Which certificate should I use to sign my Mac OS X application?

Question

We are developing a Mac OS X application that we are going to distribute outside the Mac App Store. We ended up having these certificates in the Mac Developers program:

and when I go to select one for signing the application, I find this:

Am I correct in that I should use Developer ID: * for Debug? Will that allow developers that don’t have my company’s certificate to sign the application to be able to run it locally?

What certificate should I use for Release?

Answer 1

For development (for example, the Debug configuratino) use the Mac Developer option, which will choose your local Mac Developer certificate (in your case "Mac Developer: José Fernández"), which is meant for team members working on your project (includes testing/debugging).

For Release, use "Developer ID: *" which will pick the standard application release certificate used outside the AppStore, in your case "Developer ID Application: Carousel Apps. I recommend doing a final test/debug after codesigning to ensure it's working as expected.

The way Xcode picks up certificates is by a simple substring matching.

Apple Codesigning Certificate Types

(Name, Type, Description)

iOS Development

• iPhone Developer: Team Member Name Used to run an iOS app on devices and use certain app services during development.

iOS Distribution

• iPhone Distribution: Team Name Used to distribute your iOS app on designated devices for testing or to submit it to the App Store.

Mac Development

• Mac Developer: Team Member Name Used to enable certain app services during development and testing.

Mac App Distribution

• 3rd Party Mac Developer Application: Team Name Used to sign a Mac app before submitting it to the Mac App Store.

Mac Installer Distribution

• 3rd Party Mac Developer Installer: Team Name Used to sign and submit a Mac Installer Package, containing your signed app, to the Mac App Store.

Developer ID Application

• Developer ID Application: Team Name Used to sign a Mac app before distributing it outside the Mac App Store.

Developer ID Installer

• Developer ID Installer: Team Name Used to sign and distribute a Mac Installer Package, containing your signed app, outside the Mac App Store

Once codesigned you can also simulate the launch behavior of your app when Gatekeeper is enabled from Terminal.app:

spctl -a -v Carousel.app

./Carousel.app: accepted
source=Developer ID

The Developer ID Application certificate allows your app to run with Gatekeeper on the setting "allow apps downloaded from Mac App Store and identified developers"