Signing 327 files: notarizing a Mac app that ships its own runtimes
What broke on the way to Lynx opening like any other Mac app, and what fixed it.
Lynx 1.0.7 was the first build signed with our Developer ID and notarized by Apple. Before it, everyone who installed Lynx had to find Open Anyway in System Settings. Now it opens like any other Mac app.
Most of Lynx's weight is not its window. It ships a download engine, a Python runtime, ffmpeg and the notch panel. The notarized app held 327 Mach-O files, and each one had to be signed in the right order with only the rights it needs.
What we learned
- Sign from the inside out, and never with --deep.
- A framework unpacked from a zip can lose its symlinks; putting them back fixed signing and took 28 MB off the app.
- A bundler that follows symlinks can undo that work, so the final check runs on the finished app, not the folder before it.
- Notarization is slow and sometimes flaky, so our release step can resume where it stopped.