Mac App Bundle Notarization

[RaySajuuk]

@SoftFever,

First, thank you for all your hard work in making OrcaSlicer. It has been my default slicer for X1C since it is released.

I couldn't help but notice the app bundle releases are not notarized, and checking the GitHub action comment, and I see you run into an error on staple the ticket.

I am unsure if it is left this way intentionally, but in case it isn't.

This is because the codesign command is missing --options runtime (hardened runtime) required for Apple notary service. The staple command is not needed, but it is good to have as it will be recognized by the gatekeeper easily. After digging, I wrote a script to notarize the app bundle and generated dmg.
The tricky part is after codesign with hardened runtime, the bambu network plug-in stopped working. The solution is to add com.apple.security.cs.disable-library-validation to allow loading unsigned dylib.

There is an excellent video from Apple explaining this: https://developer.apple.com/wwdc19/703.

Also, I will include my script so you can take a look and make appropriate adjustments to the GitHub action file. You can create a directory and run the script inside.

You need to add your Apple Developer credentials and generate an app-specific password to use it.

My script does a few things:

1. Call xcrun notarytool store-credentials with your Apple developer account credential to the keychain. (It stores in the cloud keychain if you have it enabled. So next time, you can call --keychain-profile instead of always passing your password in plain text.)
2. Call ditto to copy compiled app bundle from the project directory ~/GitHub/OrcaSlicer/build_arm64/OrcaSlicer/OrcaSlicer.app to the directory where the script is run from.
3. Generate entitlement file based on app name (more later).
4. Call codesign with with --options runtime and entitlement file against the app bundle.
5. Call hdiutil to create a DMG from signed app bundle used for notary service (more later).
6. Call codesign again with the same configuration and entitlement against the DMG file.
7. Call xcrun notarytool to submit the DMG file to Apple Notary Service.
8. Call xcrun stapler to staple the notary ticket to the DMG file and app bundle.

Apple Notary Service accepts .zip or .dmg archives. I use dmg for easy distribution.

I wrote this script to help me notarize both BambuStudio and OrcaSlicer.
Usage:
Those two commands should be self-explanatory.

notarize.sh orca
notarize.sh bambu

Those two commands will set entitlement to false, which disables the slicer from loading the network plug-in.
notarize.sh orca local
notarize.sh bambu local

*I am just a beginner, learning things slowly.🫠 I do hope this will help.

notarize_.sh.zip

[SoftFever]

@RaySajuuk
This is fantastic! I will give it a try 👍

[RaySajuuk]

@SoftFever: I forgot to mention that the terminal app you are using has the App Management permission turned on in Security & Privacy settings. Otherwise, it will not work.

[SoftFever]

@RaySajuuk
I apologize for not being responsive for a while.
I've been busy with work and family commitments recently. I'll check this weekend.

[RaySajuuk]

No worries. Completely understand. I, myself is have very busy schedule everyday also. I only hope that I am competent enough to help you with this project.🙏

[SoftFever]

It worked!
The --options runtimes did the magic :)

DMG is indeed more convenient.
I will adjust the workflow to auto notarise the bundle.
Thank you so much!!

[RaySajuuk]

You are very much welcome. I am glad I can help.