Notarize and distribute a macOS app
Needs a "Developer ID Application" certificate and App Store Connect API credentials. Install the CLI with brew install asc (docs: https://asccli.sh) and authenticate with asc auth login.
Steps
- Archive and export with the Developer ID method:
xcodebuild archive -scheme App -archivePath build/App.xcarchive, thenxcodebuild -exportArchivewith an ExportOptions.plist whosemethodisdeveloper-id. - Verify signing and hardened runtime:
codesign --verify --deep --strict --verbose=2 App.appcodesign -dvv App.appshould showflags=0x10000(runtime).
- Package:
ditto -c -k --keepParent App.app App.zip, or build a DMG (hdiutil create, or a tool such ascreate-dmg) and sign it withcodesign. - Notarize:
asc notarization submit --file ./App.zip --wait. On failure read the log:asc notarization log --id SUBMISSION_ID. - Staple (an app or DMG, not a ZIP):
asc notarization staple --file ./App.dmg --confirm. - Validate as a user would:
spctl --assess --type execute --verbose App.appandxcrun stapler validate App.dmg.
Frequent notarization failures
- Missing hardened runtime: set
ENABLE_HARDENED_RUNTIME = YES. - Unsigned nested binaries or frameworks: sign inner code first, then the bundle (avoid relying on
--deepfor signing). - Missing secure timestamp: pass
--timestamptocodesign. - Disallowed entitlements such as
get-task-allow: remove them from release builds.
Rules
- Never expose certificate passwords or API private keys. Confirm before publishing a build to users.


