Notarization and Older Version of C4D

d_schmidt

Hi. I had a question about notarization for the Mac and older versions of Cinema. Notarization requires XCode 10.1 or higher, but versions of Cinema before R21 require(suggests?) earlier versions of XCode for development. So is it possible to notarized plugins for earlier versions of Cinema given the conflicting versions?

Dan

r_gigante

Hi Dan, thanks for reaching out us.

Considering that releases before Cinema 4D R21 are not notarized, you're not supposed to notarize plugins running on versions previous R21.

Best, Riccardo

d_schmidt

Oh, alright. My reading of it was that everything on Catalina had be notarized, so that would include the older software. Thanks for clearing it up for me.

d_schmidt

This post is deleted!

d_schmidt

Hello Riccardo,

Following up about previous versions of Cinema in Catalina, I've been able to do more tests and I'm more confused now.

I've tested my plugins R15 and R18 on Catalina and in both of them my plugins fail to load because they aren't notarized. These are the same compiles that worked before Catalina. They worked through all previous OSXs. They worked from R14 through R20. After updating to Catalina fresh installations of the plugins are no longer working in R14 through R20.

Given these results it appears that everything needs to be notarized for Catalina.

Does this mean that it's impossible for plugins to work in anything earlier than R21 in Catalina or is something else the problem?

Dan

kbar

From what I have seen it appears that ALL software needs to be notarized for Catalina. And apples view on it is that the developers should update their software so that it works on Catalina.

The section "Notarize Your Preexisting Software" on this page may help.

https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution

It seems to indicate that you can use XCode 10 to notarize the zip files. IE no need to rebuild the plugins. I haven't tried this myself yet but curious to know if it works. Worth a shot giving it a go to see.

For R20 you may be able to code sign the plugins in XCode 9 and rebuild if the above doesn't work. But the sending for Notarizing needs to be done with XCode 10.

d_schmidt

@kbar

Thanks for the information! That was the assumption that I was under.

I've tried notarizing the older versions of the plugins but I'll do some further tests and see how it turns out.

Dan

r_gigante

Hi @d_schmidt, sorry for coming late here.

I've run some additional tests and I've some final considerations to share

Fresh macOS (10.15)
- Cinema >= R21 does RUN out of the box
- Plugin running on Cinema >= R21 does RUN ONLY if notarized
- Cinema < R21 does NOT RUN being not notarized
- Plugin running on Cinema < 21 does NOT RUN – independently of being notarized or not – because Cinema doesn’t run (see #1.2);
Upgraded macOS (from 10.xx to 10.15)
- Cinema >= R21 does RUN out of the box being it notarized
- Plugin running on Cinema >= R21:
  - Installed before the upgrade to 10.15: does RUN – independently of being notarized or not – because already existing on the system at the time of the os upgrade;
  - Installed after the upgrade to 10.15: does RUN ONLY if notarized because not existing on the system at the time of the os upgrade;
- Cinema < R21:
  - Installed before the upgrade to 10.15: does RUN – despite not being notarized – because already existing on the system at the time of the os upgrade;
  - Installed after the upgrade to 10.15: does NOT RUN because not existing on the system at the time of the os upgrade;
- Plugin running on Cinema < 21:
  - Installed before the upgrade to 10.15: does RUN – independently of being notarized or not – because already existing on the system at the time of the os upgrade;
  - Installed after the upgrade to 10.15: does RUN ONLY if notarized because not existing on the system at the time of the os upgrade;
Former macOS (< 10.15)
- Cinema (no matter what version) does RUN – independently of being notarized or not.
- Plugin running on Cinema (no matter what version) does RUN – independently of being notarized or not.

I've also experienced during the tests, that non-notarized application/plugins can run on Catalina if the quarantine attribute is removed from the Zip archive that contains the application/plugin before unarchiving the application and running it.
Although this is not a recommended workflow, it can be achieved by calling:

$ xattr -d "com.apple.quarantine" <zip file>

Now about notarizing already built plugins: as already mentioned by @kbar it is possible and this afternoon I tried and it went ok.
Before notarizing the zip archive shipping the plugin as described in our documentation, you have to:

sign the plugin;
enforce the hardened runtime;
create the zip archive
submit the zip archive to the notarization service
wait for Apple to notarize the archive.

In the end steps 1 and 2 are achieved by calling

$ codesign -f -s "Developer ID Application: <Your Name>" --options runtime <xlib file>

whilst the remaining ones are the same reported in the link above.
With this method I've successfully signed and notarized the latticeplane binaries found in the archive on Maxon Labs and made them working on R19 and R20 in Catalina. Finally these additional notes will be added in the documentation.

Cheers, R

kbar

Fantastic work! Thanks Riccardo for going through all that testing and checking for us. Really helps.

d_schmidt

@r_gigante

Thanks for the breakdown!

I'm having trouble getting this to work:

$ codesign -f -s "Developer ID Application: <Your Name>" --options runtime <xlib file>

The terminal says that runtime isn't a valid argument.

Are there plans to have previous versions of Cinema running on Catalina and beyond or is it expected to only allow previous versions if macOS was upgraded?

I've been trying to get R14 plugins notarized, but XCode 4.4.1 doesn't build for 10.9 which is required for notarization. Does this mean its impossible to get R14 plugins loading in Catalina?

Dan

kbar

@d_schmidt

Maxon won't be putting any resources into making older versions of C4D run on Catalina. That doesn't make any business sense to even attempt to do so. And from here on out C4D 22+ will only run on Catalina and up.

https://www.maxon.net/news/maxon-news/article/future-system-requirements-for-cinema-4d/

I think your best bet is just see what you can support and leave it at that. I highly doubt anyone with R14 will be trying to run on Catalina. And from a developers perspective it's not even possible to build plugins for R20 below on Catalina anyway, since XCode 9 and below do not run. Its only us old timers that have a stack of old Macs that can even attempt to do something like that.

Kent

r_gigante

Hi @d_schmidt the string I used looking in my bash history is

$ codesign -f -s "Developer ID Application: Riccardo Gigante" --options runtime latticeplane_R20.xlib

which should be similar to the one you entered.

I've been trying to get R14 plugins notarized, but XCode 4.4.1 doesn't build for 10.9 which is required for notarization. Does this mean its impossible to get R14 plugins loading in Catalina?

Actually I agree with @kbar and I have strong doubts that R14 can run flawlessly on Catalina. I've tested up to R18 and although it loads properly I won't consider running as a stable-proof combination.

Best bet is to support recent revisions (we grant support up to one revision back from the current one) and get advantage of the design opportunities offered by newer system.

Best, R

d_schmidt

@r_gigante @kbar

Thanks for the infomation. I assumed that was the case and it makes sense, I'm just reluctant to stop supporting older versions of Cinema but it might be time.

Riccardo, I think I was using the incorrect version of osX or XCode, not sure which, but using your codesign worked when I moved onto a later version of both and it is correctly signing my R20 compiles.

Thanks both of you for all of the help and clarifying of notarization.

Dan