notarize-and-distribute SKILL.md skillA
notarize-and-distribute from yybd/app-factory is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add yybd/app-factory/notarize-and-distribute@git:20260929.a7fd8b7Pins git:20260929.a7fd8b7 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- yybd/app-factory
- Path
plugins/apple-track/skills/notarize-and-distribute/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260929.a7fd8b7, committed Sep 29, 2026
- Size
- 9,777 bytes
- Repository stars
- 5
- License
- MIT
Take a built macOS app from an Xcode archive, package it into a signed DMG, notarize it with Apple, staple the ticket, and verify that everything — the app AND the DMG — is properly signed and notarized for direct (non-App-Store) distribution. Use this whenever the user wants to ship a Mac app outside the Mac App Store ("נוטריזציה", "קובץ DMG"): build/create a DMG, sign with Developer ID, notarize, staple, fix "app is damaged / can't be opened / unidentified developer" Gatekeeper errors, or…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Notarize & Distribute (Developer ID DMG)
> **Conversational language:** talk to the user — questions, summaries, reports — in **the language the user writes in** — unless a `conversational language` is set in the hub `DATA.md` (`$APP_HUB/DATA.md`), which overrides it. This sets the *conversation* language only — content/deliverables follow the app's target locales.
For a Mac app distributed outside the App Store, Apple's Gatekeeper will block it
unless it is signed with **Developer ID**, **notarized** by Apple, and the
notarization ticket is **stapled**. Miss any step and users see "app is damaged"
or "unidentified developer". This skill runs the whole chain — locate the app →
**notarize + staple the app** → DMG → sign → **notarize + staple the DMG** →
verify — and checks that the DMG *and* the app inside it pass Gatekeeper.
**Always notarize the app itself, not just the DMG.** The standard flow notarizes
and staples the `.app` *before* packaging it, then notarizes the DMG too. Stapling
only the DMG leaves the app inside un-notarized, so once a user drags it out of the
DMG it can fail Gatekeeper offline ("damaged"). Doing both is the default here —
…Read the whole file at its exact version.
How to install
mdr add yybd/app-factory/notarize-and-distribute@sha256:5996f93671b10be6The line at the top of this page pins the label git:20260929.a7fd8b7, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_d4msofejyrmwj7jw)
0 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Sep 29, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (9777 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
yybd/app-factory · 5 stars · license MIT · pushed 2026-10-28 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_d4msofejyrmwj7jw GET https://markdownregistry.com/api/v1/resolve?ref=yybd/app-factory/notarize-and-distribute GET https://markdownregistry.com/api/v1/blob/5996f93671b10be67f432630031b5eb5d9afc48270fe3abb6e826363dc930a26
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.