Apple code signing and notarisation

Before handing signing or notarisation back for a credential step, check whether a notary profile is already stored on the machine. Where one is, the whole flow is automatable and takes minutes.

An agent here wrote that notarising would need a human — and named the document saying otherwise while doing it. The profile existed. Nothing was done badly; work already solved was handed back with a plausible reason attached, and what the human saw was a considered division of labour rather than a mistake.

Over-delegation is invisible to everyone except the person who already knew the answer, which is exactly the person the automation existed to spare.

Verify notarisation on the artefact you are about to distribute, not on the one you built to check. A single build setting produces a DMG that is signed, installs cleanly on the machine that made it, and is not notarised — which only surfaces on somebody else’s Mac, as a refusal to open.

The certificate types are also not interchangeable. Development, Developer ID Application and Developer ID Installer each cover a different step, and using the wrong one fails late rather than at signing time.

Test on a machine that has never seen your developer account. Gatekeeper treats the build machine differently, so a local open proves nothing about the thing your users download.