Adobe AIR macOS sign and notarize for distribution outside of the App Store

1) macOS sign Adobe AIR app.sh

# how to sign an Adobe AIR app with captive runtime on macOS for distribution outside of App Store (Developer ID application)
# you should have already run adt from the AIR SDK
# Entitlements.plist is included below in this Gist
/usr/bin/codesign -f -v -s "Developer ID Application: My Company (XXXXXXXXXX)" --deep --options runtime --entitlements Entitlements.plist MyApp.app

# verifies that the code signing of .app file is valid
/usr/sbin/spctl --assess --verbose --type execute MyApp.app

2) macOS create and sign .pkg installer.sh

# create and sign a macOS .pkg installer file for distribution
# .pkg files should use a Developer ID Installer certificate
/usr/bin/productbuild --component MyApp.app "/Applications" --version 1.0.0 --sign "Developer ID Installer: My Company (XXXXXXXXXX)" MyApp.pkg

3) macOS notarize.sh

# submit the .pkg installer file to Apple for notarization
/usr/bin/xcrun notarytool submit MyApp.pkg --apple-id [email protected] --password xxxx-xxxx-xxxx-xxxx --team-id XXXXXXXXXX --wait

# staple the notarization to the .pkg
/usr/bin/xcrun stapler staple MyApp.pkg

# then, verify that the code signing of .pkg file is valid
/usr/sbin/spctl --assess --verbose --type install MyApp.pkg

Entitlements.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>com.apple.security.cs.allow-jit</key>
	<true/>
	<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
	<true/>
</dict>
</plist>

I added the commands above to the Ant build script that I use to build an Adobe AIR app. These are snippets only, and I have not included the mxmlc and adt commands necessary to compile and package the Adobe AIR app. These Ant commands create a .pkg file for macOS, including signing and notarization. The resulting .pkg file is meant to be downloadable from a website only. The steps required to distribute an Adobe AIR app in the macOS App Store are likely different, and I cannot give advice about that because I always distribute my apps outside the App Store.

It should be fairly simple to convert each the <exec> sections above into actual commands that you can run directly in a terminal, if you prefer not to use Ant. I just threw this Gist together quickly with a little copying and pasting from my build.xml file, and this is not intended as a comprehensive tutorial.

For more information, you might also want to read airsdk.dev: Creating macOS PKG installers.