Dealing with spctl for plugins

[rbdr]

Hi Everyone!

I had a question that perhaps y'all might be familiar with: What's the recommended way to avoid spctl blocking plugins? Do you actually submit the plugins to the notarization process?

I just built a UI plugin (https://git.sr.ht/~rbdr/Flat-Bezel.qsplugin / https://unlimited.pizza/flat_bezel.html) and sign it with codesign --force -vvv --deep --sign using a Developer ID certificate.

This works well locally, but as soon as I package it and upload / dowlnoad again, gatekeeper blocks it until I give permissions in "Security & Privacy". Since this is a bit annoying for end-users, I was wondering what the recommended approach is.

My guess is to run through the notarization process, but wanted to check in case there's other recommendations from the community.

[n8henrie]

Do you actually submit the plugins to the notarization process?

No, signed but not notarized. The whole process is done in CI, so you can compare / contrast the process for Calculator-qsplugin vs Quicksilver.app with the latter including calls to qssign with the xcrun notarytool parts.

This works well locally, but as soon as I package it and upload / dowlnoad again, gatekeeper blocks it until I give permissions in "Security & Privacy".

Some relevant conversations:

• Make it possible to run qssign outside of CI #2868
• Is signing possible through GitHub Actions? #2576
• Quicksilver is not codesigned #2654
• Split signing out from qsrelease #2655

Sorry I haven't really curated those for you.

Don't quote me on this, but IIRC we have the same issue with manually downloaded plugins, see here and here.

[rbdr]

This is super valuable, I went over part of the conversations and I'll take a deeper look soon. but I think the last two especially answer my question.

Thank you for the help! (And for the really quick response :D)