davidvartan

I can repro this locally as well. Interesting if it's inconsistent with Apple docs and when Gatekeeper should be firing, as running stuff locally without distributing/downloading is somewhat out of scope for notarization.

Reached out about this to Apple dev support, hope to get more insight.

The Gatekeeper behavior is specific to running things from Finder (not Terminal), and only if you downloaded it via a browser that sets the com.apple.quarantine xattr.

Two posts from Apple dev support (Cmd+F "eskimo") describe this in more detail.

https://forums.developer.apple.com/thread/127709

https://forums.developer.apple.com/thread/127694

Notarization/stapling/etc. is for distribution only, not generally part of your dev workflow.

Re: downloading Xcode, this page has saved me hours: https://stackoverflow.com/questions/10335747/how-to-download.... It's just a list of direct links to each version of Xcode at apple.com. Mystery why Mac App Store downloads still can't be bulletproof after all these years.

> a degraded user experience, as the first time a user runs a new executable, Apple delays execution while waiting for a reply from their server.

The way to avoid this behavior is to staple the notarization ticket to your bundle (or dmg/pkg), i.e. "/usr/bin/stapler staple <path>." Otherwise, Gatekeeper will fetch the ticket and staple it for the user on the first run.

(I'm the author of xcnotary [1], a tool to make notarization way less painful, including uploading to Apple/polling for completion/stapling/troubleshooting various code signing issues.)

[1] https://github.com/akeru-inc/xcnotary

Shameless plug: I created xcnotary [1] to make command line notarization quite a bit less painful. It will poll the service and block for completion, return a non-zero failure code for CI, and will even audit your app for some common code signing issues prior to uploading it to Apple.

[1] https://github.com/akeru-inc/xcnotary

Thank you!

asciinema to generate a raw json file, then svg-term to convert it to svg

https://github.com/asciinema/asciinema

https://github.com/marionebl/svg-term-cli

(I ended up moving the SVG assets to GitHub Pages which hopefully fixes the issue others were seeing.)

It was surprising that they didn't provide an all-in-one blocking command, leaving everyone to write their own version of the submit(); while(true) { poll(); }.

I will need to add support for .pkg to cover more use cases. (Right now the tool specifically checks the input to be an .app bundle and zips it up for submission.)

The notarization service is opaque (uses Xcode's "xcrun altool" to submit/read status, instead of something like a REST API...) so unfortunately Mac-only at the moment.

That sounds like a fun project! I do hope Apple shows more love to the command line tooling in general (even if Mac-only) as the workflow still seems somewhat optimized for clicking one-by-one in Xcode.

Thanks for the heads up! May I ask what browser you are using? If there are compatibility issues I may just re-render these as GIFs.

(The author.) I had originally written a version of this in Python for my own use, and recently thought of rewriting it in Rust as a learning experience.

What I found is that writing a CLI in Rust is a absolute breeze, in part due to excellent documentation and the tooling, and also thanks to various well-maintained crates, such as StructOpt [1] to parse command line arguments of any complexity, or indicatif [2] to show animated progress.

[1] https://github.com/akeru-inc/xcnotary/blob/11649e49892d81754...

[2] https://github.com/akeru-inc/xcnotary/blob/11649e49892d81754...