Code signing for 10.8.x
lazarus / 33-macOS - Mac OS X

----------------------------------------------------------------------
rossh_lz · 2012-08-01 09:45

I thought I'd write a How to for others who need to sign code on
Lazarus apps, and outside of the X-code system.

Updated 12 months later (2013):

Setup:
1/  Join the Mac Dev Center through Appstore.  $99 a year - suck it
up.
2/  In the Dev center, go to the certificate section, and create 2
certificates:  Go to: Certificates ->  + to create new -> Production
->  Developer ID ->  (1) Developer ID Application, and (2) Developer
ID Installer.  You do this in conjunction with KeyChain utility
program and its Assistant and request a cert (use the saved to disk
method)
3/  Download those two certs and install into your KeyChain (click the
cer file).
4/  Download two more intermediate certs - Go to: Certificates ->  +
to create new -> Intermediate certs, and get both WWDR and Developer
ID Intermediate cert.  You might already have these.  Install these to
your KeyChain.

Signing:
5/  Sign your .app bundle:
/usr/bin/codesign -f -s "Developer ID Application: MyCoName inc." 
/path/to/my/app/bundle.app

6/  Make your package file with your signed .app above

7/  Sign your .pkg file:
/usr/bin/productsign --sign "Developer ID Installer: MyCoName inc."
/input/path/to/package.pkg  /OUTPUT/path/for/the/result.pkg

8/  Make your .dmg file as required.

----------------------------------------------------------------------
jwdietrich · 2012-08-01 18:01

Thank you for providing this interesting and useful information.

----------------------------------------------------------------------
Hansaplast · 2012-08-09 02:54

I was wondering how that would work - thanks for the info and insight!

----------------------------------------------------------------------
Shebuka · 2012-09-03 15:41

Hi, good guide

I'v used a bit different approach:
Quote from: rossh_lz on August 01, 2012, 11:45:29 am4/  Download two
more intermediate certs - go to Overview, WWDR intermediate cert, and
Developer ID Intermediate cert.  Install these to your KeyChain.I'v
not downloaded this ones, and it still works.

Quote from: rossh_lz on August 01, 2012, 11:45:29 amSigning:
5/  Sign your .app bundle:
/usr/bin/codesign -f -s "3rd Party Mac Developer Application: MyCoName
inc."  /path/to/my/app/bundle.appHere i'm using this code:
codesign -s "Developer ID Application: MyCoName S.p.A."
/path/to/my/app/bundle.app

What is the difference between this certificates? With Developer ID
Application it still works fine.

----------------------------------------------------------------------
jwdietrich · 2013-07-11 23:38

The only version, which I have made good experiences with is:

codesign -f -s ID /path/to/my/app/bundle.app -r="host => anchor apple
and identifier com.apple.translate designated => identifier
BundleIdentifier",

where ID is the 10-digit alphanumeric user ID of my Developer ID
application and BundleIdentifier is the CFBundleIdentifier (e.g.
net.sf.spina.thyr for my SPINA Thyr application).

Successful codesigning may be checked with

codesign -d -r- /path/to/my/app/bundle.app

and

codesign -vvvv /path/to/my/app/bundle.app

With this method I could successfully sign applications for a
prerelease build of Mac OS X 10.9 (Mavericks).