Thanks JonArnold, these are some excellent detailed steps! For other struggling through this, here is some additional vital information about certificates I've discovered through exhaustive reading on Apple's developer site. Changes in OS X 10.9.5 mandate some measures that aren't reflected in most guidelines for packaging and codesigning, including Adobe's post linked above, and all the other links. It turns out that there is a different type of certificate for signing apps for submission to Apple for Mac App Store distribution than the certificate needed for independent distribution. Despite the fact that some of Apple's documents say that certificates issued by legitimate third parties can be used for codesign, despite the fact that a certificate can pass internal certification and be marked OK for codesign in Keychain Access, it seems that only a proper certificate issued from Apple's developer program will do the trick. For submission to Apple for distribution to the Mac App Store, you will need to manually codesign your AIR app properly using a Mac App Distribution certificate. In Keychain Access, this certificate will have a "3rd Party Mac Developer Application:" prefix. For independent distribution, you will need to manually codesign your AIR app using a Developer ID Distribution certificate. In Keychain Access, this certificate will have a "DeveloperID Application:" prefix. Tip: Because of very inconsistent labeling of certificates (differing names in the online portal, filename when downloaded, name in Xcode, name in Keychain Access), I recommend clearly renaming downloaded .cer certificates by appending a clear description as well as the date of expiry to match that in the development portal. When performing a manual codesign on an app destined for Mac App Store distribution, spctl and Gatekeeper will reject the resulting app! It is only after Apple approves your submission and publishes the app on the Mac App Store that it will pass spctl and Gatekeeper test. I’m still getting our development team setup for the Developer ID provision and will report back with details when I go through this process.
... View more