I'd suggest the latest versions of Big Sur, so 11.7. My work laptop is on 12 which is also fine. macOS 13 Ventura comes out soon, but it's too soon to set up a build environment for it, at least on a server.

On Oct 8, 2022, at 3:16 PM, Lucas Cordiviola lucarda27@hotmail.com wrote:

...

Actually using altool is deprecated and you get a warning that the uploads will fail after a certain date. Xcode 13+ uses notarytool and will be the only way to submit for notarization in the (near) future. You will need a VM running macOS 11.3 at a minimum to install Xcode 13.

I'll try to get a 11.3 VM. I'm away from the "server room" for a couple of days.

Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com http://danomatika.com/ robotcowboy.com http://robotcowboy.com/

@ Dan

I'm back on my "machines home". I did:

xcrun notarytool

and I got its help options.

Do I need an apple developer account ?

I don't even have an apple id.

How should I proceed? do I wait for your script? do i get my apple id?

I'm sure I'm not the only one willing to provide arm64 builds (pd-porres has already inquired me on this).

--

Mensaje telepatico asistido por maquinas.

On 08/10/2022 10:46, Lucas Cordiviola wrote:

I meant "server room" as "machine room" or more accurate "home".

I actually have an Monterey VM via qemu on Debian11 (on some amd-A6 cpu). I tried xcrun --find altool and it returned not found.

I got xcode via xcode-select --install.

--

Mensaje telepatico asistido por maquinas.

On 10/8/2022 10:34 AM, Dan Wilcox wrote:

...

I'd suggest the latest versions of Big Sur, so 11.7. My work laptop is on 12 which is also fine. macOS 13 Ventura comes out soon, but it's too soon to set up a build environment for it, at least on a server.

...

On Oct 8, 2022, at 3:16 PM, Lucas Cordiviola lucarda27@hotmail.com wrote:

...

Actually using altool is deprecated and you get a warning that the uploads will fail after a certain date. Xcode 13+ uses notarytool and will be the only way to submit for notarization in the (near) future. You will need a VM running macOS 11.3 at a minimum to install Xcode 13.

I'll try to get a 11.3 VM. I'm away from the "server room" for a couple of days.

---

Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com http://danomatika.com robotcowboy.com http://robotcowboy.com

---

Pd-list@lists.iem.at mailing list UNSUBSCRIBE and account-management -> https://lists.puredata.info/listinfo/pd-list

@ Dan

Thanks for sharing this. I'll be digging about  you need an Apple Developer account (and Apple ID to sign up for one). If there's no workaround about the us$100 i'll be giving up notarizing builds. Do you know of a way to not send money to the thieves (if i'm not mistaken) ?

or to put it in another way:

if I don't codesign/notarize the builds: is just that users have an "open anyway" dialog? or is it a total "show stopper" that quits Pd?

Which way should I go without the $100 ?

--

Mensaje telepatico asistido por maquinas.

On 11/10/2022 12:55, Dan Wilcox wrote:

Howdy Lucas,

I have the makefiles working but realize now I need to do some refactoring to better handle non-app bundles like dylib libraries. Apparently the notarization process is a little different. In any case, you can check them out for now but I will be working on them further:

https://github.com/zkmkarlsruhe/mac-app-builder

Yes, you need an Apple Developer account (and Apple ID to sign up for one) in order to create the certificates for code signing as well as notarization. The overview is in the readme.

The notarization process for dylibs appears to be:

• build the dylibs (in our case pd externals)
• codesign them
• notarize them (upload to Apple notarization server)
• package them into a disk image .dmg
• sign the dmg
• staple the dmg with the notarization ticket

Distributing via zip will not work in this case because the zip cannot be signed like a dmg.

I think it might make sense for us to make a Makefile.pdlibnotarizer or something similar.

I also have a separate repo with example programs (Cocoa, openFrameworks, console + dylib) for testing, but it's not ready yet. I managed to get the dylib signed this morning which is when I found out my assumptions for the whole process are different between apps and libs. :(

...

On Oct 11, 2022, at 4:48 PM, Lucas Cordiviola lucarda27@hotmail.com wrote:

@ Dan

I'm back on my "machines home". I did:

xcrun notarytool

and I got its help options.

Do I need an apple developer account ?

I don't even have an apple id.

How should I proceed? do I wait for your script? do i get my apple id?

I'm sure I'm not the only one willing to provide arm64 builds (pd-porres has already inquired me on this).

---

Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com http://danomatika.com robotcowboy.com http://robotcowboy.com

You already have you answer: no code signing or notarization means users get the security popup when the dylibs are loaded but they just have to select open as far as I know. Gatekeeper asks them once, then the system remembers the selection. I believe it may also require changing a privacy setting in System Preferences to allow it.

I already added the "Disable library validation" entitlement back for the first Pd release for 10.15 which introduced the stronger security settings.

Also, I think calling them "thieves" is misleading. If you don't want to use the platform or the services which are provided with the developer account, don't. No one is forcing you. Please don't contribute to FUD.

You could simply provide the code and perhaps the make files to automate the process, then convince an institution to pay for the developer account license. I included this as one of my expenses for my last funded iOS project... :)

On Oct 11, 2022, at 7:12 PM, Lucas Cordiviola lucarda27@hotmail.com wrote:

@ Dan

Thanks for sharing this. I'll be digging about you need an Apple Developer account (and Apple ID to sign up for one). If there's no workaround about the us$100 i'll be giving up notarizing builds. Do you know of a way to not send money to the thieves (if i'm not mistaken) ?

or to put it in another way:

if I don't codesign/notarize the builds: is just that users have an "open anyway" dialog? or is it a total "show stopper" that quits Pd?

Which way should I go without the $100 ?

Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com http://danomatika.com/ robotcowboy.com http://robotcowboy.com/

looks like you can „ask apple“ only if you are "members of the Apple Developer Program or Apple Developer Enterprise Program“ furthermore topics are set to apples latest + shiniest https://developer.apple.com/events/ask-apple/questions-and-answers/ https://developer.apple.com/events/ask-apple/questions-and-answers/

your proposed question is great: I would like to know how an open source project which relies on freely-shared plugins is supposed to exist on a platform that is making it harder on accessibility. just apple doesn´t seem to provide a slot to ask it - they might have their reasons…

i could try to wrestle my institution into paying for a dev account, which i could open up to people like lucas. another possibility would be a donated dev account - 100$ per year is like 2 beers per month. drink less, have more code :-) would that even be allowed by apple?

best hans

Am 11.10.2022 um 23:37 schrieb Dan Wilcox danomatika@gmail.com:

Looks like we could “Ask Apple”…

https://developer.apple.com/events/ask-apple/ https://developer.apple.com/events/ask-apple/

I would like to know how an open source project which relies on freely-shared plugins is supposed to exist on a platform that is making it harder on accessibility.

I have had a developer account for many years but that doesn’t mean I like jumping through these hoops after spending too long figuring them out. It would be nicer if you, as a user, could simply tell the system: “Pd can load whatever dynamic libs.”

It’s the same situation for other environments such as Max.

enohp ym morf tnes

Dan Wilcox danomatika.com robotcowboy.com

...

On Oct 11, 2022, at 8:01 PM, Dan Wilcox danomatika@gmail.com wrote:

You already have you answer: no code signing or notarization means users get the security popup when the dylibs are loaded but they just have to select open as far as I know. Gatekeeper asks them once, then the system remembers the selection. I believe it may also require changing a privacy setting in System Preferences to allow it.

I already added the "Disable library validation" entitlement back for the first Pd release for 10.15 which introduced the stronger security settings.

Also, I think calling them "thieves" is misleading. If you don't want to use the platform or the services which are provided with the developer account, don't. No one is forcing you. Please don't contribute to FUD.

You could simply provide the code and perhaps the make files to automate the process, then convince an institution to pay for the developer account license. I included this as one of my expenses for my last funded iOS project... :)

...

On Oct 11, 2022, at 7:12 PM, Lucas Cordiviola <lucarda27@hotmail.com mailto:lucarda27@hotmail.com> wrote:

@ Dan

Thanks for sharing this. I'll be digging about you need an Apple Developer account (and Apple ID to sign up for one). If there's no workaround about the us$100 i'll be giving up notarizing builds. Do you know of a way to not send money to the thieves (if i'm not mistaken) ?

or to put it in another way:

if I don't codesign/notarize the builds: is just that users have an "open anyway" dialog? or is it a total "show stopper" that quits Pd?

Which way should I go without the $100 ?

---

Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com http://danomatika.com/ robotcowboy.com http://robotcowboy.com/

---

Pd-list@lists.iem.at mailing list UNSUBSCRIBE and account-management -> https://lists.puredata.info/listinfo/pd-list

One option is to directly circumvent the app/binary quarantine process. Essentially, you can remove the quarantine flag manually:

sudo xattr -r -d com.apple.quarantine path/to/MyApp.app

Print the current flags to check with:

xattr path/to/MyApp.app

I think this should work with dylibs as well.

The externals could be shipped with an additional script for macOS which users can run once to remove the compiled externals from quarantine. There should be no more popups after.

This does, however, open up possible attack vectors, but anything more than what we already had before. I think it is a reasonable approach to ask users to decide to run the script themselves, although there will be added friction.

On Wed, Oct 12, 2022 at 2:04 AM Alexandre Torres Porres porres@gmail.com wrote:

I'm still on old macs and I am not yet sure if my stuff is working or not in new macs. I just updated ELSE btw, I am now wondering if people can use it just fine or if it doesn't work or is a nightmare (like asking every time if on external should be loaded).

Em ter., 11 de out. de 2022 às 15:03, Dan Wilcox danomatika@gmail.com escreveu:

...

You already have you answer: no code signing or notarization means users get the security popup when the dylibs are loaded but they just have to select open as far as I know. Gatekeeper asks them once, then the system remembers the selection. I believe it may also require changing a privacy setting in System Preferences to allow it.

I already added the "Disable library validation" entitlement back for the first Pd release for 10.15 which introduced the stronger security settings.

Also, I think calling them "thieves" is misleading. If you don't want to use the platform or the services which are provided with the developer account, don't. No one is forcing you. Please don't contribute to FUD.

You could simply provide the code and perhaps the make files to automate the process, then convince an institution to pay for the developer account license. I included this as one of my expenses for my last funded iOS project... :)

On Oct 11, 2022, at 7:12 PM, Lucas Cordiviola lucarda27@hotmail.com wrote:

@ Dan

Thanks for sharing this. I'll be digging about you need an Apple Developer account (and Apple ID to sign up for one). If there's no workaround about the us$100 i'll be giving up notarizing builds. Do you know of a way to not send money to the thieves (if i'm not mistaken) ?

or to put it in another way:

if I don't codesign/notarize the builds: is just that users have an "open anyway" dialog? or is it a total "show stopper" that quits Pd?

Which way should I go without the $100 ?

---

Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com robotcowboy.com

---

Pd-list@lists.iem.at mailing list UNSUBSCRIBE and account-management -> https://lists.puredata.info/listinfo/pd-list