Once KeyTips worked on my Mac, I asked what seemed like a simple question: how do I put it on my website so people can download it?
It turns out that a working app and an app other people can install are quite different things. Here’s the list. Some of it isn’t finished, and I’ve marked which.
1. Apple has to be able to vouch for it
Without a Developer ID signature and Apple’s notarization, macOS warns people or blocks the app. Signing needs an Apple Developer Program membership, which costs about $99 a year, and a Developer ID certificate.
The Mac App Store isn’t a simple alternative for this kind of app, because its sandbox rules are unlikely to allow one app to control another.
Status: the release script is written, but I haven’t joined the program yet. The signing steps are still untested.
2. Unsigned builds work, with friction
I can AirDrop an unsigned test build to a friend, but it won’t simply open. They have to:
- Drag the app to Applications.
- Try to open it, and dismiss the warning.
- Go to System Settings → Privacy & Security and click Open Anyway.
- Allow it under Accessibility.
That’s acceptable for a friend who trusts me, but not for strangers on a website, and they shouldn’t be taught to click past security warnings for software they don’t know.
3. Be upfront about permissions
KeyTips needs Accessibility permission, because it has to see key presses and press ribbon buttons. That’s a lot to ask, so the app has a first-run screen that explains why, and I’ve drafted a privacy policy. KeyTips doesn’t store or log keystrokes, or read the contents of your documents.
There’s a catch while developing: locally built apps are signed ad hoc, so macOS treats each rebuild as a new app. Shortcuts stop working until you remove the app from the Accessibility list and add it again. A Developer ID certificate avoids this.
4. Plan for updates on day one
KeyTips depends on Office’s ribbon, and Office updates can rename or move things. Some shortcuts will break eventually, so users need a way to get fixes. KeyTips uses Sparkle, a widely used update framework for Mac apps.
Updates are signed with a private key that must be kept safe. Lose it and existing users can’t update.
5. Decide what you won’t support
I made KeyTips Apple silicon only. That removed the Intel code and took the disk image from 2 MB to 1.3 MB at the time. The trade-off is that Intel Mac users can’t run it, and Rosetta won’t help, because it only works the other way round. So the download page needs to say so clearly.
6. Test on a clean Mac
Your own Mac has already granted the permissions and has every tool installed, so it hides problems. The signed build needs to run on a Mac that has never had the app before it goes public.
The takeaway
Claude can write all of this, but it can’t enrol in the Apple program, hold your signing keys or stand behind your privacy policy. Those stay with you, so plan for them from the start.