Do I Codesign with Two Certs on OSX?

Question

On OSX Cocoa application development, do I codesign with two certs or one? (Note, I'm not planning on distributing my app in the Apple AppStore, but from a website.) See, Apple says I need an organizational developer ID to sign my OSX app. Okay, fine, but Chrome and IE browsers like those expensive Symantec EV codesigning certs, at least for Windows apps, more so than other less-expensive EV codesigning certs. (Our tests have shown we get approved by Chrome and IE only with the expensive Symantec EV certs, not the cheaper ones, if wanting to distribute our applications from a website.

So, if indeed I need to code sign with two certs, can you explain the command line process for installing these? Also, note that my application is a little odd and I need to know which items I must codesign. See, in my application, I have:

• The setup app is a compiled, custom .app with a binary inside that loads the GUI. I assume I have to codesign both?
• The application it installs is a GUI-based .app (Cocoa app) that also contains a couple console executables inside the Resources folder. I assume that I have to codesign the .app and the console executables too?

Answer 1

The certs that Symantec is offering for your web site are probably quite helpful if you were distributing a Windows app, but Apple has developed a solution of its own in Gatekeeper which I strongly recommend using.

As long as you code sign the app with Gatekeeper when you build it with Xcode, you can distribute it on the web and just about any Mac will be able to open it without issue, regardless of browser they're using.