asc-notarization

1# macOS Notarization
2 
3Use this skill when you need to notarize a macOS app for distribution outside the App Store.
4 
5## Preconditions
6- Xcode installed and command line tools configured.
7- Auth is configured (`asc auth login` or `ASC_*` env vars).
8- A Developer ID Application certificate in the local keychain.
9- The app's Xcode project builds for macOS.
10 
11## Preflight: Verify Signing Identity
12 
13Before archiving, confirm a valid Developer ID Application identity exists:
14 
15```bash
16security find-identity -v -p codesigning | grep "Developer ID Application"
17```
18 
19If no identity is found, create one at https://developer.apple.com/account/resources/certificates/add (the App Store Connect API does not support creating Developer ID certificates).
20 
21### Inspect Trust Settings
22 
23If `codesign` or `xcodebuild` fails with "Invalid trust settings" or "errSecInternalComponent", the certificate may have custom trust overrides that break the chain:
24 
25```bash
26# Check for custom trust settings
27security dump-trust-settings 2>&1 | grep -A1 "Developer ID"
28```
29 
30These errors do not by themselves prove a trust override is the cause. Inspect the affected certificate before proposing a repair. Changing trust settings requires explicit authorization for that certificate; do not remove trust overrides or re-sign an arbitrary app as a diagnostic step.
31 
32## Step 1: Archive
33 
34```bash
35xcodebuild archive \
36  -scheme "YourMacScheme" \
37  -configuration Release \
38  -archivePath /tmp/YourApp.xcarchive \
39…