Notarisation for dummies

[Natan]

@d-healey said in Notarisation for dummies:

@hisefilo You don't need to notarize/staple your plugins. You only need to codesign plugins and notarize/staple the installer.

So Only Code Signing The .Component / .VST Or .VST3 Can Let Us To Distribute The Plugin?
Without Installers?

So End User Can Drag & Drop The Plugin Into The Folders And Get To Work Right Away?!!!

[d.healey]

@Natanr No. If you are distributing the binaries only then they need to be codesigned and notarized/stapled, but if you are distributing them in a pkg (or a DMG that contains a pkg) then you only need to notarize the pkg. This is according to the famous KVR post - https://www.kvraudio.com/forum/viewtopic.php?t=531663

[adriano]

@d-healey at the risk of a pass for an ignorant, what is the use of notarization? if my .vst or .au plugin is not notarized it will not work? I am under catalina and my plugins are working fine. it's just a legal obligation is it?

[Christoph Hart]

The end user will see a passive-aggressive popup from macOS that suggests your software is full of viruses unless you notarize.

It isn't a show stopper (AFAIK you can still run the installer by right-clicking and choosing Open from the context menu) but you need to prepare to answer a few more customer support emails than you should have to...

[adriano]

@Christoph-Hart however i have already given my plugins and vst to friends to try and they had no problem installing. logic asks that the plugin be checked but we can activate it anyway.

[d.healey]

@adriano are they using Catalina?

[Lindon]

@d-healey - my understanding remains that you need to notarise anything that will "run" on its own - so app or pkg or dmg etc. but plug-ins - that are called from within DAWs only need to be codesigned. Colour me massively unsurprised is this opinion is wrong...

[d.healey]

@Lindon Perhaps it is needed for apps, the KVR thread just mentions plugins. I'll see what I can find out!

[adriano]

@d-healey yes. And me too

[adriano]

@d-healey it also works without problem with the standalone versions. indeed the plugins already have an "Abcd" code for their operation in the daw.

[d.healey]

@adriano said in Notarisation for dummies:

@d-healey indeed the plugins already have an "Abcd" code for their operation in the daw.

That's not related to notarization.

Have you disabled/bypassed gatekeeper?

[d.healey]

@Lindon Seems like we're good to just notarize the pkg

Does notarization apply to a .app contained on a .pkg?

Yep. From my previous post:
The notary service generates a ticket for the top-level file that you specify, as well as each nested file. For example, if you submit a disk image that contains a signed installer package with an app bundle inside, the notarization service generates tickets for the disk image, installer package, and app bundle.

Your app must get code signed and get Hardened Runtime enabled,

My exporter tool handles this.

[adriano]

@d-healey I don't understand everything in the language of a programmer like you. gatekeeper I don't even know what it is. I distributed a dixiane of plugin to friends under catalina, mainly producers. I created one. pkg with the mac package application, then creates a distribution package. I just told the package to put the .vst and .au plugins in audio / plugin .... and that's it .. no problem whatsoever at the package or vst level. To be sure, I asked my friends if they had any errors and no one reported any problem to me. I did not do any right click manipulation etc ... just we open the pkg and everything works fine. After that maybe to distribute a plugin via the apple store it is necessary but for me, at this moment, everything is fine. I compile under x code latest version, project latest version and catalina latest version

[Christoph Hart]

Alrighty, then enjoy the freedom from notarization as long as you can :)

[d.healey]

@adriano said in Notarisation for dummies:

gatekeeper I don't even know what it is.

Gatekeeper is the Mac "security" thing that pops up and tells you which apps it thinks are dangerous and it will try to stop you running them.

[adriano]

@d-healey ball kick to gatekeep

[SampleScience]

@adriano Do you distribute your plugins to your friends online or by using USB keys? Because if it's by using USB keys, you won't have any problems, it's when it's downloaded via the web that the Gatekeeper will interfere with the app/plugin.

[adriano]

@SampleScience from "WE transfert" or gmail directly.

[yall]

@Lindon said in Notarisation for dummies:

username

@Lindon

hi, i just got to code my vst.component and the PKG. the coding went well.
(I could not verify if the code was successful with the command.>.

codesign -vvv /Users/macmini/Desktop/notarizationplugin/myvst.component. )

i had again entered the command line to sign, the terminal told me that the vst was already signed. so ok.
i'm notarizing pkg now, i handwrite in terminal but get this error. >.
unable to find utility "altool", not a developer tool or in PATH. <

and I am a little stuck.
I have created my altool password, correctly entered my email address in username. do you have any idea of ​​the problem?
thank you ;)

[yall]

@Lindon the problem may be with x code 8.3 instead of a newer version?