Desktop application publishing to Mac App Store

Publishing Desktop Applications to Mac App Store

Mac App Store has stricter requirements than direct distribution: applications must work in App Sandbox, use only permitted entitlements, and pass Apple review. Electron applications are supported but require special configuration.

Difference between MAS and Direct Distribution

Configuring electron-builder for MAS

# electron-builder.yml
mac:
  target:
    - target: mas       # Mac App Store
    - target: mas-dev   # For sandbox testing

  provisioningProfile:        build/embedded.provisionprofile
  entitlements:               build/entitlements.mas.plist
  entitlementsInherit:        build/entitlements.mas.inherit.plist
  hardenedRuntime:            false   # MAS doesn't require hardened runtime
  identity: "3rd Party Mac Developer Application: Company (TEAM_ID)"

Entitlements for MAS

<!-- build/entitlements.mas.plist -->
<?xml version="1.0" encoding="UTF-8"?>
<plist version="1.0">
<dict>
  <!-- App Sandbox — mandatory for MAS -->
  <key>com.apple.security.app-sandbox</key><true/>

  <!-- Network -->
  <key>com.apple.security.network.client</key><true/>

  <!-- If file access is needed -->
  <key>com.apple.security.files.user-selected.read-write</key><true/>

  <!-- For Electron: JIT needs separate entitlement child -->
</dict>
</plist>

<!-- build/entitlements.mas.inherit.plist — for Electron child processes -->
<?xml version="1.0" encoding="UTF-8"?>
<plist version="1.0">
<dict>
  <key>com.apple.security.app-sandbox</key><true/>
  <key>com.apple.security.inherit</key><true/>
</dict>
</plist>

Provisioning Profile

Need Mac App Store Distribution Profile:

1. Go to developer.apple.com → Certificates, Identifiers & Profiles
2. Create App ID with needed capabilities
3. Create Distribution Certificate (3rd Party Mac Developer)
4. Create Provisioning Profile type Mac App Store
5. Download .provisionprofile and place in build/

Build and validation

# Build MAS package
npx electron-builder --mac mas

# Validate before submission
xcrun altool --validate-app \
  --file dist/mas/AppName.pkg \
  --type osx \
  --apiKey   "YOUR_API_KEY" \
  --apiIssuer "YOUR_ISSUER_UUID"

# Submit to App Store Connect
xcrun altool --upload-app \
  --file dist/mas/AppName.pkg \
  --type osx \
  --apiKey   "YOUR_API_KEY" \
  --apiIssuer "YOUR_ISSUER_UUID"

Modern alternative — xcrun notarytool and Transporter.app.

App Sandbox restrictions

Sandbox prohibits operations familiar to Electron developers:

• No direct shell command execution via child_process.exec
• No access to arbitrary file system paths
• No auto-start at system boot (without LaunchAgent entitlement)
• Inter-process communication — only via XPC or App Groups

To bypass some restrictions, use XPC Services — separate processes with extended permissions called from the main application.

GitHub Actions

- name: Build MAS
  run: npx electron-builder --mac mas
  env:
    APPLE_ID:          ${{ secrets.APPLE_ID }}
    APPLE_TEAM_ID:     ${{ secrets.APPLE_TEAM_ID }}
    CSC_LINK:          ${{ secrets.MAS_CERTIFICATE }}
    CSC_KEY_PASSWORD:  ${{ secrets.MAS_CERTIFICATE_PWD }}

- name: Upload to App Store Connect
  run: |
    xcrun altool --upload-app \
      --file "dist/mas/AppName.pkg" \
      --type osx \
      --apiKey   "${{ secrets.ASC_API_KEY }}" \
      --apiIssuer "${{ secrets.ASC_ISSUER_ID }}"

Apple review takes 1 to 7 days. Updates usually proceed faster than first publication.

Timeline

Setup of sandbox compatibility, provisioning profiles, and first publication to Mac App Store: 4–6 business days.