Mac launch checklist

Work through it at your own pace. Your ticks save in this browser, with no account.

Mac launch checklist

0 done

SigningCreate a Developer ID Application certificateThis is the one for apps sold outside the Mac App Store. Apple Development certificates are only for testing.Turn on the hardened runtimeNotarization requires it. Check with codesign -dv and look for runtime in the flags.Review your entitlementsRemove get-task-allow from release builds and keep only the exceptions you can explain.Sign nested codeFrameworks, helpers and XPC services inside the bundle all need a valid signature and a secure timestamp.Verify the finished bundleRun codesign --verify --deep --strict --verbose=2 YourApp.app on the exact build you will ship.Decide on Apple silicon and IntelCheck with lipo -archs that the binary holds what your site promises.

NotarizationStore notary credentialsUse xcrun notarytool store-credentials so scripts never hold your password.Submit and waitRun xcrun notarytool submit YourApp.dmg --keychain-profile NAME --wait.Read the log, even on successRun xcrun notarytool log SUBMISSION_ID. It can list warnings worth fixing.Staple the ticketRun xcrun stapler staple YourApp.dmg so the first launch works offline.Check what Gatekeeper seesRun spctl -a -vv YourApp.app and look for source=Notarized Developer ID.

Sparkle updatesGenerate your EdDSA keysRun Sparkle's generate_keys, put the public key in SUPublicEDKey, and back up the private key somewhere safe.Set SUFeedURL to an https appcastHost it somewhere you will still control in a few years.Sign every updateRun sign_update on each archive and put the signature in the appcast.Test a real updateInstall the previous build, publish an update to a test feed, and update through the app itself.Write release notes people can readThey show up in the update window, so plain words beat ticket numbers.

DMGAdd an Applications shortcutDragging the app to a link right beside it is the install step people expect.Sign and notarize the DMGSign it with Developer ID, notarize it, then staple the ticket to the DMG.Test a real downloadDownload it through a browser so quarantine applies, then open it on another Mac or user account.Test running from the Downloads folderIf your app must live in Applications, say so or offer to move it.Use one stable download linkA link that always points at the latest build means old posts keep working.

PrivacyWrite your usage stringsCamera, microphone and similar access need a purpose string that says why, in words a person would use.Test on a Mac that has never seen the appReset with tccutil reset All YOUR.BUNDLE.ID and walk through every permission prompt.Publish a privacy policyState what you collect, including crash reports and analytics, and link it from the site and the app.Fill in App Store privacy details if you use the storeAnswer them for your SDKs as well as your own code.Check third-party SDKs for privacy manifestsUpdate any SDK that has not added one.

Screenshots and siteExport accepted screenshot sizesUse the screenshot checker if you are heading to the Mac App Store.Show the real appUse a real window with real content, and avoid filler text.Check your icon at small sizesUse the icon checker. It has to read at 16 points.Show the price and system requirementsPut the price, macOS version and a download button where people do not have to hunt for them.Run your landing page through the graderThe landing page grader shows which basics are missing.

Launch dayInstall the live download once moreUse the public link, on a clean account, right before you post.Set up a way to reach youAn email address in the app and on the site is enough to start.Make sure you can see crashesKnow where reports will reach you before many people run the build.Write your launch postThe launch post helper gives you a first draft to rewrite.Read each community's rules before postingMany subreddits limit self-promotion, so check first.Keep the day free for repliesAnswering questions quickly is the part only you can do.List your app on directoriesAdd it to MacPip and any others that fit.

About this list

It covers apps sold outside the Mac App Store as well as inside it, so skip what does not apply. Your ticks live in this browser only, so clearing site data clears them.