The extensionless-binary trap in macOS notarization

posted on 2026-06-22 22:10:00

Or: Apple code signing fussiness

I packaged music chop — a PyInstaller-frozen Python GUI that bundles ffmpeg, ffprobe, and rubberband — into a macOS .app, and went to sign and notarize it so Gatekeeper would just stop with the warnings. Here's the whole chain:

1. Apple Developer Program ($99/yr). The approval is the prerequisite
2. A Developer ID Application certificate. Make it in Xcode → Settings → Accounts → (team) → Manage Certificates → + → Developer ID Application. This needs Account Holder / Admin — the plain "Developer" role can't create one. It installs the cert and its private key into your login keychain; without the private key, security find-identity -v -p codesigning shows nothing.
3. codesign, hardened runtime, with entitlements for whatever your app does that the runtime would otherwise block (mine needs allow-jit + allow-unsigned-executable-memory for numba, and disable-library-validation for the bundled third-party dylibs).
4. notarize with xcrun notarytool submit --wait, then staple the ticket.

read more →

2026-06-22

posted on 2026-06-22 21:55:09

Three out the door.

Today:

Pushed a live test of the GEOM 2120 trainer — gamified survey-computations drills. Out of the Downloads folder and into a browser at last.

Got my land-survey plugin accepted into the OpenCAD Studio plugin registry. First time something of mine landed in someone else's registry.

Closing in on an Apple signed music chop installer. Developer ID sorted, fought a keychain, and ran a notarization rejection to ground — three bundled CLI tools (ffmpeg, ffprobe, rubberband) weren't getting signed. Fix is in; waiting on Apple's notary queue.

Sidequests:

Also wrote up a construction deficiencies list and got it translated into Punjabi and Hindi. May have a reusable template for that soonish.

read more →

2026-06-21

posted on 2026-06-21 11:44:39

A double-clickable dv2mv.

Solstice.

Today: packaged dv2mv — the DV-footage-into-a-music-video chopper — into a real macOS app and cut a first alpha.

dv2mv / music chop is really just a wrapper for ffmpeg, scenedetect, and a pile of numba-accelerated audio math. ffmpeg and friends ride along inside the bundle now, so there is nothing to brew install.

Unsigned for the moment. Gatekeeper gives it the sideye for now, until I get a Developer ID and notarize (membership still pending); right-click → Open gets you past it.

arm64 only, macOS 11+.

read more →