macOS下Kext notarization

最近Mac 10.14.15下编译的kext加载不成功，最后发现是macOS 10.14.5引入notarization机制造成的.

xcode编译好kext后终端里运行
sudo chmod -R 755 my.kext
sudo chown -R root:wheel my.kext
加载驱动
sudo kextutil my.kext

如果出错会提示：
System Extension Blocked
A program tried to load one or more system extensions that are incompatible with this version of macOS, Please contact “… CO.,LTD” for support.

终端里会提示：Kext rejected due to system policy:

因为10.14.5后kext需要notarization才能顺利加载

spctl --assess --type install --context context:primary-signature -v my.kext
需要这样才能加载成功
my.kext/: accepted
source=Notarized Developer ID
这样不能加载成功
my.kext/: rejected
source=Unnotarized Developer ID

notarization先需要打包成zip文件
ditto -c -k --keepParent “my.kext” "my.kext.zip"

提交notarization申请,-u参数后接开发者帐号,-p后接APP-SPECIFIC PASSWORDS
xcrun altool --notarize-app -f ./my.kext.zip --primary-bundle-id com.my.kext -u -p
终端里提示获得RequestUUID = af5d1d35-f0e5-459e-95d6-cd385244bd08

确认是不是提交成功
xcrun altool --notarization-info af5d1d35-f0e5-459e-95d6-cd385244bd08 -u -p

确认本地的kext
spctl --assess --type install --context context:primary-signature -v my.kext

成功后还会收到apple公司的邮件

需要注意的是xcrun altool 提交notarization时需要通过apple ID(https://appleid.apple.com)申请APP-SPECIFIC PASSWORDS

联系我可通过fatbaby@163.com