I built a desktop app in Python (PySide6 + MediaPipe + ONNX, ~33k lines) and shipped it to real beta users on macOS and Windows. Building the app took months. Getting it to install and run on other people's machines took weeks of fighting Apple's notarization, Windows antivirus heuristics, and browser download blocking — and almost none of it is documented in one place.
This is that one place. Everything below happened to me, with the exact errors and the exact fixes.
Part 1 — macOS: signing and notarization
Without Developer ID signing + notarization, your users get "App is damaged and can't be opened. You should move it to the Trash." That message alone kills your app for non-technical users.
The paperwork is easy: Apple Developer account ($99/year), create a Developer ID Application certificate, create an app-specific password, store it once with xcrun notarytool store-credentials. Then the actual pipeline is: codesign every binary with hardened runtime → zip → submit to Apple → staple the ticket. Simple in theory. Here are the three traps that each cost me hours.
