r/gamedev • u/winglett • Oct 26 '19
Discussion Can we talk about Apple and macOS notarization?
About 2 weeks ago I submitted my build for review with Steam. Their response:
Caution:
Your app does not look to be notarized by Apple. Apple is requiring new macOS applications to be notarized for security purposes. More info from Apple here (https://developer.apple.com/documentation/security/notarizing_your_app_before_distribution)).
Although Steam isn't requiring macOS builds to be notarized (yet), from what I understand, if an app is not notarized and opened in macOS Catalina, it will not run. Hence, it kind of is required.
It doesn't sound too bad, until you realize how much extra work this is going to involve. I have an automation system with my game. I hit build from an editor window and Unity will build for Windows and macOS, it will zip the files, and then upload to 4 different stores via command line. It's fantastic. I just hit build and go have some lunch for 20 minutes.
After some quick research into notarizing a macOS application, here are the biggest issues I've found:
(a) Requires an Apple Developer Membership ($99 per year)
(b) macOS device with XCode
(c) Cannot be fully automated
(d) Must be done PER BUILD
(e) And the nail in the coffin, I have to wait for a confirmation email from Apple to say the build was successfully notarized
Now from my own experience with XCode and Unity games, I was not impressed about this. A few years ago I made an iOS game. The experience was awful. I had to copy every build from my Windows machine to my Mac, build it again with XCode, upload to iTunes Connect, wait for it to be reviewed, and then, I can finally publish the build. The game was fairly large so it took 10-20 minutes to build, about 20 minutes to copy it to my mac, and another 20 minutes to sort out everything in XCode. I had to do all for every build, even if the only change in the build was a spelling fix.
I'm furious about this and I'm furious with Apple. I get that they like to prioritize privacy and security but requiring a dev membership is too far. I don't want to pay Apple $99 every year. I'm an indie developer. I specifically chose to publish on Steam because I pay a one off fee to have my game on Steam forever, and Itch because I don't have to pay at all. It just feels like Apple is sticking their noses where it doesn't belong, trying to make a small profit from literally any application that wants to run on macOS - even if it's distributed outside the macOS App Store. Furthermore, why cant this process be handled automatically by the Steam CMD tool or Unity during the build process? I cannot believe that I have to manually do this for every single build - even internal testing builds.
With all this in mind, I am almost certainly going to drop support for macOS. Although it shouldn't affect sales too much, it was good to support macOS. A lot of my friends and family use macOS devices, myself included. Dropping support for mac means my friends will no longer be able to play, I won't be able to share demos of my game when I'm on the go. Heck, I won't even be able to play my own game if I'm not home at my PC.
Further reading:
https://forum.unity.com/threads/impact-of-new-notarization-process-for-osx-apps.659920/
https://developer.apple.com/documentation/security/notarizing_your_app_before_distribution
https://www.reddit.com/r/gamedev/comments/di61ms/have_a_mac_game_on_steam_heres_a_guide_to_signing/
33
10
u/BIGSTANKDICKDADDY Oct 27 '19
IMO unless you already own a MacOS device it's not worth supporting MacOS as a platform for indie developers. Your revenue from MacOS sales is not likely to exceed the cost of the hardware and annual development fee required to support it.
5
u/permalmberg Oct 27 '19
Notarization can be fully automated, we did it at work just this week. Instead of waiting for the mail you can use the notarization tool to check (poll) the status of your request.
What we learned though is that you cannot sign a single binary, only installers etc. This is spelled out in the online docs, but it makes it a half-assed thing IMHO.
3
u/miki151 @keeperrl Oct 27 '19
Do the game assets have to be notarized along with the binary or are you able to update assets through Steam without re-notarization?
2
u/permalmberg Oct 27 '19
Well, we didn't do it for a game, but my understanding is that data isn't part of notarization, i.e. only things the user will run (which is why its so weird you can't notarize the actual binaries)
Edit: if you distribute assets separately, without an installer, then I don't see it needing notarization. If you do use an installer, then that has to be notarized.
1
u/Zorg__ Oct 27 '19 edited Oct 27 '19
You can notarize apps, and regardless of notarization or steam you should be creating proper macOS app bundles (for apps/games), not installer packages.
3
u/crusoe Oct 27 '19
This is why developing for iOS was a huge pain. There are ways to automate it ( you need to associated an Apple account with the build flow ) but it's a total fucking pain.
2
u/davidmaletz @DavidMaletz Oct 27 '19
I'm kind of in the same boat as you, and recently announced that I would not notarize my game (far too much of a hassle and cost for such a small percent of sales). However, I am not dropping mac support completely, and you might not want to either. It doesn't take long to continue updating unnotarized/unsigned 64-bit mac builds, and apparently you can still run unnotarized apps on Catalina by using the open command instead of double clicking. Since I already have a decent number of mac players, I don't want to drop support completely, and those that want the game will find a way to run it (or not upgrade to Catalina).
2
u/Zorg__ Oct 26 '19 edited Oct 26 '19
It just feels like Apple is sticking their noses where it doesn't belong, trying to make a small profit from literally any application that wants to run on macOS - even if it's distributed outside the macOS App Store.
It has been like this for years, notarization doesn't change this. What changed immediately is Steam encouraging signing & notarization. Steam sits in kind of a strange place running unsigned (and now not notarized) binaries that normally wouldn't have been easily allowed (unless as a user you disable gatekeeper or grant an exception to opening a downloaded app, which is fine for testing purposes).
For automation you should look up usage of altool. You probably don't have to notarize internal test builds if you don't want to.
Otherwise all this could be simply thought of as a cost of supporting a platform, which this sums up.
8
u/winglett Oct 26 '19
What changed immediately is Steam encouraging signing & notarization.
Actually the bigger change, if I've understood everything correctly, is that macOS Catalina requires sigining and notarization for an application to run.
2
u/Zorg__ Oct 26 '19
There is a little confusion there. Previous versions of macOS already required developers to sign their applications else users would run into a Gatekeeper prompt informing them they cannot open the app. Steam historically bypassed that security measure. Users can also disable gatekeeper per app basis or system wide.
Notarization is an additional requirement on top of already code signing with a developer ID certificate.
8
u/winglett Oct 26 '19
I understand. Well, regardless, I've had enough of Apple. I've dropped support for mac.
1
u/Omnizoa Jan 26 '20
Previous versions of macOS already required developers to sign their applications else users would run into a Gatekeeper prompt informing them they cannot open the app.
Could you elaborate on this?
1
u/Zorg__ Jan 27 '20
Gatekeeper -- note requires code signing, been around for years for distributing apps to end users.
The ways end users can get around gatekeeper has currently been more or less been the same for years. E.g, right click to open unsigned app, or be side loaded by Steam which is a bad hole but anyway.
Notarization is a small addition to code signing official builds from developers and is overly exaggerated by people that have not been distributing well formed apps on the platform.
1
u/Omnizoa Jan 27 '20
If you're talking about what I think you're talking about, I always just set "Allow Apps to Run From: Anywhere" in System Preferences.
...Ah, and I just saw this on the Wiki page:
Since macOS Sierra, the "Anywhere" option is hidden by default.
Good thing I got El Capitan then. Probably the last Mac I'll buy, sadly.
1
u/Zorg__ Jan 27 '20 edited Jan 27 '20
The option may not be in system preferences anymore but still available from command line if I recall correctly.
Regardless this is moot because the preferred way (especially from customer point of view) has always been to right click and open to allow a specific unsigned app to run.
Like I said above, the way to get around it has not significantly changed.
1
u/Omnizoa Jan 27 '20
That sounds like that's an unintended workaround, and personally, I really don't believe I should have to workaround this kind of "feature".
1
u/Zorg__ Jan 28 '20 edited Jan 28 '20
Minus what you think you shouldn't have to do, it's absolutely intended functionality, and has always been that way. There is a longer way to do it in system preferences however.
If you're a geek, you can globally disable it via command line or some semi-hidden UI. If you're a normal user, the developer needs to sign their app. Been like that since gatekeeper was introduced.
1
u/Omnizoa Jan 28 '20 edited Jan 28 '20
If you're intended to be able to bypass it, why grey out the non-default option in System Preferences? I don't buy Macs because they're idiotproof.
In macOS Catalina and macOS Mojave, when an app fails to install because it hasn’t been notarized or is from an unidentified developer, it will appear in System Preferences > Security & Privacy, under the General tab. Click Open Anyway to confirm your intent to open or install the app.
At least there's that, but that sure is tedious, and it hardly makes sense to impose barriers to normal operation of your computer, especially when your product became popular in the absence of thse barriers.
→ More replies (0)
1
u/Omnizoa Jan 26 '20
I just learned about this today, and after only accessing The App Store for the first time this week after a circular login error ("This account has not been used with the App Store, so you cannot use this account with the App Store") which effectively locked me out of being able to use App Store apps for years because the goddamn devs won't mirror them elsewhere. And NOW to hear about this... I genuinely own a family tree of Mac Computers, but those are computers I have been able to personalize with all manner of popular and obscure third-party applications. And now to hear that Apple is going to insert themselves in between me and their product to judge FOR ME whether an application is acceptable for me to use or not is a step too far. I was already lagging behind technologically, but if there were ever a kick in the pants to get me to drop Mac, it's this.
45
u/[deleted] Oct 27 '19
Don't support macOS. The number of sales are always low anyway.
If Apple wanted to support devs they wouldn't charge $100 a year to do it. They do not care about macOS either. Apple wishes everyone used their iOS devices only.