I release my app both in the MAS and on my website. I use the same signing credentials, but necessarily different certs (Apple Development vs. Developer ID).
When I run the MAS app and then run the other version, or vice versa, I need to re-authenticate the many privacy permissions each time (Finder AppleScript, Network browse, Full Disk Access), which is tedious and keeps causing trouble for other users because some of these require a tcc reset (which my app currently invokes manually, which I consider a hack, though).
So, am I doing something wrong or is it really no possible to have both signed apps use the same identity with TCC?
It depends on what you mean by “identity”. macOS generally tracks your code’s identity via its designated requirement (DR). App Store apps and Developer ID apps have mutually compatible DRs, as explained in TN3127 Inside Code Signing: Requirements. So, this stuff typically Just Works™.
There are, however, two gotchas:
- Not all privileges are tracked by the app’s DR.
- A development-signed app’s DR is not mutually compatible with the other two.
The latter explains the majority of the misbehaviour you’re reporting. Fortunately, it only affects folks running development signed code.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
