For Mac developers selling outside the App Store
Point it at the Mac app you already have — or start from the included skeleton — and get back a notarized, auto-updating, licensed DMG. Every trap already hit for you.
Certificate to notarised DMG — the full run, in order.
The log is the tool's own output, word for word.
Sell from your own site and you keep 100% minus payment fees, own your customers, and escape the sandbox. In exchange, Apple hands you this list — and no tooling.
| The job | Handled alone | With the kit |
|---|---|---|
| Menu bar app shell | No Xcode template exists; tutorials are outdated, LLMs suggest deprecated APIs | Working skeleton, macOS 13+ |
| Notarization | Xcode notarises the app. The DMG you actually ship is a separate submission — and every release repeats the GUI by hand | One script, both submissions, signature flags checked before the round-trip |
| DMG packaging | hdiutil incantations; the DMG itself must be notarized too — most guides skip that | Signed, notarized, stapled |
| Auto-updates | Sparkle setup, EdDSA keys, appcast hosting, three silent failure modes | Wired, with delta updates |
| License keys | Verification API, offline handling, refund handling, keychain storage | Gumroad flow, 14-day grace |
Config.xcconfigThe one file you edit. Name, bundle id, team, versions, update feed, product id — everything follows it.ship.shBuild → sign → notarize → staple → DMG. Verifies its own signature flags before wasting a round-trip to Apple, and refuses to ship what would silently fail.appcast.shGenerates your signed update feed — and rejects an unsigned one, a failure Sparkle's own tooling lets through without a word.# you edit one file: Config.xcconfig ShipKit.xcodeproj Sources/ ExampleFeatureView ← your app goes here SettingsView launch-at-login, tabs UpdaterView Sparkle wired License* Gumroad + grace period scripts/ ship.sh one command → DMG appcast.sh signed update feed docs/ 01-quickstart … 05-troubleshooting
Every claim on this page was measured on a real machine on a real Apple Developer account, the day this kit's pipeline first ran.
Measured 2026 — not projected, not "up to".
Three of the ten. Any one of these costs a lost afternoon — or worse, ships broken silently.
Apple's certificate page pre-selects "Previous Sub-CA". Accept it and your Developer ID dies in February 2027 no matter what the expiry says. The guide walks you past it; ship.sh's error text warns about it too.
Add Sparkle after your first release and its own tool generates an unsigned feed with no warning — updates then fail silently on every user's machine. appcast.sh verifies the signature and refuses to let it through.
errSecInternalComponent is codesign's way of saying "keychain permissions" — it just never mentions keychains, or permissions. You get the one-line fix in the error message itself, when it happens, not after two hours of searching.
One file to configure. One command to ship. Every trap already documented.
$99 one-time
Requires Apple's own Developer Program membership ($99/year, paid to Apple) — everyone shipping Mac apps pays that, kit or not.
ship.sh and appcast.sh, and five guides — then walks you through the certificate and notary setup. Full readable source, no obfuscation. The key is checked once, when you unlock; your copy is stamped with your name and the app never phones home again.