# macOS signing and notarization

`composeApp` is packaged with Compose Desktop `nativeDistributions`, so the correct place to sign the app is during `packageDmg` / `notarizeDmg` on the Mac that owns the Apple developer credentials.

## Why post-signing the finished `.dmg` fails

For JVM desktop apps, signing only the outer `.dmg` is not enough. The `.app` bundle contains:

- the main launcher binary
- the bundled JVM runtime
- many nested `.dylib` files from the runtime and native libraries such as JCEF/Skiko/JNA

All of those files must be signed consistently with hardened runtime before the `.dmg` is finalized.

Compose Desktop 1.10.2 already supports this flow and re-signs the runtime contents when macOS signing is enabled. This repo now pins:

- a reverse-DNS macOS bundle ID via `thulur.mac.bundleID` with default `com.thulur.desktop`
- explicit entitlements for JVM/JCEF hardened runtime in `composeApp/macos/default-entitlements.plist`

## Recommended flow

Run the build on the Mac that has the signing certificate in its keychain:

```bash
./gradlew :composeApp:packageDmg
```

For notarization:

```bash
./gradlew :composeApp:notarizeDmg
```

## Required Gradle properties on the signing Mac

Put these in `~/.gradle/gradle.properties` on the signing machine:

```properties
compose.desktop.mac.sign=true
compose.desktop.mac.signing.identity=Developer ID Application: Your Name Or Company (TEAMID)
compose.desktop.mac.notarization.appleID=you@example.com
compose.desktop.mac.notarization.password=@keychain:NOTARIZATION_PASSWORD
compose.desktop.mac.notarization.teamID=TEAMID
thulur.mac.bundleID=com.thulur.desktop
```

Notes:

- `compose.desktop.mac.signing.keychain=/path/to/login.keychain-db` is optional if the certificate is not in the default keychain or there are multiple matching certificates.
- `compose.desktop.mac.notarization.password` should be an app-specific password or a keychain reference, not a raw account password.
- If your registered Apple App ID is not `com.thulur.desktop`, override `thulur.mac.bundleID` with the actual value.

## Verification commands

After packaging on the signing Mac:

```bash
codesign --verify --deep --strict --verbose=2 build/compose/binaries/main/dmg/Thulur.app
spctl --assess --type exec --verbose=4 build/compose/binaries/main/dmg/Thulur.app
```

## Practical takeaway

If someone needs to use a different Apple account on another Mac, the reliable options are:

1. rebuild `:composeApp:packageDmg` on that Mac with its own signing credentials configured
2. or unpack the `.app`, recursively re-sign the entire bundle and runtime, then recreate the `.dmg`

The first option is the intended and much safer one.
