attachment
<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class="">
<div><br class=""><blockquote type="cite" class=""><div class="">On Feb 26, 2020, at 11:59 AM, Michael Sweet <<a href="mailto:msweet@msweet.org" class="">msweet@msweet.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252" class="">
<div class="">OK, I have some good news and some bad news...<br class="">
<br class="">
The good news is that I've successfully signed and notarized the ZIP archive for the macOS self-certification tools. I only needed to make some small changes to the packaging script to a) update the code signing options to reflect the current "secure runtime" and "secure timestamp" options, and b) add a prefix (org.pwg.ippeveselfcertNN.) to the default "bundle ID" used for command-line tools. The resulting ZIP file can be submitted for notarization and makes macOS happy...<br class="">
<br class="">
The bad news is that we can't use a third-party code signing certificate on macOS. Apple requires that you now use the certificate they provide, which can only be provided by signing up as an Apple developer and paying the $99/year for the privilege (which actually is super-affordable compared to what you go through on Windows with code signing certs from GoDaddy/etc.)<br class="">
<br class="">
In the short term I can sign the tools using my Lakeside Robotics certificate for the macOS builds, but in the long term I assume we'll want the PWG IPP Everywhere Printer Self-Certification Tools signed by the IEEE-ISTO Printer Working Group, as before.<br class="">
<br class="">
Thoughts?<br class=""></div></div></blockquote><div><br class=""></div>Thanks for the legwork!</div><div><br class=""></div><div>I think we need to get the Apple provided certificate. I can at least start the process of finding out how we get signed up. Does the $99 / year apply even to open source projects? That seems a bit lame if so...but we can bear $100 / year. I'll ask our ISTO program manager if she wants to be involved or if this is instead just an internal-to-the-PWG thing. Guessing the former.</div><div><br class=""><blockquote type="cite" class=""><div class=""><div class="">
<br class="">
<br class="">
> On Feb 26, 2020, at 1:21 PM, Michael Sweet via ipp <<a href="mailto:ipp@pwg.org" class="">ipp@pwg.org</a>> wrote:<br class="">
> <br class="">
> Smith,<br class="">
> <br class="">
>> On Feb 26, 2020, at 1:15 PM, Kennedy, Smith (Wireless & IPP Standards) <<a href="mailto:smith.kennedy@hp.com" class="">smith.kennedy@hp.com</a>> wrote:<br class="">
>> <br class="">
>> <br class="">
>> <br class="">
>>> On Feb 26, 2020, at 10:57 AM, Michael Sweet <<a href="mailto:msweet@msweet.org" class="">msweet@msweet.org</a>> wrote:<br class="">
>>> <br class="">
>>> ... and FWIW I just tried notarizing the zip file we provide and it failed, as it appears that the only supported notarization containers are currently application bundles (directories with a specific organization) and macOS packages. The latter isn't really what we want for macOS so I'll see what I can do about faking an application bundle...<br class="">
>> <br class="">
>> Does it let you notarize a .dmg?<br class="">
> <br class="">
> No.<br class="">
> <br class="">
>> If not, you could do a flat .pkg that can install to a specific location and default to ~/ so that a sw-ippeveselfcert11-20200219-macos.pkg would install its payload into ~/sw-ippeveselfcert11-20200219, but make the package allow installing into other locations...<br class="">
> <br class="">
> You can't install packages to user directories... :/<br class="">
> <br class="">
> I'm investigating further, the notarization logs also point to some missing code signing options so I'll see what I can do about that...<br class="">
> <br class="">
> ________________________<br class="">
> Michael Sweet<br class="">
> <br class="">
> <br class="">
> <br class="">
> _______________________________________________<br class="">
> ipp mailing list<br class="">
> <a href="mailto:ipp@pwg.org" class="">ipp@pwg.org</a><br class="">
> <a href="https://www.pwg.org/mailman/listinfo/ipp" class="">https://www.pwg.org/mailman/listinfo/ipp</a><br class="">
<br class="">
________________________<br class="">
Michael Sweet<br class="">
<br class="">
<br class="">
</div>
</div></blockquote></div><br class=""></body></html>