title: Failure digitally signing a Mac app outside Xcode
body: <p>I develop a Mac app with Qt5, so outside Xcode. I want GateKeeper to allow my app to run on clients' computers rather than issuing the "Can't be opened because the identity of the developer cannot be confirmed" warning.</p>
  
  <p>I have successfully digitally signed the app but GateKeeper still comes with this complaint. I have an Apple developer certificate (I am the Team Agent) and my keychain says it is valid. I also have installed two Apple root certificates.</p>
  
  <p>I use the command line utility <code>codesign</code> to digitally sign all the binaries inside the app folder and in addition I digitally sign the app folder itself. In all cases the response of codesign is informative and displays no error. With codesign I can check that indeed all the binaries are signed, running<br /> </p>
  
  <pre><code>$ codesign --verify --deep --verbose=2 MyApp.app
  </code></pre>
  
  <p>shows that <em>all</em> binaries are <em>validated</em>. And in addition it reports: </p>
  
  <blockquote>
    <p>MyApp.app: valid on disk <br/>
    MyApp.app: satisfies its Designated Requirement<br/></p>
  </blockquote>
  
  <p>Running:</p>
  
  <pre><code>$ codesign -v --verbose=4 --display MyApp.app   
  </code></pre>
  
  <p>gives</p>
  
  <blockquote>
    <p>Executable=/Users/xxx/trunk/yyy/deploy/release/MyApp.app/Contents/MacOS/MyApp <br/>
    Identifier=aaaa.MyApp <br/>
    Format=bundle with Mach-O thin (x86_64) <br/>
    CodeDirectory v=20200 size=12461 flags=0x0(none) hashes=616+3          location=embedded <br/>
    Hash type=sha1 size=20 <br/>
    CDHash=d1c12c783dac0e8d9a2b749fb896b11558cec8b6<br/>
    Signature size=8532<br/>
    Authority=Developer ID Application: XXXXX<br/>
    Authority=Developer ID Certification Authority<br/>
    Authority=Apple Root CA<br/>
    Timestamp=29 jul. 2015 12;04:40 <br/>
    Info.plist entries=8 <br/>
    TeamIdentifier=YYYYY <br/>
    Sealed Resources version=2 rules=12 files=10<br/>
    Internal requirements count=1 size=180<br/></p>
  </blockquote>
  
  <p>which seems OK.</p>
  
  <p>Running </p>
  
  <pre><code>$ spctl -a -t exec -vv MyApp.app
  </code></pre>
  
  <p>on <em>all</em> binaries gives as result</p>
  
  <blockquote>
    <p>MyApp.app: accepted <br/>
    source=Developer ID <br/>
    origin=Developer ID Application: XXXX<br/></p>
  </blockquote>
  
  <p>which also seems OK</p>
  
  <p>Running the XCode command line tool check-signature
   on the app or on the binaries inside the app folder: <br/></p>
  
  <pre><code>$ ./check-signature /Users/xxx/trunk/yyy/release/MyApp.app
  </code></pre>
  
  <p>gives as result</p>
  
  <blockquote>
    <p>(c) 2014 Apple Inc.  All rights reserved. <br/>
    YES <br/></p>
  </blockquote>
  
  <p>which in <em>all</em> cases is the desired result.</p>
  
  <p>But GateKeeper still does not accept the app and complains about the fact that the developer cannot be confirmed.</p>
  
  <p><strong>[added by author on Friday July 17, 2015]</strong><br /></p>
  
  <p>I think I have found the problem. I do not know whether it is a feature or an OSX bug. I was helped a lot by stackoverflow <a href="https://stackoverflow.com/questions/19551298/app-cant-be-opened-because-it-is-from-an-unidentified-developer">question 19551298</a>.</p>
  
  <p>Whenever a file is downloaded from the internet it gets an extended file attribute com.apple.quarantine associated with it. When double-clicking on this downloaded file in Finder, GateKeeper has two possibilities:</p>
  
  <ol>
  <li><p>When the file is not signed it issues the "Unidentified developer etc" message</p></li>
  <li><p>When the file is digitally signed it issues the "Developer cannot be confirmed etc" message</p></li>
  </ol>
  
  <p>In both cases the MessageBox has only one button, an OK button. When this button is clicked nothing happens, apart from the MessageBox closing.</p>
  
  <p>If the extended attribute is deleted (xattr -d) the applications runs, signed or not. </p>
  
  <p>The behavior is different when the applications is started by right-mouse-button-clicking in Finder on the app and then click on the "open" menu action. Again one of the two messageboxes is shown, but now with an extra button to allow the user to open the app anyway. Again the only difference between signed and not signed is the "Unidentified" or the "Not confirmed" message. I do not expect my customers to be able to tell the differende. As a result signing the app is an exercise in futility.</p>
  
  <p>On the basis of the <a href="https://support.apple.com/en-us/HT201940" rel="nofollow noreferrer">Apple Support Documentation</a> I expected another, much nicer behavior of GateKeeper when double clicking a downloaded app (perhaps the documentation is outdated, or I misread it):<br /></p>
  
  <ol>
  <li><p>if the app is signed GateKeeper should show a MessageBox with "Downloaded from the internet etc" and a button with "Proceed anyway?"</p></li>
  <li><p>if the app is not signed a MessageBox with a single OK button and a text "Unidentified developer etc.."</p></li>
  </ol>