title: How properly add MacOS Signature & Notarization to .app built with Qt
body: <p>I have an application (built with Qt / QML) that I am trying to sign and notarize for Ad hoc distribution outside the App Store (it's for internal company use).  Apple confirms that my software has been notarized, and I then staple my .app - but Gatekeeper still stops the application from running and alerts users: </p>
  
  <blockquote>
    <p><em>App Name</em> can’t be opened because Apple cannot check it for malicious
    software.</p>
  </blockquote>
  
  <p><strong>What am I doing wrong?</strong>.</p>
  
  <p>Here are the steps that I am following:</p>
  
  <ol>
  <li><p>Ran QMake / Build in Qt Creator.</p></li>
  <li><p>Modified the CFBundleIdentifier key in the generated Info.plist file to be com.<em>myCompanyName</em>.<em>appName</em> instead of com.yourcompany.<em>appName</em> as generated by Qt.</p></li>
  <li><p><code>cd</code> to my build dir.</p></li>
  <li><p>Ran macdeployqt: <br> <code>/Users/&lt;user&gt;/Qt/5.13.0/clang_64/bin/macdeployqt &lt;appName&gt;.app -qmldir=&lt;project source code dir&gt;</code>.</p></li>
  <li><p>Code Sign: <br> <code>codesign --deep -f -s "Developer ID Application: &lt;company name&gt; (&lt;team id&gt;)" --options "runtime" "&lt;appName&gt;.app/"</code>
  <br>
  (Where the developer id application is the name as it appears in KeychainAccess).</p></li>
  <li><p>Verified that the signature: <br> <code>codesign -dv --verbose=4 &lt;appName&gt;.app</code> <br> <strong>Returns:</strong> <br></p>
  
  <pre><code>`Executable=&lt;build dir&gt;/&lt;app name&gt;.app/Contents/MacOS/&lt;app name&gt;
  Identifier=com.&lt;company name&gt;.&lt;app name&gt;
  Format=app bundle with Mach-O thin (x86_64)
  CodeDirectory v=20200 size=53750 flags=0x10000(runtime) hashes=1674+3 location=embedded
  Library validation warning=OS X SDK version before 10.9 does not support Library Validation
  VersionPlatform=1
  VersionMin=658432
  VersionSDK=0
  Hash type=sha256 size=32
  CandidateCDHash sha256=*************************************
  CandidateCDHashFull sha256=*************************************
  Hash choices=sha256
  CMSDigest=*************************************
  CMSDigestType=2
  Page size=4096
  CDHash=*************************************
  Signature size=8990
  Authority=Developer ID Application: &lt;my company name&gt; (&lt;my team ID&gt;)
  Authority=Developer ID Certification Authority
  Authority=Apple Root CA
  Timestamp=May 27, 2020 at 2:35:38 PM
  Info.plist entries=10
  TeamIdentifier=V7L2LD4Q9S
  Sealed Resources version=2 rules=13 files=1198
  Internal requirements count=1 size=184
  </code></pre>
  
  <p>Or if I look at a (chosen at random) executable from the Qt framework inside the app bundle: <br> <code>codesign -dv --verbose=4 &lt;appName&gt;.app/Contents/Frameworks/QtCore.framework/Versions/5/QtCore</code> <br> <strong>Returns:</strong></p>
  
  <pre><code>Executable=&lt;build dir&gt;/&lt;app name&gt;.app/Contents/Frameworks/QtCore.framework/Versions/5/QtCore
  Identifier=org.qt-project.QtCore
  Format=bundle with Mach-O thin (x86_64)
  CodeDirectory v=20500 size=49057 flags=0x10000(runtime) hashes=1526+3 location=embedded
  VersionPlatform=1
  VersionMin=658432
  VersionSDK=658944
  Hash type=sha256 size=32
  CandidateCDHash sha256=*************************************
  CandidateCDHashFull sha256=*************************************
  Hash choices=sha256
  CMSDigest=*************************************
  CMSDigestType=2
  Page size=4096
  CDHash=*************************************
  Signature size=8990
  Authority=Developer ID Application: &lt;my company name&gt; (&lt;my team ID&gt;)
  Authority=Developer ID Certification Authority
  Authority=Apple Root CA
  Timestamp=May 27, 2020 at 2:35:37 PM
  Info.plist entries=8
  TeamIdentifier=V7L2LD4Q9S
  Runtime Version=10.14.0
  Sealed Resources version=2 rules=13 files=1
  Internal requirements count=1 size=184
  </code></pre></li>
  <li><p>zip: <code>ditto -ck --rsrc --sequesterRsrc "&lt;appName&gt;.app" "&lt;appName&gt;.zip"</code></p></li>
  <li><p>Upload for notarization: <br>
  <code>xcrun altool --notarize-app -t osx -f &lt;appName&gt;.zip --primary-bundle-id="com.&lt;my company name&gt;.&lt;appName&gt;" -u "&lt;develpper ID @ company name&gt; -p "&lt;app specific password&gt;"</code></p></li>
  <li><p>Receive an email that "Your Mac software was successfully notarized."</p></li>
  <li><p>Staple: <code>xcrun stapler staple "&lt;appName&gt;.app"</code>
   <br><strong>Returns:</strong> <code>The staple and validate action worked!</code></p></li>
  <li><p>Distribute:</p>
  
  <ol>
  <li>Create a blank sparse bundle disk image.</li>
  <li>Copy the <em>appName</em>.app bundle to it (along with a shortcut to /Applications).</li>
  <li>Convert to read only.</li>
  <li>Distribute to users.</li>
  </ol></li>
  </ol>
  
  <p><hr>
  If I look in Console.app - I can see in the logs that the app is being denied to open:</p>
  
  <pre><code>default 15:10:56.549137-0400    runningboardd   Invalidating assertion 294-139-3156 (target:executable&lt;&lt;appName&gt;(501)&gt;) from originator 139
  default 15:11:01.061942-0400    runningboardd   [executable&lt;&lt;appName&gt;(501)&gt;:4893] Death sentinel fired!
  </code></pre>
  
  <p>There is nothing in the console with <code>XprotectService</code> as <a href="https://stackoverflow.com/questions/57174961/macos-notarize-gatekeeper-does-not-recognize-notarized-app">this</a> SO answer suggests.</p>
  
  <p><hr>
  If I try to use spctl to check the signature, it fails:</p>
  
  <p><code>spctl -v -a -t open --context context:primary-signature &lt;appName&gt;.app</code>
  <br>
  <strong>Returns:</strong></p>
  
  <pre><code>opal.app: rejected
  source=Unnotarized Developer ID
  </code></pre>
  
  <p><code>spctl -a -t exec -vv &lt;appName&gt;.app produces</code>
  <br>
  <strong>Returns:</strong></p>
  
  <pre><code>&lt;appName&gt;.app: rejected
  source=Unnotarized Developer ID
  origin=Developer ID Application: &lt;my company name&gt; (&lt;team ID&gt;)
  produces: invalid API object reference
  </code></pre>
  
  <p><hr>
  However, if I use stapler to validate the app, it passes:
  <br>
  <code>stapler validate &lt;appName&gt;.app</code>
  <br>
  <strong>Returns:</strong></p>
  
  <pre><code>Processing: /&lt;build dir&gt;/&lt;appName&gt;.app
  The validate action worked!
  </code></pre>
  
  <p><hr>
  <strong>About my environment:</strong></p>
  
  <p>MacOS 10.15.3 <br>
  Qt 5.13 <br>
  Xcode 11.4</p>