Appstore notary runner

Skill Xopoko/build-swift-apps/skills/appstore-notary-runner

Use for the concrete macOS Developer ID notarization command path with xcodebuild export plus `asc notarization` submit, status, log, and stapling. Not for broad packaging readiness review or signing-only diagnosis.From its SKILL.md

Install

npx -y skills add Xopoko/build-swift-apps --skill appstore-notary-runner

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

runs commandsInstructs the agent to run 1 command, including `python3 "$PLUGIN_ROOT/skills/appstore-notary-runner/scripts/notary_plan.py" --app-name "YourApp" --scheme "YourMacScheme" --archive-path "/tmp/YourApp.xcarchive" --export-path "/tmp/YourAppExport" --a`.

SKILL.md

2.3 KB, 482 tokens by cl100k_base, as published. Nobody here has run it

App Store Notary Runner

Use for macOS apps distributed outside the App Store with Developer ID signing and Apple notarization.

Use macos-notarization-packager first when the artifact is not clearly distribution-ready. Use macos-signing-inspector for local code-signing, entitlement, Gatekeeper, or trust-policy diagnosis.

Preconditions

Xcode/CLT configured.
asc auth login or ASC_*.
Developer ID Application certificate in keychain.
App builds for macOS.

Command Plan Helper

For a deterministic command plan, run the helper from the plugin root:

python3 "$PLUGIN_ROOT/skills/appstore-notary-runner/scripts/notary_plan.py" \
  --app-name "YourApp" --scheme "YourMacScheme" \
  --archive-path "/tmp/YourApp.xcarchive" \
  --export-path "/tmp/YourAppExport" \
  --app-path "/tmp/YourAppExport/YourApp.app" \
  --zip-path "/tmp/YourAppExport/YourApp.zip" \
  --file "/tmp/YourAppExport/YourApp.zip" \
  --include-archive --include-export --include-zip --include-submit \
  --wait --confirming-actions

The helper prints commands only; it does not build, export, upload, staple, or change trust settings. Commands that write local files or submit to Apple require --confirming-actions. Pass --json for machine-readable output.

Workflow

Run read-only preflight first: signing identities, trust settings, recent notarization submissions, and existing submission status/log when an ID is known.
If the artifact is not clearly Developer ID ready, route to macos-notarization-packager before exporting or submitting.
Archive, export with Developer ID options, verify code-signing authority/timestamp, package as zip/DMG/PKG, then submit.
Fetch status/log output and repair signed nested binaries, hardened runtime, timestamp, or trust issues before retrying.
Staple only after Apple accepts the notarization submission.

References

references/appstore-notary-runner.md for detailed preflight, archive, export, submit, status, stapling, DMG, PKG, and troubleshooting commands.

What ships with it: 1 file

10.5 KB alongside SKILL.md, 1 of them executable

scripts/

notary_plan.pyruns10.5 KB