asc-notarization

# macOS Notarization Use this skill when you need to notarize a macOS app for distribution outside the App Store. ## Preconditions - Xcode installed and command line tools configured. - Auth is configured (`asc auth login` or `ASC_*` env vars). - A Developer ID Application certificate in the local keychain. - The app's Xcode project builds for macOS. ## Preflight: Verify Signing Identity Before archiving, confirm a valid Developer ID Application identity exists: ```bash security find-identity -v -p codesigning | grep "Developer ID Application" ``` If no identity is found, create one at https://developer.apple.com/account/resources/certificates/add (the App Store Connect API does not support creating Developer ID certificates). ### Fix Broken Trust Settings If `codesign` or `xcodebuild` fails with "Invalid trust settings" or "errSecInternalComponent", the certificate may have custom trust overrides that break the chain: ```bash # Check for custom trust settings security dump-trust-settings 2>&1 | grep -A1 "Developer ID" # If overrides exist, export the cert and remove them security find-certificate -c "Developer ID Application" -p ~/Library/Keychains/login.keychain-db > /tmp/devid-cert.pem security remove-trusted-cert /tmp/devid-cert.pem ``` ### Verify Certificate Chain After fixing trust settings, verify the chain is intact: ```bash codesign --deep --force --options runtime --sign "Developer ID Application: YOUR NAME (TEAM_ID)" /path/to/any.app 2>&1 ``` The sign...