# Code Signing macOs application

**URL:** <https://discourse.cmake.org/t/code-signing-macos-application/7275>\
**Category:** Code\
**Tags:** os:macos, gen:xcode\
**Created:** [January 18, 2023, 3:47pm UTC](https://discourse.cmake.org/t/code-signing-macos-application/7275 "2023-01-18T15:47:07Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![tonygo](https://discourse.cmake.org/user_avatar/discourse.cmake.org/tonygo/32/3095_2.png) [@tonygo](https://discourse.cmake.org/u/tonygo)\
**Post date:** [January 18, 2023, 3:47pm UTC](https://discourse.cmake.org/t/code-signing-macos-application/7275/1 "2023-01-18T15:47:07Z")

</div>

Hi 👋

I’m trying to code sign a macOs application through CMake with a certificate.

I followed the approach mentioned in the book of @craig.scott, using `-DCMAKE_XCODE_ATTRIBUTE_DEVELOPMENT_TEAM` and `-DCMAKE_XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY` variables, but it didn’t work.

By the way, the snippet which inspires me is:

```cmake
set(CMAKE_XCODE_ATTRIBUTE_DEVELOPMENT_TEAM
    "ABC12345DE" CACHE STRING ""
)
set(CMAKE_XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY
    "Apple Development" CACHE STRING ""
)

```

I got an error message from Xcode:

```nohighlight
<project-name>.xcodeproj: error: No certificate for team '<the-id>' matching '<name>' found: Select a
different signing certificate for CODE_SIGN_IDENTITY, a team that matches your selected certificate, or
switch to automatic provisioning. (in target 'starship_platform_desktop' from project '<project-name>')

```

I already try this: [xcode - No "iOS Development" signing certificate matching team ID "\*\*\*\*\*"with a private key was found - Stack Overflow](https://stackoverflow.com/questions/46541459/no-ios-development-signing-certificate-matching-team-id-with-a-private/54192386#54192386)

I don’t know if someone already face a similar issue.

Cheers ^^

cc @jviotti

---

<div class="post-metadata">

**Author:** ![jviotti](https://discourse.cmake.org/user_avatar/discourse.cmake.org/jviotti/32/3030_2.png) [@jviotti](https://discourse.cmake.org/u/jviotti)\
**Post date:** [January 18, 2023, 4:00pm UTC](https://discourse.cmake.org/t/code-signing-macos-application/7275/2 "2023-01-18T16:00:48Z")

</div>

I’m @tonygo 's colleague. We are testing this with certificates generated from my personal Apple Developer account. The title of the certificate looks like this: “Developer ID Application: Juan Cruz Viotti (97Z2ARC25P)”

From what we understand, `CMAKE_XCODE_ATTRIBUTE_DEVELOPMENT_TEAM` should be `97Z2ARC25P ` and `CMAKE_XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY` should be `Juan Cruz Viotti`.

Is that correct, or are we misinterpreting the variables?

---

<div class="post-metadata">

**Author:** ![craig.scott](https://discourse.cmake.org/user_avatar/discourse.cmake.org/craig.scott/32/20_2.png) [@craig.scott](https://discourse.cmake.org/u/craig.scott)\
**Post date:** [January 18, 2023, 8:42pm UTC](https://discourse.cmake.org/t/code-signing-macos-application/7275/3 "2023-01-18T20:42:26Z")

</div>

Unless you have multiple different identities on your machine for the same team ID, I’d normally recommend setting `CMAKE_XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY` to `Apple Development`. Xcode should then select the appropriate identity matching your specified team ID.

> [@jviotti](#):
>
> The title of the certificate looks like this: “Developer ID Application: Juan Cruz Viotti (97Z2ARC25P)”

It’s been a while since I’ve revisited these things in my book, and I haven’t been working on any Apple projects lately. It’s possible things have changed recently, but so far I haven’t heard anything to suggest the advice in the book isn’t still applicable. The name on that certificate doesn’t seem like what I’d expect. My signing certificates for development are named “Apple Development: Craig Scott (\<some-ID\>)”. Are you perhaps trying to use the wrong certificate? EDIT: I noticed that the “(\<some-ID\>)” part of the certificate name is not my Team ID for my developer signing certificate. All other certificate types _do_ have the Team ID as part of the name. I don’t know why the developer ID certificate name is different for me, but that could just be a historical hang-over from earlier things or it might genuinely be typical behavior.

---

<div class="post-metadata">

**Author:** ![jviotti](https://discourse.cmake.org/user_avatar/discourse.cmake.org/jviotti/32/3030_2.png) [@jviotti](https://discourse.cmake.org/u/jviotti)\
**Post date:** [January 18, 2023, 9:21pm UTC](https://discourse.cmake.org/t/code-signing-macos-application/7275/4 "2023-01-18T21:21:08Z")

</div>

Thanks! We’ll give this a shot. As far as I understand, the “Apple Development” ones are for App Store / Mac App Store distribution, where as the “Developer ID Application” ones are for distribution outside of the store (which we are aiming for).

---

<div class="post-metadata">

**Author:** ![craig.scott](https://discourse.cmake.org/user_avatar/discourse.cmake.org/craig.scott/32/20_2.png) [@craig.scott](https://discourse.cmake.org/u/craig.scott)\
**Post date:** [January 18, 2023, 9:33pm UTC](https://discourse.cmake.org/t/code-signing-macos-application/7275/5 "2023-01-18T21:33:48Z")

</div>

I seem to vaguely recall having difficulties trying to use the application certificate for the first signing long ago. I think the workflow that eventually worked for me was to sign with the usual `Apple Developer` certificate when building the code. Then, produce the archive using `xcodebuild -archive ...`, and lastly export that archive for distribution using `xcodebuild -exportArchive ...`. The exporting step requires you to specify the method of distribution, and you select that in your export options plist file (using the `-exportOptionsPlist` command line argument). Check if one of those distribution methods matches what you want to use. The exporting step will select the appropriate certificate to re-sign your app based on the distribution method you specify.

---

<div class="post-metadata">

**Author:** ![tonygo](https://discourse.cmake.org/user_avatar/discourse.cmake.org/tonygo/32/3095_2.png) [@tonygo](https://discourse.cmake.org/u/tonygo)\
**Post date:** [January 19, 2023, 8:58am UTC](https://discourse.cmake.org/t/code-signing-macos-application/7275/6 "2023-01-19T08:58:13Z")

</div>

Thanks for these insights @craig.scott 🙌

I tried to replace our current `CMAKE_XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY` with `Apple Development`, but it didn’t work.

Regarding the second approach, what I’ve to do is:

- produce an archive with `xcodebuild` (I have to figure out how exactly, probably some answers there: [Xcode "Build and Archive" from command line - Stack Overflow](https://stackoverflow.com/questions/2664885/xcode-build-and-archive-from-command-line))
- export the archive still with `xcodebuild` with flags `-exportArchive` and `-exportOptionsPlist`.
  - In the plist file, I should add the property `signingCertificate` with the value: `Juan Cruz Viotti (97Z2ARC25P)”`

I’ll work on that and see it how it goes.

---

<div class="post-metadata">

**Author:** ![RaisinTen](https://discourse.cmake.org/user_avatar/discourse.cmake.org/raisinten/32/2945_2.png) [@RaisinTen](https://discourse.cmake.org/u/RaisinTen)\
**Post date:** [January 19, 2023, 10:24am UTC](https://discourse.cmake.org/t/code-signing-macos-application/7275/7 "2023-01-19T10:24:32Z")

</div>

I think another approach would be to use [`CPACK_BUNDLE_APPLE_CERT_APP `](https://cmake.org/cmake/help/v3.2/module/CPackBundle.html#variable:CPACK_BUNDLE_APPLE_CERT_APP). I found an example usage on [GitHub](https://github.com/GenericMappingTools/gmt/blob/609ccc1e5c084ff3b762c510f2d41e9d45b19462/admin/ConfigReleaseBuild.cmake#L30).

---

<div class="post-metadata">

**Author:** ![RaisinTen](https://discourse.cmake.org/user_avatar/discourse.cmake.org/raisinten/32/2945_2.png) [@RaisinTen](https://discourse.cmake.org/u/RaisinTen)\
**Post date:** [January 20, 2023, 6:54am UTC](https://discourse.cmake.org/t/code-signing-macos-application/7275/8 "2023-01-20T06:54:09Z")

</div>

I tried setting these options in the cmake file:

```cmake
set(CMAKE_XCODE_ATTRIBUTE_DEVELOPMENT_TEAM "97Z2ARC25P")
set(CMAKE_XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY "Developer ID Application")
set(CMAKE_XCODE_ATTRIBUTE_CODE_SIGN_STYLE "Manual")

```

and it appears that the resultant bundle has been code signed successfully using the right certificate:

```plaintext
$ codesign -dv --verbose=2 examples/hello_world/dist/desktop/Debug/Hello\ World.app
Executable=/Users/raisinten/Desktop/git/starship-next/examples/hello_world/dist/desktop/Debug/Hello World.app/Contents/MacOS/Hello World
Identifier=com.postmanlabs.starship.hello-world
Format=app bundle with Mach-O thin (x86_64)
CodeDirectory v=20400 size=16712 flags=0x0(none) hashes=511+7 location=embedded
Signature size=4674
Authority=Developer ID Application: Juan Cruz Viotti (97Z2ARC25P)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Signed Time=20-Jan-2023 at 12:20:06 PM
Info.plist entries=25
TeamIdentifier=97Z2ARC25P
Sealed Resources version=2 rules=13 files=5
Internal requirements count=1 size=228

```

🎉

---

<div class="post-metadata">

**Author:** ![jviotti](https://discourse.cmake.org/user_avatar/discourse.cmake.org/jviotti/32/3030_2.png) [@jviotti](https://discourse.cmake.org/u/jviotti)\
**Post date:** [January 20, 2023, 4:04pm UTC](https://discourse.cmake.org/t/code-signing-macos-application/7275/9 "2023-01-20T16:04:06Z")

</div>

Awesome! @craig.scott This would good for inclusion on the next edition of the book. We are all big fans of it at Postman 🙂

---

<div class="post-metadata">

**Author:** ![craig.scott](https://discourse.cmake.org/user_avatar/discourse.cmake.org/craig.scott/32/20_2.png) [@craig.scott](https://discourse.cmake.org/u/craig.scott)\
**Post date:** [March 12, 2023, 8:40pm UTC](https://discourse.cmake.org/t/code-signing-macos-application/7275/10 "2023-03-12T20:40:11Z")

</div>

> [@tonygo](#):
>
> I tried to replace our current `CMAKE_XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY` with `Apple Development`, but it didn’t work.

@tonygo I’d be interested in knowing what kind of error you get if you use `Apple Development`. I’d expect that to work unless you had more than one certificate that matched. Would also be good to know the full command line you’re using to build (presumably some form of `xcodebuild archive ...`

I’d like to understand your case better, since I’m revisiting the code signing behavior with Xcode 14 at the moment to see if there have been any significant changes.

---

<div class="post-metadata">

**Author:** ![tonygo](https://discourse.cmake.org/user_avatar/discourse.cmake.org/tonygo/32/3095_2.png) [@tonygo](https://discourse.cmake.org/u/tonygo)\
**Post date:** [March 15, 2023, 12:21pm UTC](https://discourse.cmake.org/t/code-signing-macos-application/7275/11 "2023-03-15T12:21:40Z")

</div>

Hey dear @craig.scott 👋

Thanks for coming back to me. I gave it a try this morning.

I use this base project: [GitHub - tony-go/codesign-macos: This project illustrate how could we codesign a macOS application with CMake.](https://github.com/tony-go/codesign-macos) (I prepare a post on this topic)

And If I modify these two lines:

```cmake
set(XCODE_ATTRIBUTE_DEVELOPMENT_TEAM "BZVTQUQUN8")
set(XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY "Apple Development")

```

 ![Screenshot 2023-03-15 at 13.23.45](https://discourse.cmake.org/uploads/default/original/2X/7/7fbe306851522b43d3cc06d1b536ab289bd741e2.jpeg)

Then I got the following error:

```plaintext
/Users/tonygorez/perso/codesign-macos/build/MyCLIApp.xcodeproj: error: No signing certificate "Mac Development" found: No "Mac Development" signing certificate matching team ID "BZVTQUQUN8" with a private key was found. (in target 'MyCLIApp' from project 'MyCLIApp')

```

---

<div class="post-metadata">

**Author:** ![craig.scott](https://discourse.cmake.org/user_avatar/discourse.cmake.org/craig.scott/32/20_2.png) [@craig.scott](https://discourse.cmake.org/u/craig.scott)\
**Post date:** [March 15, 2023, 7:40pm UTC](https://discourse.cmake.org/t/code-signing-macos-application/7275/12 "2023-03-15T19:40:24Z")

</div>

Right click on the “Apple Development: Tony Gorez (BZVTQUQUN8)” certificate and select “Get Info”. Near the top of the “Details”, take a look at what your “Organisational Unit” is set to. That value is what should be used as your team ID. For me, it is different to the string in the brackets after my name in the development certificate, so I am wondering if you’re using the wrong team ID for your certificate.

---

<div class="post-metadata">

**Author:** ![craig.scott](https://discourse.cmake.org/user_avatar/discourse.cmake.org/craig.scott/32/20_2.png) [@craig.scott](https://discourse.cmake.org/u/craig.scott)\
**Post date:** [March 24, 2023, 9:47am UTC](https://discourse.cmake.org/t/code-signing-macos-application/7275/13 "2023-03-24T09:47:43Z")

</div>

I’ve re-tested the approach documented in my Professional CMake book, using Xcode 14. While there have been some changes, the general method still seems to work. I suspect what may be tripping you up are one or both of the following:

- Specifying the wrong Team ID when signing the application (during general development or with the archive operation). If you use the correct Team ID that matches your Apple Development certificate, it should work.
- When exporting your archive using `xcodebuild -exportArchive ...`, use the appropriate `method` in the export options plist file (the one you list after `-exportOptionsPlist`) that matches the way you want to distribute the app. For general distribution outside the App Store, it looks like the `method` you should be using in that plist file is `developer-id`. The canonical certificate that should match that is “Developer ID Application”, or if you’re producing an installer, “Developer ID Installer”. The “Apple Distribution” certificate is only for distribution through the App Store (e.g. setting `method` to `app-store`).

---

<div class="post-metadata">

**Author:** ![tonygo](https://discourse.cmake.org/user_avatar/discourse.cmake.org/tonygo/32/3095_2.png) [@tonygo](https://discourse.cmake.org/u/tonygo)\
**Post date:** [June 2, 2023, 11:08am UTC](https://discourse.cmake.org/t/code-signing-macos-application/7275/14 "2023-06-02T11:08:37Z")

</div>

hey @craig.scott 👋

I hope you’re doing well.

Sorry for the last reply; I was swamped these days, and still, thank you for your availability for the community 🙂

I tried using the “Organisational Unit” for my Apple Development certificate, which worked nicely.

I updated my example project: [GitHub - tony-go/codesign-macos: This project illustrates how we could codesign a macOS application with CMake.](https://github.com/tony-go/codesign-macos) and my blog post: [Demystifying Code Signing in macOS: A Step-by-Step Tutorial for CLI Applications with CMake](https://tonygo.ghost.io/demystifying-code-signing-macos-cli-cmake-xcode/)