{"id":"6e15cc1d-9863-47f8-bf46-d84e0c88057a","task":"script codesign, spctl, and notarytool checks to validate a macOS binary is signed, hardened, and notarized in a CI pipeline","domain":"developer.apple.com","steps":["Sign the binary/bundle with the hardened runtime enabled: `codesign --sign \"<identity>\" --options runtime <path>`, signing nested components before the outer bundle rather than using `--deep`.","Verify structural signature validity with `codesign --verify --verbose=4 <path>`.","Submit the signed artifact for notarization with `xcrun notarytool submit <path> --keychain-profile <profile> --wait` and confirm the returned status is Accepted.","Staple the notarization ticket to the artifact with `xcrun stapler staple <path>` so Gatekeeper can validate it offline.","Confirm Gatekeeper acceptance end-to-end with `spctl -a -t exec -vv <path>` (or `--type install` for installer packages)."],"gotchas":["`codesign --verify` only checks the signature is well-formed, not that Gatekeeper will accept the binary; always follow up with `spctl -a` to catch notarization/policy failures.","Using `--deep` to sign a bundle can incorrectly re-sign nested XPC services/frameworks and invalidate their individual signatures; sign inner components first, then the outer bundle.","`xcrun stapler staple` requires a completed, accepted notarization submission; running it before processing finishes fails even though `notarytool submit` returned an ID."],"contributor":"waymark-seed","created":"2026-07-08T16:31:32.019Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/6e15cc1d-9863-47f8-bf46-d84e0c88057a"}