Skip to content


Switch branches/tags

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time


Xojo2DMG: CodeSign, DMG creation and Notarization (Post Build Script)

License: MIT


Are you distributing macOS Software outside of the Mac App Store? For your users best experience and confidence, your applications have to be notarized by Apple. A requirement for that is to CodeSign with Hardened Runtime. This might lead to a different Runtime behavior compared to a simple (unsigned) DebugRun within the Xojo IDE. That's why I encourage everyone to CodeSign (with Hardened Runtime) each and every DebugRun on macOS, allowing you to develop and debug as close to a Release Build as possible.

This example shows how a Post Build Script can be used in a Xojo project in order to create a customized DiskImage, sign and notarize both .app and .dmg. You can easily customize the DiskImage's appearance by setting a couple of Variables in the Post Build Script. Additionally, even Notarization can be performed fully scripted. That requires to set up an item in your Keychain - see Info in the Script provided.


  1. Xojo running on macOS (obviously... you can't CodeSign for macOS on Windows)
  2. CodeSigning, CodeSigning-Validation and Notarization requires Xcode to be installed
  3. CodeSign of .dmg requires OS X 10.11.5 (or later)
  4. Validation of the .dmg's CodeSignature requires macOS 10.12.0 (or later).
  5. Notarization: Xcode 11, macOS 10.13.6


This DMG has been created with Xojo2DMG (built with Xojo 2021r3.1, macOS 12.2, Xcode 13.2.1 for CodeSigning/Notarization). It contains the built example app (built as macOS Universal: x86_64 & ARM64). ScreenShot: Disk Image

Xojo IDE with the Post Build Script:
ScreenShot: Xojo IDE - PostBuildScript



Xojo is a rapid application development for Desktop, Web, Mobile & Raspberry Pi.

The Desktop application Xojo example project Xojo2DMG.xojo_project is using:

  • Xojo 2018r4
  • API 1

How to use in your own Xojo project?

  1. Copy the folder scripts to your project folder.
  2. Create a PostBuild Script in your project and copy-and-paste the example PostBuild Script provided in Xojo2DMG.
  3. If you're using Xojo 2022r1 (or newer): make sure this PostBuild Script runs after the Step 'Sign'. Otherwise Xojo will overwrite the CodeSigning again with it's 'Sign' step.
    Note: You even need to do this if you're opening this example project in Xojo 2022r1+. The reason is that Xojo 2018r4 (which has been used to save this example project) doesn't have Xojo's 'Sign' step - and all existing Post Build steps are being placed before 'Sign' by default.
  4. Read the Comments in PostBuild Script, modify according to your needs (CodeSign Entitlements, Notarization, DMG look and feel).


Juerg Otter is a long term user of Xojo and working for CM Informatik AG. Their Application CMI LehrerOffice is a Xojo Design Award Winner 2018. In his leisure time Juerg provides some bits and pieces for Xojo Developers.


E-Mail    Follow on Facebook    Follow on Twitter


Do you like this project? Does it help you? Has it saved you time and money?
You're welcome - it's free... If you want to say thanks I'd appreciate a message or a small donation via PayPal.

PayPal Dontation to jotools