Signing for macOS

An unsigned Mac build refuses to open at all on a modern macOS — the user gets "cannot be opened because the developer cannot be verified", and the way past it is obscure enough that most people give up.

Two things fix that, and they are separate: signing proves the build came from you, and notarising proves Apple has scanned it. You need both for a download. Signing alone is enough for a build you hand to a colleague.

What you need

An Apple Developer Program membership (99 USD a year) and a Developer ID Application certificate.

Note the name. Apple issues several kinds and they are not interchangeable:

Getting the .p12

1. On a Mac, open Keychain Access → Certificate Assistant → Request a Certificate from a Certificate Authority. Save the request to disk. This generates the private key locally — the request is useless to anyone else, and the certificate Apple gives back is useless without it.
2. Go to Certificates, Identifiers & Profiles, create a Developer ID Application certificate and upload that request.
3. Download the certificate and double click it to install it into Keychain.
4. In Keychain Access, find it under My Certificates — it must show a disclosure triangle with a private key underneath. If it does not, you are on a different Mac from the one that made the request.
5. Right click → Export → .p12, and set a password.

Do not create two certificates with the same name. Exporting then becomes a guess about which one you picked.

What to put in Forge

Forge signs on Linux using rcodesign, a clean-room implementation of Apple's format. We verified the output with Apple's own codesign on a Mac: valid on disk, satisfies its Designated Requirement, full chain to the Apple Root CA. You do not need a Mac.

Then notarise

Signing is half of it. See Apple notarisation for the other half — without it, macOS still warns on anything downloaded from the internet.