Created attachment 922 [details]
Log from Apple for the latest successful notarization of tlclient
Since Feb 3 2020 Apple have made the requirements more strict for notarizing apps:
Ever since we started notarizing the macOS tlclient in bug 7371 we have gotten warnings about pulseaudio, ssh and all other help-binaries that the ThinLinc Client uses. Now with the new strict prerequisites these warnings have turned into errors.
Created attachment 923 [details]
Log from Apple for a failed notarization of tlclient after Feb 3 2020
There are three different problems with the package that the notarization complains about:
* libraries and sub-binaries are not signed
* libraries and sub-binaries do not have a timestamp
* main app and sub-binaries does not have hardened runtime enabled
We currently sign only the main app with the options deep and timestamp. This resource at developer.apple.com says it's not recommended to use --deep:
> Important: While the --deep option can be applied to a signing operation, this is not recommended. We recommend that you sign code inside out in individual stages (as Xcode does automatically). Signing with --deep is for emergency repairs and temporary adjustments only
So we should ideally not sign with --deep anymore.
(In reply to comment #2)
> * libraries and sub-binaries are not signed
> * libraries and sub-binaries do not have a timestamp
I tested manually signing each binary and library that the notarization complained about with --timestamp, and then signing the main app without --deep. After I tried notarizing that one it no longer complained about the above two issues.
We should try to make the script find which files in the bundle that needs signing without a hard-coded list.
Should be ready for testing now.
Seems to work fine.
I followed our signing instructions which correctly signed and notarised the client. It was accepted by macOS 10.15 both when downloaded as a .iso or the entire client bundle. (A dialog popped up where it was possible to click "open")
* Local drives
* Smart cards
* Local printer
* Audio playback
* Audio recording
Everything works correctly.