Notarizing OSX Builds?

I’ve been able to codesign my app without any issues, but upon uploading to the notarization service I’m finding a handful of libraries are unsigned. Even after individually signing the inner-contents, I’m struggling to make any progress. On top of that I’m receiving the error on the main app of “The executable does not have the hardened runtime enabled.”. I’ve found very little help for precompiled app notarizing, and was hoping there were others here who have tacked it.

Anyone else come across these issues?

4 Likes

Did you ever manage to get your app notarized? If so, could you give some pointers?

So I am assuming you guys have looked at Notarizing macOS software before distribution | Apple Developer Documentation what issues we you seeing with this. The plan is we will support notarization, and it will be supported in the supported versions of unity.

Am experiencing the same problems on 2019.1.10.

Any idea how soon this will be working? Until then, it looks like Unity apps can’t be distributed on Mac anymore. Is that right?

Hey Amateurd, we have successfully passed the notarization process for our Mac OS App. We aren’t distributing our product on the Mac App Store, so I can’t speak to how that affects what is required.

The short answer is you will need to manually sign and submit your Mac App for notarization, Unity’s build process doesn’t have any logic for that.

Heres an example cmd for running codesign with all the important bits:
codesign --deep --force --verify --verbose --timestamp --options runtime --entitlements <entitlements_file> --sign "<Developer ID Application: Your Company>" YourApp.app

Replace <entitlements_file> with an actual file on disk with the desired entitlements.
Replace with your actual dev ID.

Hope this helps!

1 Like

Does this mean Unity will be able to get the builds uploaded for notarization for us or will we still need Xcode 10 available to perform it?

Updating for those who may still be in search…

I was able to successfully upload the app to the Mac App Store. I had to download MachOView to disable GameKit (don’t do this if your app uses GameKit).

From there I created a little script that basically does everything @dev_arussell listed.

Does anyone have a step by step guide to this? From signing up to be an Apple developer, to building in Unity then opening in XCode to do the notarization process? Can I skip the XCode part? Can I just run a script over the built game.app?

I also manually signed my app for steam. When I enabled the hardened runtime capability my game crashed at start. I needed to add this specific entitlement to make it work:

It appears this is only necessary for Mono builds (the Mono JIT needs it), I switched to an IL2CPP build and then the entitlement wasn’t required.

1 Like

Here’s a step by step guide I made https://gist.github.com/dpid/270bdb6c1011fe07211edf431b2d0fe4

3 Likes

You don’t need the pkg, just zip the app and upload that. This saves you having to create an installer certificate.

Great tip. I’ll try that out and update my gist. Thank you.

@damonp @christianmahler I am distirbuting my app for steam. Do we need to notarize the app before processing it for steam or after processing with contentprep for steam?
I could successfully do before Steam SDK processing but not after

To All, This helped me to resolve all the codsign errors. Do try if your facing code sign issue. I ignored the first time i saw this. But this ended up saving my time.
My certificates were in login keychain so it I used login.keychain. Replace according to your keychain

  • security lock-keychain login.keychain
  • security unlock-keychain -p “password” login.keychain
  • sudo reboot
  • security list-keychains
    “/Users/admin/Library/Keychains/login.keychain-db”
    “/Library/Keychains/System.keychain”
  • security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k “password” /Users/admin/Library/Keychains/login.keychain-db

@srilakshmim You notarize the Game.app before uploading to steam. Make sure to staple the returned ticket to the Game.app. You can check successful notarization by running spctl -a -v Game.app. All in all you don’t want to get message like this when opening your game in Catalina:


@christianmahler so for Steam, do we have to notarize the app every time we do a patch?

It looks like contentprep is depreciated. I’d recommend using ContentBuilder. This is what I successfully used for uploading to Steam after notarization.

@gecko , any build being uploaded to Steam will need to be notarized.

Yes every new build, Apple does this to ensure there is no malware in your app bundle, but you could introduce malicious stuff with each update.

1 Like