How to sign Qt app with Mac Developer Id?

Question

I have my first cross-platform app ready to release, developed with Qt 4.7.4, using Qt Creator (not Xcode). I thought I had everything ready to go: I have a script that runs macdeployqt and produces a .dmg, which works great. I'm not planning to put this app in the Mac App Store. Users will just download the .dmg from our web site.

However, on Mac OS X 10.8 Mountain Lion, Gatekeeper's default will cause confusion for my users if I don't have a developer id associated with my app.

I've googled quite a bit, and am pretty confused about what I need to do. I've never done anything with code signing before, and very little with Mac's keychains. What are the steps to take a completed Qt app and get it associated a developer id, so Gatekeeper at its default setting will be happy with my dmg and not confuse my users?

Answer 1

You need three steps: 1. sign the bundle itself 2. sign the .dylib binaries inside the bundle 3. sign the Qt frameworks (mainly everything like Qt* inside the bundle)

The command used in all three steps is:

codesign --force --verify --verbose --sign 'YOUR IDENTITY HERE' HelloWorld.app

and similary for other files (.dylibs and Qt frameworks) See man codesign for detailed explanations. You should have generated a certificate and include it in your Keychan. If you don't know where to get a certificate from, well.. that's another topic.

Edit: added a more detailed article HERE.