From 2f3258f5493ff1961d6630d66fb00030c69b5c06 Mon Sep 17 00:00:00 2001 From: Julien Chastang Date: Thu, 8 Jul 2021 18:09:23 -0600 Subject: [PATCH] more info about notarization --- release/certs.md | 76 ++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 67 insertions(+), 9 deletions(-) diff --git a/release/certs.md b/release/certs.md index 7a98c0aaea..02f64ba475 100644 --- a/release/certs.md +++ b/release/certs.md @@ -371,7 +371,7 @@ Examine the contents of the output (e.g., `codesign0` )for signature expiration - Primary Bundle ID - Obtain the `primary-bundle-id` from `/Volumes/idv/Integrated\ Data\ Viewer\ Installer.app/Contents/Info.plist`, `CFBundleIdentifier` element. (I actually do not know if an accurate `primary-bundle-id` matters, but this is what I did and it worked.) + Open the DMG you just fetched. This step will mount it into `/Volumes/idv`. Obtain the `primary-bundle-id` from `/Volumes/idv/Integrated\ Data\ Viewer\ Installer.app/Contents/Info.plist`, `CFBundleIdentifier` element. (I actually do not know if an accurate `primary-bundle-id` matters, but this is what I did and it worked.) - app-specific Password @@ -393,18 +393,76 @@ Examine the contents of the output (e.g., `codesign0` )for signature expiration RequestUUID = e8d76646-d018-468d-bb0f ``` - If the upload attempt was not successful, you will get a lengthy error log with some obscure error codes. In that case, just try again. Sometimes, you'll have to try a few times before it works. Hopefully, after a few minutes you will get an email saying "Your Mac software was successfully notarized". If not successful, you'll have to run + If the upload attempt was not successful, you will get a lengthy error log with some obscure error codes. In that case, just try again. Sometimes, you'll have to try a few times before it works. Hopefully, after a few minutes you will get an email saying "Your Mac software was successfully notarized". - ```shell - xcrun altool --notarization-info -u -p \ - - ``` + - Notarization Failures + + After upload to Apple, if there are notarization failures you will see an email from Apple Developer titled "Your Mac software was not notarized". In this case you will have to access the notarization failure with: + + ```shell + xcrun altool --notarization-info -u -p \ + + ``` + + This command will return a message that contains a URL where you can find the error log. **Note** notarization failures are considered by Apple as "upload" failures. This language is somewhat confusing since the DMG may have uploaded to Apple without problems, but when the notarization process fails, it is **still** considered an "upload" failure. + + - Common Problems + + The most common problem you may encounter is 32-bit code which the notarization process will reject: + + ```yaml + { + "logFormatVersion": 1, + "jobId": "7c91ddea", + "status": "Invalid", + "statusSummary": "Archive contains critical validation errors", + "statusCode": 4000, + "archiveFilename": "idv_6_0_macos_installer.dmg", + "uploadDate": "2021-07-08T18:50:09Z", + "sha256": "e5d0afa", + "ticketContents": null, + "issues": [ + { + "severity": "error", + "code": null, + "path": "idv_6_0_macos_installer.dmg/Integrated Data Viewer Installer.app/Contents/Resources/app/67.dat/ncIdv.jar/com/sun/jna/darwin/libjnidispatch.jnilib", + "message": "The binary is not signed.", + "docUrl": null, + "architecture": "i386" + }, + { + "severity": "error", + "code": null, + "path": "idv_6_0_macos_installer.dmg/Integrated Data Viewer Installer.app/Contents/Resources/app/67.dat/ncIdv.jar/com/sun/jna/darwin/libjnidispatch.jnilib", + "message": "The signature does not include a secure timestamp.", + "docUrl": null, + "architecture": "i386" + }, + { + "severity": "error", + "code": null, + "path": "idv_6_0_macos_installer.dmg/Integrated Data Viewer Installer.app/Contents/Resources/app/67.dat/ncIdv.jar/com/sun/jna/darwin/libjnidispatch.jnilib", + "message": "The binary is not signed.", + "docUrl": null, + "architecture": "x86_64" + }, + { + "severity": "error", + "code": null, + "path": "idv_6_0_macos_installer.dmg/Integrated Data Viewer Installer.app/Contents/Resources/app/67.dat/ncIdv.jar/com/sun/jna/darwin/libjnidispatch.jnilib", + "message": "The signature does not include a secure timestamp.", + "docUrl": null, + "architecture": "x86_64" + } + ] + } + ``` - This command will return a message that contains a URL where you can find the error log. + In this case, make sure you obtain an `ncIdv.jar` from the THREDDS group that does not contain 32-bit code when building the IDV. -- Stapling +- Stapling After Successful Notarization - The last step as part of the notarization process is "stapling". + After the "successfully notarized" email from Apple, the last step as part of the notarization process is "stapling". ```shell xcrun stapler staple .dmg