Action required by Apple: Transition to the notarytool command-line utility

[targos]

Build got this by email:

We’re reaching out because you recently used the altool command-line utility to notarize your macOS software with Apple. As announced last year at WWDC22, if you’re still using altool with the Apple notary service, you should transition to the notarytool command-line utility as soon as possible. Notarizing software with altool was deprecated in Xcode 13, and the Apple notary service will no longer accept uploads from altool as of November 1, 2023. Existing notarized software will continue to function properly.

For information on notarizing your apps, read TechNote TN3147: Migrating to the latest notarization tool.

[targos]

According to the above TechNote:

If xcrun can’t find the tool, make sure you have Xcode 13 or later selected:

This means we will have to migrate to Xcode>=13 for all releases by the end of the year. v16.x will be EoL but v18.x won't and is currently built on macOS 10.15 (Xcode 13 doesn't support it)

[targos]

We use gon to notarize the pkg. The tool doesn't support notarytool and doesn't seem to be maintained anymore.

https://github.com/nodejs/node/blob/b0e08d178ed3fcb4442324f70154d5f36f8dfcc2/tools/osx-notarize.sh#L3

[richardlau]

For background, we implemented notarization using gon in nodejs/node#31459 and #2199, with discussion in nodejs/node#29216.

Another tool, electron-notarize-cli, was mentioned in the context of OpenJDK -- this one looks like it has an option to use notarytool.

I guess another question is whether we need another tool at all or whether we can directly use notarytool. https://developer.apple.com/videos/play/wwdc2021/10261/ suggests that notarytool can now wait for the notarization to succeed (or I guess fail) whereas previously with altool there needed to be a polling loop (which for us was provided by gon).

@UlisesGascon is this something you're interested in/have the time to look at?

[mhdawson]

I'd be +1 in getting @UlisesGascon more access if that's needed to do this work and he's interested.

[UlisesGascon]

First approach to integrate notarytool is here: nodejs/node#48701 🎉

[UlisesGascon]

Next steps

• Merge and test tools: added support for notarytool for osx notarization node#48701
• Remove support for macOS 10.x in the Jenkins Release CI jenkins: remove macOS 10.x release machines #3531
• Remove the macOS 10.x machines from the Jenkins Release CI Inventory Remove macOS 10.x release machines from inventory #3532
• Remove the macOS 10.x machines from the Jenkins Release CI Inventory (secrets) https://github.com/nodejs-private/secrets/pull/289
• Refactor the script tools/osx-notarize.sh to remove support for gon tools: drop support for osx notarization with gon node#50291
• Refactor the script tools/osx-notarize.sh to use --keychain-profile and include an Ansible step to store the credentials. See: Add --keychain-profile to notarytool #3545
• Add --verbose flag to staple. See: tools: add staple to macOS notarized binaries node#50625 (comment)
• Add step for staple. tools: add staple to macOS notarized binaries node#50625
• Add step for binaries verification tools: add macOS notarization verification step node#50628