The extensionless-binary trap in macOS notarization

posted on 2026-06-22 22:10:00

Or: Apple code signing fussiness

I packaged music chop — a PyInstaller-frozen Python GUI that bundles ffmpeg, ffprobe, and rubberband — into a macOS .app, and went to sign and notarize it so Gatekeeper would just stop with the warnings. Here's the whole chain:

1. Apple Developer Program ($99/yr). The approval is the prerequisite
2. A Developer ID Application certificate. Make it in Xcode → Settings → Accounts → (team) → Manage Certificates → + → Developer ID Application. This needs Account Holder / Admin — the plain "Developer" role can't create one. It installs the cert and its private key into your login keychain; without the private key, security find-identity -v -p codesigning shows nothing.
3. codesign, hardened runtime, with entitlements for whatever your app does that the runtime would otherwise block (mine needs allow-jit + allow-unsigned-executable-memory for numba, and disable-library-validation for the bundled third-party dylibs).
4. notarize with xcrun notarytool submit --wait, then staple the ticket.

read more →