Re: Sharing patch with externals on MacOS

IOhannes m zmölnig via Pd-list <[email protected]> Sun, 12 Apr 2026 13:46:02 +0200
Newsgroups	gmane.comp.multimedia.puredata.general
Message-ID	<[email protected]>
On 12/04/2026 11:25, Dan Wilcox wrote:
> You also just clear all the flags which is easier to remember:
> 
> xattr -c <path>
> 
> One option: I would provide a script which runs this all all required files. The participants could double-click this after downloading and unpacking the zip.
> 
> This is probably happening because the external library to be dynamically loaded is distributed in a zip file. The macOS "Gatekeeper" system recognizes when something is 1. downloaded from a website and 2. contains executables or dynamic libs, in which case, meta flags are set which trigger these warning dialogs. The macOS signing mechanism cannot be applied to zip files so there is verification for who and where the files are coming from, whereas it can with a signed and notarized dmg (mac Disk Images).
> 
that would be new to me.
to my understanding:
- a code *signature* is embedded into a binary itself. as such, a signed 
binary can be distributed via dmg-images, zip-files or direct downloads.
- *notarization* is basically a cross-signature from apple. it cannot be 
embedded directly into a binary.
- whether a given binary has been successfully notarized can be queried 
via a webservice (afaiu, the macOS Gatekeeper will calculate a 
cryptographically secure hash of binary; and if it is not found in the 
local database, it will send this hash to the notarization webservice to 
check whether Apple knows about the file).
- this requires a machine to be online when trying to load a binary for 
the first time, which can be impractical in certain situations.
   in this case, there's the possibility to *staple* a notarization 
ticket into a bundle (e.g. a .app; or a DMG). this stapled ticket is a 
standalone file with an Apple-issued signature of the signed binaries.


now Pd externals are shipped as single files (typically packaded in a 
zip-file that you can download via deken).
this distribution does not make use of "bundles", so even if the files 
have been signed and notarized, they lack the notarization ticket.

which only means that the user has to be online when they first try to 
load the externals.

so TL;DR: you *can* sign and notarize single binary files. you 
**cannot** distribute the proof of notarization with single binary files 
(you need bundles/dmg for this).

having said all that I'd like to clarify my last email on thies subject 
a bit more: i *think* most macOS binaries available on deken are *not* 
signed (and thus not notarized either).
however, the binaries provided by me/the iem (e.g. "zexy", "Gem" and 
libraries prefixed with "iem*"), are all signed/notarized (because the 
iem does pay for an Apple developer account). because of the 
distribution form, users must be online when loading these binaries (for 
the first time) to validate the notarization.

mgfdsr
IOhannes

---
[email protected] - the Pure Data mailinglist
https://lists.iem.at/hyperkitty/list/[email protected]/message/RVKV6O6PFD3AM42NHDYR4EK3LQGYB7DK/

To unsubscribe send an email to [email protected] mailing list
UNSUBSCRIBE and account-management -> https://lists.iem.at/
OpenPGP_signature.asc (application/pgp-signature, 840 B)