# Signing & Notarization — extracted from zyquo-term (Phase 8 reference) Inspected `/Users/simon-pierreboucher/Desktop/other/OTHER/zyquo-term` on 2026-07-30. Both the certificate and the notary profile were verified present and working on this machine (`security find-identity` lists the cert; `notarytool history` shows a recent **Accepted** submission). ## Values to reuse | Item | Value | |---|---| | Signing identity | `Developer ID Application: Simon-Pierre Boucher (3YM54G49SN)` | | Team ID | `3YM54G49SN` | | notarytool credentials | Keychain profile **`MacLustr-Notarize`** (stored in login keychain — no Apple ID/password needed in scripts) | | Entitlements pattern | Hardened runtime at signing time; minimal entitlements plist (zyquo-term ships only `com.apple.security.cs.allow-jit = false`; no sandbox). Zyquo Cloud needs no extra entitlements either — outbound network needs none outside the sandbox. | ## Pipeline (from zyquo-term `scripts/notarize.sh` + `scripts/package-app.sh`) 1. `swift build -c release` → assemble `dist/Zyquo Cloud.app` (Contents/MacOS/ZyquoCloud, Info.plist, Resources/AppIcon.icns, SPM `.bundle` resources copied into Resources). 2. Sign nested executables first, then the bundle: `codesign --force --options runtime --timestamp --entitlements --sign "Developer ID Application: Simon-Pierre Boucher (3YM54G49SN)" ` 3. `codesign --verify --deep --strict --verbose=2` 4. DMG: copy app + `/Applications` symlink into temp dir → `hdiutil create -volname ... -format UDZO` → codesign the DMG. 5. `xcrun notarytool submit --keychain-profile "MacLustr-Notarize" --wait` 6. `xcrun stapler staple` the DMG **and** the .app; verify with `spctl -a -vv` ("Notarized Developer ID"). zyquo-term notarizes the DMG (app stapled too). For Zyquo Cloud, `make release` will do: zip via `ditto -c -k --keepParent` for notarization, staple the app, then optionally build + notarize the DMG.