我终于解决了我的问题.第一个信用：(i)我的另一个stackoverflow question的答案是非常有用的,(ii)通过提交所谓的技术支持事件(TSI),我得到了官方苹果开发商的非常好的(有偿的)建议.

在所有这一切的基础上,我现在可以给出一个非常简明的秘诀,说明如何让您的Mac应用程序成功地被GateKeeper处理.详细介绍食谱之后,我会显示我原来的错误.

Goal: After having developed a Mac app outside Xcode to have GateKeeper issuing the warning “Downloaded from the Internet …” with three buttons,one of which is “open”.

Failure: When GateKeeper issues a warning with either the text “.. unidentified developer..” or the text “.. unconfirmed developer .. ” with – in both cases – a messageBox with a single OK button.

让您的应用程序GateKeeper准备就绪涉及三个步骤：

• Make your app standalone with no unacceptable external dependencies. The only acceptable external dependences are system libraries. All other dependencies should have been copied to your MyApp.app folder. GateKeeper rejects any app that has non-system external dependencies
• Binaries should not be located at illegal positions inside the MyApp.app folder. Libraries go into MyApp/Contents/Frameworks and the executable goes into MyApp/Contents/MacOS
• All binaries inside MyApp should be digitally signed. Then the MyApp.app folder should be signed. For this signing an Apple “Developer ID Application …” certificate is necessary

我们的食谱是自动的.所有的工作都是由一个脚本完成的.在Qt Creator的情况下,我们使用一个qmake脚本,我们通过$$system命令访问系统shell.当使用(Xcode)系统命令中的任何一个(xcode)系统命令,code,spctl或check-signature时,我们假定您已经将stderr重定向到stdout,如answer to question所示.否则,在运行这些实用程序时,您将无法捕获系统响应.在下面我们将不会显式地显示此重定向.

这里是我们的招待会

A. Making the app stand-alone:

1. copy (with a script) all the needed binaries to the MyApp.folder
2. run (with a script) install_name_tool -change and install_name_tool -id such that all dependences inside the app are of the relative type @executable_path/../MacOS.. or @executable_path/../Frameworks
3. run (with a script) otool -L on all binaries inside the MyApp.app folder and flag any illegal dependence,like “@rpath…” or absolute file paths not being system paths. Note that otool -L is not guaranteed to find all dependencies. Plugins are often beyond the horizon of otool. That is why you need the next check.
4. start a terminal at the location “MyApp.app/Contents/MacOS”. Run export DYLD_PRINT_LIBRARIES=1. Then run inside the same terminal window ./MyApp. Your terminal will fill up with over hundred loaded libraries. Check this list again for forbidden libraries (libraries present on your computer,but not on the computer of your customers).
5. proof of the pudding is in the eating. We use the 07002 and check whether or not our app runs there. Alternative solution could be the Mac of a relative who is not a developer. Or you could also create a new user (“test”) on your own Mac and copy the app to its Download (or Desktop folder,or …). In the latter case you must temporarily rename the root folder of your IDE as otherwise the user “test” will find the missing binaries there.

B Signing the app

6. Signing: With our script we run codesign --force --verify --verbose --sign \"Developer ID Application: ....\" \"/path/to/binary\" on all the binaries in the app and then on the app folder itself. In each case the system response is caught. It should contain in each case the string “signed Mach-O thin”.
7. Verification: Run (with a script) command codesign --verify --verbose \"/path/to/binary\" on each binary in your app and on the app itself and catch the system response. It should in each case contain the strings “valid on disk” and “satisfies its Designated Requirement”.
8. GateKeeper check: Run (with a script) spctl -a -t exec -vv /path/to/binary\" on each binary and on the app folder itself. The system response is caught. It should contain in all cases the string “accepted source”.
9. check-signature: Run (with a script) check-signature \"/path/to/banary\" on each binary and on the app folder itself. The system response is caught. It should contain the string “YES” in each case.

C External check

10. zip your app into a single zip file. Upload to one of your cloud servers

11. GateKeepers keeps a long list (typically hundreds of items) of exceptions on its general gate-keeper role. Your app must not be in that list if you want to test GateKeeper. Rather than editing this list a much simpler trick is creating a new user on your Mac. Log in to that user and download the zip file from the Internet cloud server. Finder will automatically uncompress it. Click on it. If GateKeeper tells you that it can open the application but it warns you at the same time that it is downloaded from the Internet,it is time to grab a (white) beer.

这里所需的GateKeeper警告：

我的错

我做了大量的安装和签名,没有明确地检查每个二进制文件的结果.之后,我将使用otool -L在一些二进制文件,但不是所有.我错过了从早期的Qt版本升级到Qt 5.5的二进制libqminimal.dylib已经获得了额外的依赖关系,即：QtDBus.我没有注意到,但是GateKeeper做了.

Qt开发人员可能会想知道为什么我们不仅仅是使用macdeployqt在Mac上部署Qt应用程序.首先,我们不喜欢不使用不成文的黑箱实用程序.在互联网论坛上,有相当多的人报告macdeployqt的问题.此外,当比较不同的Qt版本时,Qt库可以具有不同的安装位置(由otool-L报告).当我们有一个新的Qt版本时,我们的脚本将立即开始对被禁止的依赖关系大喊大叫.以这种方式,我们可以获得有关这个新版本发生变化的信息.