script that calls out to the shell (or a shell script) so that your app is automatically code-signed each time it is built.

Code signing must be done as the absolute last step. If you modify anything inside your application bundle (such as Info.plist) after you code sign, you will invalidate the signature and you'll have to code sign again. For a Build Step, this means it must be the last item after the Build item.

For more information about code signing from Apple, refer to the macOS Code Signing In Depth Technical Note at the Apple Dev Center.

3rd Party Alternative

For more complicated code signing situations you might want to consider a 3rd party code signing tool, such as App Wrapper.