这里示范的是Qt程序的部署、签名及公证。
1.首先用macdeployqt xxx.app部署,不要加-dmg参数,如果出现第三方库依赖问题,百度查找解决办法,第三方库编译为静态库能少很多事,依赖的其它资源也放进去,比如我这边有个webui目录用来放html资源。
2.代码签名
entitlements.entitlements参考:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.security.app-sandbox</key>
<false/>
<key>com.apple.security.assets.movies.read-write</key>
<true/>
<key>com.apple.security.assets.music.read-write</key>
<true/>
<key>com.apple.security.assets.pictures.read-write</key>
<true/>
<key>com.apple.security.cs.allow-dyld-environment-variables</key>
<true/>
<key>com.apple.security.cs.allow-jit</key>
<true/>
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
<true/>
<key>com.apple.security.cs.debugger</key>
<true/>
<key>com.apple.security.cs.disable-executable-page-protection</key>
<true/>
<key>com.apple.security.cs.disable-library-validation</key>
<true/>
<key>com.apple.security.files.downloads.read-write</key>
<true/>
<key>com.apple.security.files.user-selected.read-write</key>
<true/>
<key>com.apple.security.network.client</key>
<true/>
<key>com.apple.security.personal-information.photos-library</key>
<true/>
<key>com.apple.security.print</key>
<true/>
</dict>
</plist>
权限设置不正确会导致签名后运行崩溃,我这边有读写~/.XXX,然后程序崩溃了,在xcode没找到设置除了相册、下载之类的常见目录以外的目录的权限条目,后来干脆关闭了沙盒(com.apple.security.app-sandbox)就好了。
签名:
codesign -f -o runtime --entitlements ./entitlements.entitlements --timestamp --deep -s "Developer ID Application: XXXXXXX (XXXXXXXXXX)" -v xxx.app
-s的值是证书名称,换成自己的。如果要重新签名,先移除之前的签名:
codesign --remove-signature xxx.app
此时查看签名状态是:
% spctl -a -v xxx.app
Dog.app: rejected
source=Unnotarized Developer ID
忽略,公证后就好了。
3.用xxx.app制作dmg包,重复步骤2,xxx.app换成dmg包名称,对dmg包签名
codesign -f -o runtime --entitlements ./entitlements.entitlements --timestamp --deep -s "Developer ID Application: XXXXXXX (XXXXXXXXXX)" -v xxx.dmg
4.公证
xcrun altool --notarize-app --primary-bundle-id "com.xxx.yyy" --username "开发者账号" --password "应用专用密码" --asc-provider "XXXXXXXXXX" -t osx --file xxx.dmg
应用专用密码如果没有,需要登录appleid.apple.com创建,asc-proider是
ProviderShortname,可通过以下命令查看:
xcrun altool --list-providers -u "开发者账号" -p "应用专用密码"
5.查看公证结果
xcrun altool --notarization-info xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx --username "开发者账号" --password "应用专用密码"
notarization-info是第4步得到的RequestUUID,如果看到Package Approved就是成功了,in progress表示处理中,一般几分钟就好。
公证后查看签名状态已变更为accepted:
% spctl -a -v xxx.app
Dog.app: accepted
source=Notarized Developer ID