asc-notarization by rudrankriyam/asc-skills
npx skills add https://github.com/rudrankriyam/asc-skills --skill asc-notarization当您需要为 App Store 以外的分发渠道对 macOS 应用进行公证时,请使用此技能。
asc auth login 或 ASC_* 环境变量)。在归档之前,确认存在有效的开发者 ID 应用程序身份:
security find-identity -v -p codesigning | grep "Developer ID Application"
如果未找到身份,请在 https://developer.apple.com/account/resources/certificates/add 创建一个(App Store Connect API 不支持创建开发者 ID 证书)。
如果 codesign 或 xcodebuild 失败并提示 "Invalid trust settings" 或 "errSecInternalComponent",可能是证书存在破坏信任链的自定义信任覆盖:
# 检查自定义信任设置
security dump-trust-settings 2>&1 | grep -A1 "Developer ID"
# 如果存在覆盖,导出证书并移除它们
security find-certificate -c "Developer ID Application" -p ~/Library/Keychains/login.keychain-db > /tmp/devid-cert.pem
security remove-trusted-cert /tmp/devid-cert.pem
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
修复信任设置后,验证信任链是否完整:
codesign --deep --force --options runtime --sign "Developer ID Application: YOUR NAME (TEAM_ID)" /path/to/any.app 2>&1
签名必须显示以下链:开发者 ID 应用程序 → 开发者 ID 认证机构 → Apple 根证书颁发机构。
xcodebuild archive \
-scheme "YourMacScheme" \
-configuration Release \
-archivePath /tmp/YourApp.xcarchive \
-destination "generic/platform=macOS"
为开发者 ID 分发创建一个 ExportOptions plist 文件:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>method</key>
<string>developer-id</string>
<key>signingStyle</key>
<string>automatic</string>
<key>teamID</key>
<string>YOUR_TEAM_ID</string>
</dict>
</plist>
导出归档文件:
xcodebuild -exportArchive \
-archivePath /tmp/YourApp.xcarchive \
-exportPath /tmp/YourAppExport \
-exportOptionsPlist ExportOptions.plist
这将生成一个使用开发者 ID 应用程序签名并带有安全时间戳的 .app 包。
codesign -dvvv "/tmp/YourAppExport/YourApp.app" 2>&1 | grep -E "Authority|Timestamp"
确认:
ditto -c -k --keepParent "/tmp/YourAppExport/YourApp.app" "/tmp/YourAppExport/YourApp.zip"
asc notarization submit --file "/tmp/YourAppExport/YourApp.zip"
asc notarization submit --file "/tmp/YourAppExport/YourApp.zip" --wait
asc notarization submit --file "/tmp/YourAppExport/YourApp.zip" --wait --poll-interval 30s --timeout 1h
asc notarization status --id "SUBMISSION_ID" --output table
asc notarization log --id "SUBMISSION_ID"
获取日志 URL 以查看详细问题:
curl -sL "LOG_URL" | python3 -m json.tool
asc notarization list --output table
asc notarization list --limit 5 --output table
公证成功后,装订票据以使应用在离线状态下工作:
xcrun stapler staple "/tmp/YourAppExport/YourApp.app"
对于 DMG 或 PKG 分发,请在创建容器后装订:
# 创建 DMG
hdiutil create -volname "YourApp" -srcfolder "/tmp/YourAppExport/YourApp.app" -ov -format UDZO "/tmp/YourApp.dmg"
xcrun stapler staple "/tmp/YourApp.dmg"
| 格式 | 使用场景 |
|---|---|
.zip | 最简单;将已签名的 .app 包压缩 |
.dmg | 用于拖放安装的磁盘映像 |
.pkg | 安装程序包(需要开发者 ID 安装程序证书) |
要对 .pkg 文件进行公证,您需要一个开发者 ID 安装程序证书(与开发者 ID 应用程序证书不同)。此证书类型无法通过 App Store Connect API 获取 — 请在 https://developer.apple.com/account/resources/certificates/add 创建。
对包进行签名:
productsign --sign "Developer ID Installer: YOUR NAME (TEAM_ID)" unsigned.pkg signed.pkg
然后提交:
asc notarization submit --file signed.pkg --wait
开发者 ID 证书存在自定义信任覆盖。请参阅上文的预检部分以移除它们。
应用使用了开发或 App Store 证书签名。请使用 ExportOptions.plist 中的 method: developer-id 重新导出。
在手动 codesign 调用中添加 --timestamp,或使用会自动添加时间戳的 xcodebuild -exportArchive。
设置更长的上传超时时间:
ASC_UPLOAD_TIMEOUT=5m asc notarization submit --file ./LargeApp.zip --wait
获取开发者日志以查看具体问题:
asc notarization log --id "SUBMISSION_ID"
常见原因:未签名的嵌套二进制文件、缺少强化运行时、嵌入的库没有时间戳。
asc notarization 命令使用 Apple Notary API v2,而非 xcrun notarytool。asc 命令相同的 API 密钥。--help 验证标志:asc notarization submit --help。每周安装量
230
代码仓库
GitHub 星标数
593
首次出现
2026年2月9日
安全审计
安装于
codex220
opencode201
gemini-cli198
kimi-cli197
github-copilot197
amp197
Use this skill when you need to notarize a macOS app for distribution outside the App Store.
asc auth login or ASC_* env vars).Before archiving, confirm a valid Developer ID Application identity exists:
security find-identity -v -p codesigning | grep "Developer ID Application"
If no identity is found, create one at https://developer.apple.com/account/resources/certificates/add (the App Store Connect API does not support creating Developer ID certificates).
If codesign or xcodebuild fails with "Invalid trust settings" or "errSecInternalComponent", the certificate may have custom trust overrides that break the chain:
# Check for custom trust settings
security dump-trust-settings 2>&1 | grep -A1 "Developer ID"
# If overrides exist, export the cert and remove them
security find-certificate -c "Developer ID Application" -p ~/Library/Keychains/login.keychain-db > /tmp/devid-cert.pem
security remove-trusted-cert /tmp/devid-cert.pem
After fixing trust settings, verify the chain is intact:
codesign --deep --force --options runtime --sign "Developer ID Application: YOUR NAME (TEAM_ID)" /path/to/any.app 2>&1
The signing must show the chain: Developer ID Application → Developer ID Certification Authority → Apple Root CA.
xcodebuild archive \
-scheme "YourMacScheme" \
-configuration Release \
-archivePath /tmp/YourApp.xcarchive \
-destination "generic/platform=macOS"
Create an ExportOptions plist for Developer ID distribution:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>method</key>
<string>developer-id</string>
<key>signingStyle</key>
<string>automatic</string>
<key>teamID</key>
<string>YOUR_TEAM_ID</string>
</dict>
</plist>
Export the archive:
xcodebuild -exportArchive \
-archivePath /tmp/YourApp.xcarchive \
-exportPath /tmp/YourAppExport \
-exportOptionsPlist ExportOptions.plist
This produces a .app bundle signed with Developer ID Application and a secure timestamp.
codesign -dvvv "/tmp/YourAppExport/YourApp.app" 2>&1 | grep -E "Authority|Timestamp"
Confirm:
ditto -c -k --keepParent "/tmp/YourAppExport/YourApp.app" "/tmp/YourAppExport/YourApp.zip"
asc notarization submit --file "/tmp/YourAppExport/YourApp.zip"
asc notarization submit --file "/tmp/YourAppExport/YourApp.zip" --wait
asc notarization submit --file "/tmp/YourAppExport/YourApp.zip" --wait --poll-interval 30s --timeout 1h
asc notarization status --id "SUBMISSION_ID" --output table
asc notarization log --id "SUBMISSION_ID"
Fetch the log URL to see detailed issues:
curl -sL "LOG_URL" | python3 -m json.tool
asc notarization list --output table
asc notarization list --limit 5 --output table
After notarization succeeds, staple the ticket so the app works offline:
xcrun stapler staple "/tmp/YourAppExport/YourApp.app"
For DMG or PKG distribution, staple after creating the container:
# Create DMG
hdiutil create -volname "YourApp" -srcfolder "/tmp/YourAppExport/YourApp.app" -ov -format UDZO "/tmp/YourApp.dmg"
xcrun stapler staple "/tmp/YourApp.dmg"
| Format | Use Case |
|---|---|
.zip | Simplest; zip a signed .app bundle |
.dmg | Disk image for drag-and-drop install |
.pkg | Installer package (requires Developer ID Installer certificate) |
To notarize .pkg files, you need a Developer ID Installer certificate (separate from Developer ID Application). This certificate type is not available through the App Store Connect API — create it at https://developer.apple.com/account/resources/certificates/add.
Sign the package:
productsign --sign "Developer ID Installer: YOUR NAME (TEAM_ID)" unsigned.pkg signed.pkg
Then submit:
asc notarization submit --file signed.pkg --wait
The Developer ID certificate has custom trust overrides. See the Preflight section above to remove them.
The app was signed with a Development or App Store certificate. Re-export with method: developer-id in ExportOptions.plist.
Add --timestamp to manual codesign calls, or use xcodebuild -exportArchive which adds timestamps automatically.
Set a longer upload timeout:
ASC_UPLOAD_TIMEOUT=5m asc notarization submit --file ./LargeApp.zip --wait
Fetch the developer log for specific issues:
asc notarization log --id "SUBMISSION_ID"
Common causes: unsigned nested binaries, missing hardened runtime, embedded libraries without timestamps.
asc notarization commands use the Apple Notary API v2, not xcrun notarytool.asc commands.--help to verify flags: asc notarization submit --help.Weekly Installs
230
Repository
GitHub Stars
593
First Seen
Feb 9, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykWarn
Installed on
codex220
opencode201
gemini-cli198
kimi-cli197
github-copilot197
amp197
agent-browser 浏览器自动化工具 - Vercel Labs 命令行网页操作与测试
144,300 周安装
Conventional Commit规范提交助手 - GitHub Copilot自动生成标准化提交信息
8,400 周安装
Web界面规范检查工具 - 自动验证代码符合Vercel设计指南
8,400 周安装
.NET/C# 最佳实践指南:代码规范、设计模式、依赖注入与AI集成
8,700 周安装
网站设计审查工具 - 自动检测并修复HTML/CSS/JS、React、Vue等框架的视觉与布局问题
8,700 周安装
Playwright MCP 测试生成工具 - 自动生成 TypeScript 端到端测试代码
8,800 周安装
React Native 最佳实践与性能优化指南 | 提升应用FPS、启动速度与包体积
8,800 周安装