macOS Code Signing and DMG Packaging

macOS Code Signing and DMG Packaging

If you want to distribute a macOS application outside the App Store, you need to sign it with a Developer ID certificate. This certificate is issued by Apple and proves that you are a known developer. When users download your app, macOS checks this signature and shows it in the security dialog. Without a valid signature, macOS will refuse to run your app unless the user explicitly bypasses the security settings.

To get a Developer ID certificate, you need an Apple Developer account, which costs 99 dollars per year. Once you have an account, you can generate a certificate through the Apple Developer portal. The certificate is used with the codesign command-line tool, which is part of Xcode. The signing process embeds a digital signature in your application bundle that macOS can verify.

The most common way to distribute macOS applications is through a DMG file. A DMG is a disk image that appears as a mounted drive when opened. Users drag the application from the DMG to their Applications folder. To create a DMG, you first build and sign your application, then use the hdiutil command to create the disk image, and finally sign the DMG itself to ensure its integrity.

The signing process involves several steps. First, you sign all the frameworks and libraries inside your application bundle. Then you sign the main application executable. Finally, you sign the DMG file. Each step uses the codesign tool with your Developer ID certificate. The entire process can be automated in a build script, which is essential for continuous integration pipelines.