App Store Notary Runner
Before invoking Apple-only binaries, confirm the execution context is macOS. From Windows or Linux, run those steps in a Mac SSH project or through an already configured remote transport; do not retry missing Apple binaries locally.
Use for macOS apps distributed outside the App Store with Developer ID signing and Apple notarization.
Use macos-notarization-packager first when the artifact is not clearly distribution-ready. Use macos-signing-inspector for local code-signing, entitlement, Gatekeeper, or trust-policy diagnosis.
Preconditions
- Xcode/CLT configured.
asc auth login or ASC_*.- Developer ID Application certificate in keychain.
- App builds for macOS.
Command Plan Helper
For a deterministic command plan, run the helper from the plugin root:
python3 "$PLUGIN_ROOT/skills/appstore-notary-runner/scripts/notary_plan.py" \
--app-name "YourApp" --scheme "YourMacScheme" \
--archive-path "/tmp/YourApp.xcarchive" \
--export-path "/tmp/YourAppExport" \
--app-path "/tmp/YourAppExport/YourApp.app" \
--zip-path "/tmp/YourAppExport/YourApp.zip" \
--file "/tmp/YourAppExport/YourApp.zip" \
--include-archive --include-export --include-zip --include-submit \
--wait --confirming-actions
The helper prints commands only; it does not build, export, upload, staple, or change trust settings. Commands that write local files or submit to Apple require --confirming-actions. Pass --json for machine-readable output.
Workflow
- Run read-only preflight first: signing identities, trust settings, recent notarization submissions, and existing submission status/log when an ID is known.
- If the artifact is not clearly Developer ID ready, route to
macos-notarization-packager before exporting or submitting.
- Archive, export with Developer ID options, verify code-signing authority/timestamp, package as zip/DMG/PKG, then submit.
- Fetch status/log output and repair signed nested binaries, hardened runtime, timestamp, or trust issues before retrying.
- Staple only after Apple accepts the notarization submission.
References
references/appstore-notary-runner.md for detailed preflight, archive, export, submit, status, stapling, DMG, PKG, and troubleshooting commands.
1---2name: appstore-notary-runner3description: macOS Developer ID notarization commands for xcodebuild export, `asc notarization` submit/status/log, and stapling. Excludes packaging-readiness reviews and signing-only diagnosis.4---56# App Store Notary Runner78Before invoking Apple-only binaries, confirm the execution context is macOS. From Windows or Linux, run those steps in a Mac SSH project or through an already configured remote transport; do not retry missing Apple binaries locally.910Use for macOS apps distributed outside the App Store with Developer ID signing and Apple notarization.1112Use `macos-notarization-packager` first when the artifact is not clearly distribution-ready. Use `macos-signing-inspector` for local code-signing, entitlement, Gatekeeper, or trust-policy diagnosis.1314## Preconditions1516- Xcode/CLT configured.17- `asc auth login` or `ASC_*`.18- Developer ID Application certificate in keychain.19- App builds for macOS.2021## Command Plan Helper2223For a deterministic command plan, run the helper from the plugin root:2425```bash26python3 "$PLUGIN_ROOT/skills/appstore-notary-runner/scripts/notary_plan.py" \27 --app-name "YourApp" --scheme "YourMacScheme" \28 --archive-path "/tmp/YourApp.xcarchive" \29 --export-path "/tmp/YourAppExport" \30 --app-path "/tmp/YourAppExport/YourApp.app" \31 --zip-path "/tmp/YourAppExport/YourApp.zip" \32 --file "/tmp/YourAppExport/YourApp.zip" \33 --include-archive --include-export --include-zip --include-submit \34 --wait --confirming-actions35```3637The helper prints commands only; it does not build, export, upload, staple, or change trust settings. Commands that write local files or submit to Apple require `--confirming-actions`. Pass `--json` for machine-readable output.3839## Workflow40411. Run read-only preflight first: signing identities, trust settings, recent notarization submissions, and existing submission status/log when an ID is known.422. If the artifact is not clearly Developer ID ready, route to `macos-notarization-packager` before exporting or submitting.433. Archive, export with Developer ID options, verify code-signing authority/timestamp, package as zip/DMG/PKG, then submit.444. Fetch status/log output and repair signed nested binaries, hardened runtime, timestamp, or trust issues before retrying.455. Staple only after Apple accepts the notarization submission.4647## References4849- `references/appstore-notary-runner.md` for detailed preflight, archive, export, submit, status, stapling, DMG, PKG, and troubleshooting commands.
Xopoko