Now, that we already know all the pieces involved in this particular puzzle (certificates, sandboxing, notarization, hardened runtime, etc.), the question to answer is…

What kind of macOS code signing do you want to do today?

Apple developer certificates installed on your Mac determine the kind of code signing and, thus, the distribution options available for your macOS app. They can also support certain macOS security requirements that distribution methods or features may impose, such as entitlements or provisioning profiles.

This diagram can help determine these based on the certificate used when signing the app, so you can get a better idea:

As a practical summary:

• Ad-Hoc signing / None: This option makes sense primarily when you’re developing and running or debugging the app on your Mac or on the same computer, since it typically doesn’t require special entitlements or provisioning profiles.
• Apple Developer / Development. Using this certificate enables sandboxing, hardened runtime, entitlements and provisioning profiles even when debugging from the IDE or testing the build on your own computer. It offers a better experience, but you won’t be able to notarize it or bypass the Gatekeeper barrier if distributed to other users.
• Developer ID Application / Direct Distribution. With this certificate, you can notarize your app so Gatekeeper won’t block distribution outside the Mac App Store. When debugging from the IDE, entitlements and provisioning profiles (if needed) are applied as well, along with optional sandboxing.
• Apple Distribution / App Store. Use this certificate when the app has been tested and it is ready to be sent to App Store Connect… or even when you’re planning to send it to the App Store Connect so a group of beta-testers can test it using Apple’s TestFlight.

How the Xojo IDE helps with all of this?

We have been adding features to the Xojo IDE to make code signing and distributing your macOS apps an easier and leaner process; most of these are available under Build Settings > macOS > Sign:

Developer ID – Build For

This is the most recent addition to better deal with the first, and most important, piece of the puzzle: handling certificates! Instead of having to go back and forth between the Keychain Access and the Xojo IDE to copy/paste the expected data from the certificates for the kind of build or distribution you plan for the app, you can now find under the Developer ID field all the available Developer Teams (usually just yours) and, when a Developer Team is selected, the “Build For” popup menu will be populated with the available options for builds/distributions based on the installed developer certificates for that team.

When all the Apple developer certificates are properly installed for a given Developer Team, the available options will be: Development, Direct Distribution and App Store (plus None, meaning Ad-Hoc signing).

If you find that some of these options are missing from the “Build For” popup menu, that means the corresponding certificate is not installed or there is some kind of issue with that certificate (maybe it has expired or has its private key missing). In those cases, we included the “Inspect…” option under the “Developer ID” popup menu. Selecting Inspect lets you gain a better picture about everything related to your Apple developer certificates and even get advice about how to fix the most common issues.

Sandboxing

Enable this feature if you plan to debug, build, or distribute your app as a sandboxed app. In that case, the associated editor will make it even easier to enable the sandboxing features that may apply to your particular app. The IDE will take care of all the rest. Note that, while sandboxing was previously only applied to built/distributed macOS apps in previous Xojo releases, starting with Xojo 2026r1 it is also applied when the app is being debugged from the IDE.

Hardened Runtime

Enable this option mainly for apps meant to be built and/or distributed using Direct Distribution or the App Store options. While this is optional when distributing it via the Mac App Store, it is still highly recommended to enable it for that scenario.

When the app is debugged from the IDE, the hardened runtime won’t be applied even if it is enabled… mainly so you can debug it!

As with sandboxing, the hardened runtime option also includes its own editor to make your app-specific selections easier. The IDE will take care of the under the hood processing when the app is built.

Notarization

If you haven’t started notarizing your macOS apps yet, now is the time! This will be possible only with the Direct Distribution option (equivalent to the Developer ID Application Certificate) and implies enabling hardened runtime. When you enable notarization, the associated hardened runtime will be enabled for you, even if you don’t select additional option from its editor.

Notarization requires the use of what Apple calls an App-Specific Password, which you can set up by following the steps found in the window that appears when the associated Setup button is clicked.

Once everything has been setup, the notarization process will happen the next time the app is built. Note, the notarization process will not take place when the app is debugged from the IDE (as with hardened runtime); you don’t need to specifically disable that option.

Entitlements

The combination of certain certificates, build, and distribution options you choose for your app may require you to set a series of entitlements; for example, when enabling sandboxing and/or hardened runtime. Additionally, with Xojo 2026r1 it is possible to attach your built or debugged apps to Xcode Instruments for further inspections beyond the current capabilities of Xojo’s debugger.

In all of the above scenarios, Xojo will take care of the required entitlements without you needing to notice it; but if your app also makes use of some features that require adding extra entitlements (and probably a matching provisioning profile), as happens with most of the Apple specific services such as iCloud, Keychain, In-App Purchases, etc., you will need to craft the corresponding .plist file for them and add it using the User Entitlements option. These entitlements will be combined with the ones automatically generated by Xojo and included in the app during the code signing process.

Provisioning Profiles

On macOS, provisioning profiles are supported by a Copy Files build step, which requires selecting Contents as the destination folder. Not ideal, but that way you can select what kind of provisioning profile you want to apply to builds or when debugging your project (this is a new feature starting with Xojo 2026r1).

Property List Editor

The ability to add your own property list entries to the compiled/distributed macOS app is enhanced by a complete Property List Editor available under Build Settings > macOS since Xojo 2025. It makes it easier to create these entries and even save them for reuse in other projects.

The entries you add with the Property List Editor will be combined with those automatically generated by the IDE, or with entries that may have been added to the project using previous methods (such as adding an external .plist file to the Project Navigator sidebar).

Publishing to the Mac App Store

While there are some steps that need to be done both at Apple’s Developers Portal and App Store Connect Website, you will be able to set your app category directly from the IDE under Build Settings > macOS.

In addition, the Publish feature (responsible for sending your app to App Store Connect) will be in charge of verifying that the project meets everything that Apple requires prior to send it for reviewing or making available through TestFlight.

In order for the Publish button to be enabled, you need to select the App Store option for the selected “Developer ID” Team from the “Build For” popup menu under Build Settings > macOS > Sign.

Dealing with Certificates Issues

It doesn’t matter if your app requires entitlements, provisioning profiles, or if you are going to notarize it or enable sandboxing plus hardened runtime. All of this is based on the signing of your developer certificates, so let’s go back and see how to deal with the most common issues related with these.

Backup Your Certificates

Once you have installed your certificates, the first thing you should do is export them from Keychain Access to a secure place (ideally, not in your computer but an external USB key or drive). Why? Here’s why:

1. Apple only allows you to create certificates a maximum of five times per year (mostly because they expire after one year, as we did see in a previous entry). Every time you install certificates, whether on the same computer or a different Mac you own, they count as new certificates, with different serial numbers and SHA1/SHA256 data. In practice, this reduces the number of installations available per year.
2. In addition, some features, like provisioning profiles, rely on the specific certificates selected during their creation. You will get a signing error if you build the app on a Mac with different certificates.
3. If you need to restore your Mac or migrate to a new Mac, your certificates won’t be restored using the usual tools from Apple. Having a backup of your developer certificates will make easier to restore them in Keychain Access after restoring your computer or when you change to a new Mac.

Instead of using Xcode to install new certificates on every Mac you intend to use for code signing, install them on just one Mac, export them from that Mac, and import them into the Keychain Access app on your other Macs. This ensures all of your Macs will use the same certificates.

Review Pending Apple Developer Agreements

This is one of the most common issues related to code signing: it just stops working and you don’t know why and even the returned error messages doesn’t reveal why. If you’re sure you have the required developer certificates installed, they are valid (not expired), and don’t have any other issues then it is time to sign-in into the Apple Developer and App Store Connect portals to check if there are some pending agreements you need to accept.

Missing and Expired Certificates

This is another very common issue. Starting with Xojo 2026r1, we made easier to detect this situation. If a given certificate for your team is not installed, then you won’t be able to select the signing option from the “Build For” popup menu under Build Settings > macOS > Sign. You can further dig into it selecting the “Inspect…” option from the “Developer ID” popup menu, and even receive some advice on how to fix it!

Certificates are all good… but the signing throws errors

When using the Direct Distribution or App Store options, the code signing process uses Apple Time Servers to add the date and time as part of the signing. That means that the computer requires an active Internet connection, and that such time servers must be reachable from Apple’s side (it’s very rare for them to be down).

Other operations such as notarization and publish also require an active Internet connection, and the corresponding Apple services must be up and running. Some times these can be down.

When these issues occur, it is a good idea to check the Apple Services status webpage.

In summary

It’s been a long four-article ride with the aim of giving you a clearer understanding of what happens under the hood when you code sign your macOS apps, what kind of certificate you need for a given distribution, and which macOS security features are supported by Development, Developer ID Application or Apple Distribution certificates; and, most importantly, how Xojo helps you with all of it!

I’d love to hear about your experience with macOS code signing, the rough corners you still need to tackle, and other improvements you would welcome. The Xojo forums are a great place to keep the conversation going!

Happy macOS code signing with Xojo!

Javier Menendez is an engineer at Xojo and has been using Xojo since 1998. He lives in Castellón, Spain and hosts regular Xojo hangouts en español. Ask Javier questions on Twitter at @XojoES or on the Xojo Forum.

• Facebook
• X
• LinkedIn
• GitHub
• YouTube

Code Signing on macOS: What Developers Need to Know

• Part 1, Get Started
• Part 2, Code Signing With Developer Certificates
• Part 3, Entitlements and Provisioning Profiles
• Part 4, How Xojo helps with Certificates, Signing and Distribution

The Developer ID field was introduced in Xojo 2022r1, allowing you to fill in the developer certificate information needed for signing built macOS apps; however, it could be confusing to know exactly what information was expected.

• Developer ID Application
• Developer ID Application: Francisco Javier Rodriguez Menendez
• Developer ID Application: Francisco Javier Rodriguez Menendez (BW7PU32485)
• 7D767DB917A45A8976BEB5B92F04E8C18D09501A

And… which certificate should be used for Development builds, Direct Distribution, or Mac App Store publishing? That may not be obvious for someone new to all this.

Additionally, what happens if the entered data comes from an expired certificate or if the certificate isn’t in the Keychain?

The new approach: How it works

The Team-based signing chooser for the Mac Developer ID field follows these steps:

• Collects all the developer certificates found under the user Keychain.
• Groups the valid certificates by Team (what Apple designates as the TeamID).
• Based on the previous information, the new popup menu “Build For” will offer only the code-signing options available for the current selected Team:
  • Development. This is the equivalent to using the Apple Development certificate.
  • Direct Distribution. This is the equivalent to using the Developer ID Application certificate.
  • App Store. This is the equivalent to using the Apple Distribution certificate. In addition, the Publish feature will be enabled if, for the selected Team, there is also a valid 3rd‑party Mac Developer Installer certificate available.

If None is selected in the Developer ID popup menu, the macOS app will be built/debugged using Ad-Hoc signing.

Both menus update on the fly, so if new certificates are added (or removed) from the keychain, or if any have expired since last opened, both the Developer ID and Build For popup menus will reflect those changes.

macOS Certificates Inspector Window

Under the Teams popup menu, there is also an Inspect… option. When selected, it opens a new window where you can view and gather additional information for:

• Installed / Missing Apple Intermediate Certificates.
• Installed / Missing / Expired Developer Certificates, grouped by Team.

At a glance, you’ll see useful details for each certificate, such as:

• The expiration date
• The keychain where it is stored.
• Serial number, useful for identifying same-kind developer / intermediate certificates under different Macs.
• Issuer specific information.

Clicking any certificate provides more detailed information about the role it plays in the macOS signing process.

This Inspector is also useful in order to identify some of the most common issues related with the handling of certificates such as:

• Missing certificates for a given Team, determining thus the options that are available under the “Build For” popup menu.
• Expired certificates. These also determine the options that are available under the “Build For” popup menu for a given Team. In addition, if you want to do some cleanup, it is possible to delete these expired certificates directly from the Inspector without needing to open the Keychain Access app.
• About to expire certificates, so you are aware of it and the impact it could have on apps close to be distributed or on already created Provisioning Profiles, for example.
• Certificates with their private key missing. These can’t be used for signing purposes, so you will be able to re-install them in the keychain (if you have a backup) or install a new certificate.
• Developer Certificates where some of the required intermediate certificate is missing. You will be able to install the missing Intermediate (active Internet connection required).

Improvements to macOS Builds and Debugged apps

Although Sandboxing, Entitlements, and Provisioning Profiles have been part of macOS app development, this release brings several enhancements in these areas:

• Now it is possible debug Sandboxed apps directly from the IDE.
• Entitlements and Provisioning Profile are applied when the app is debugged from the IDE.
• Improvements in how the required Entitlements are added and signed when the macOS app is built; and also a better handling of the user-added entitlements and provisioning profile files (if required).
• Debugged and Built apps can be attached to the Instruments app. Among other things, Instruments can be used to detect issues such as memory leaks in the executed app. The IDE now automatically adds the required entitlement for this when: the app is debugged/built using the “None” (Ad-Hoc signing) from the Team popup menu, or, 2) when the app is built for Development (Build For) for a given Team.

When Build For is set to Direct Distribution or App Store, the required entitlement for Instruments to attach to the app, will be added only when the app is debugged from the IDE. If you want to use Instruments with a built app signed using these certificates, then you need to add that entitlement explicitly.

This decision is because when get-tasks-allow is set to True (the entitlement required in order Instrument being able to function), there are some well documented vulnerabilities that could be used to escalate privileges or inject code into your app. That’s not desirable for your distributed apps for sure (whether using Direct Distribution or if your app is installed through the Mac App Store).

Looking forward

We know there are still some areas to improve regarding code signing on macOS (and iOS) and we are working on some of them already. In the meantime, you’ll likely find the new Team-based Developer ID option more approachable, especially if this is your first experience dealing with certificates, signing, and distributing your freshly built macOS app.

A big THANK YOU to Richard Grafl for all his help and feedback during the beta-testing cycle of this feature.

Happy macOS code-signing!

Javier Menendez is an engineer at Xojo and has been using Xojo since 1998. He lives in Castellón, Spain and hosts regular Xojo hangouts en español. Ask Javier questions on Twitter at @XojoES or on the Xojo Forum.

• Facebook
• X
• LinkedIn
• GitHub
• YouTube

Learn more about Code Signing in our recent series:

Code Signing on macOS: What Developers Need to Know

• Part 1, Get Started
• Part 2, Code Signing With Developer Certificates
• Part 3, Entitlements and Provisioning Profiles
• Part 4, How Xojo helps with Certificates, Signing and Distribution

For the past 20 years, Apple has increasingly tightened security measures when it comes to running apps distributed by third parties. Let’s take a look at this summarized timeline of code-signing and security measures added by Apple over years:

The most notable developments happened in 2011, 2012 and 2018, when terms like Sandbox and, especially, Containers, Gatekeeper, Hardened Runtime and Notarization were introduced and began to impact other pieces of the puzzle to consider when signing macOS apps. In fact, we could say that technologies such as code-signing, Sandboxing, Entitlements or Provisioning Profiles were among the first iOS technologies to make their way to macOS.

So here is an broad overview what these technologies mean:

• Sandboxing– When used, Sandboxing confines applications to a restricted, designated area of the system (its own “container”), preventing them from accessing user data, hardware or other apps without explicit permission. The system requires apps to ask for permission to use hardware resources or access user files. Sandboxing is mandatory for apps distributed through the Mac App Store.
• Gatekeeper- This technology is the primary security layer that checks whether a downloaded app comes from a verified/known developer, especially when the application has been Notarized by Apple.
• Hardened Runtime– Acts as a proactive, system-enforced shield that protects applications while they run, preventing malicious code from exploiting legitimate software. Enabling Hardened Runtime is required for Notarization.
• Notarization– Notarization is an automated security screening process run by Apple that scans software distributed outside the Mac App Store for malicious components and known security issues. Today, notarization is required for software distributed outside the Mac App Store that has been signed with the Developer ID application certificate. As a result of the process, notarization generates and staples a ticket, signed by an Apple certificate, to the app so Gatekeeper can trust it when executed.

So, basically, while Sandboxing is still optional for apps distributed outside the Mac App Store (i.e., signed with your Developer ID certificate), Notarization and Hardened Runtime are the recommended defaults. Enabling Sandboxing for your app is something you should consider based on the needs (features) and the privacy balance you want to offer your users.

If you plan to distribute the app through the Mac App Store as well, it will need to be Sandboxed and signed with your Apple Distribution certificate, while enabling Hardened Runtime is optional.

Entitlements and Provisioning Profiles

Entitlements and Provisioning Profiles are also required for many of these security measures, depending on the features and services your app uses, and they come into play during building and signing.

If you decide to go the Sandboxing route, then using Entitlements is mandatory. The good news is that Sandboxing entitlements are free to use (they don’t require creating or adding a Provisioning Profile to the project). However, if your app needs special access to the Keychain or uses iCloud, Apple Pay, or other services, you’ll need to create a Provisioning Profile in the Apple Developer portal.

Wait—what are Entitlements and Provisioning Profiles, and how do they relate to macOS app code signing?

Entitlements

Entitlements are XML-based .plist files (not unlike the app’s Info.plist) containing a set of key-value pairs. They are embedded directly into the app’s binary as part of the code signing process, typically using your Developer ID Application or Apple Distribution certificates.

Provisioning Profiles

While Entitlements are just a file, Provisioning Profiles are a different beast:

Provisioning Profiles must be created in the Apple Developer Portal. When you create one, you specify the App ID (the combination of your Team ID and the app bundle identifier which are case sensitive so pay attention). Even if you don’t plan to distribute your macOS app via the Mac App Store, you still need a Provisioning Profile, which requires creating an App ID first in the Developer Portal.

There are two kinds of Provisioning Profiles: Development and Distribution. As part of the provisioning profile creation, you must choose which type you will use.

• Development Provisioning Profiles are used while you’re developing your app; the app is signed with an Apple Development certificate and is intended to run on a set of Mac computers you’ve registered. During creation, you can add as many Apple Development certificates as you have under your Team ID.
• Distribution Provisioning Profiles are used when distributing your app. For direct distribution, sign with the same Developer ID certificate you’ll use for signing the app; for Mac App Store distribution, sign with the Apple Distribution certificate.
• Development and Distribution Provisioning Profiles do expire. This is something to keep in mind, especially when deploying new or updated versions of your app, because you may need to create new profiles.
• Development and Distribution Profiles are editable. If you make a mistake, note that both types can be edited in the Apple Developer portal, but only for certain fields: the App ID, the profile name, the selected certificate, and (for Development profiles) the included testing devices.

When Certificates and/or Provisioning Profiles expire…

We’ve already noted in previous articles that Apple Developer certificates expire one year after they’re created. We’ve also learned that if your app relies on a Distribution Provisioning Profile, that profile can expire as well. So, what does this mean for your already deployed apps?

No worries. Let’s focus first on directly distributed macOS apps (those signed with the Developer ID certificate) and pull one screenshot from the previous article:

Observe the highlighted Timestamp line. When the app is signed, the date is added automatically (retrieved from Apple’s servers). So, when a user runs an app whose embedded Developer ID Certificate has expired since its release, Gatekeeper will rely on that timestamp, compare it to the embedded certificate’s expiration date, and if everything matches—meaning it was signed before the certificate expired—the app will continue to work, provided the embedded certificate has not been revoked by the developer. In addition, if the app was Notarized, that helps a lot, because the stapled ticket includes its own timestamp and was signed with a longer-lasting Apple Certificate.

If the app is distributed through the Mac App Store, there’s good news. After you submit the app for distribution via App Store Connect and it passes Apple’s review, the app’s signing with your Apple Distribution certificate is replaced by Apple’s own signing. This means that users who install the app from the Mac App Store can continue to run it even if your original Apple Distribution certificate expired long ago.

Distribution Provisioning Profiles behave differently from others: once they expire, the app containing such a Distribution Profile will fail to execute.

The good news is that a Distribution Profile lasts for a very long time (around 18 years) so you’ll likely have ample time to create new distribution provisioning profiles and deploy updates that use renewed profiles well before users are affected.

Of course, as soon as any of your Apple Developer certificates expire, you already know how to request and install new ones in your Mac keychain.

Nearly Concluded

In the next, and last article, we will see how Xojo helps with everything related to signing and distributing your macOS apps. I’ll also show you how to deal with some of the most common issues related with certificates.

Javier Menendez is an engineer at Xojo and has been using Xojo since 1998. He lives in Castellón, Spain and hosts regular Xojo hangouts en español. Ask Javier questions on Twitter at @XojoES or on the Xojo Forum.

• Facebook
• X
• LinkedIn
• GitHub
• YouTube

Code Signing on macOS: What Developers Need to Know

• Part 1, Get Started
• Part 2, Code Signing With Developer Certificates
• Part 3, Entitlements and Provisioning Profiles
• Part 4, How Xojo helps with Certificates, Signing and Distribution

But before we can reach our leaf developer certificates, we also need to have the Apple Development Intermediate certificates installed in our keychain. These are typically found in the Login keychain, though they can also be found in the System Roots or System keychains.

Installing Apple Developer Intermediate Certificates

Since Xcode 11.4.1 and later, these can be automatically downloaded and installed in the keychain, but if not, they can also can be downloaded from the Apple PKI webpage. The ones we are interested in are:

• Developer ID – G2
• Worldwide Developer Relations – G2
• Worldwide Developer Relations – G3
• Worldwide Developer Relations – G4
• Worldwide Developer Relations – G5
• Worldwide Developer Relations – G6

Note: The Developer ID – G2 certificate corresponds to the Developer ID Certification Authority. The WWDR certificates (G2–G6) correspond to the Apple Worldwide Developer Relations Certification Authority.

As you can see from the list, there are several versions (or generations) for the WWDR Intermediate certificate; so, which one should you download? The short answer: it depends.

On February, 7, 2023 the previous WWDR intermediate certificate expired; so Apple decided to rollout a new renewed version that will expire on February 20, 2030. As part of that update Apple issued additional Intermediate certificates to better segment the purpose of different certificates:

• G2: ECDSA signing for Apple Pay.
• G3: Software signing and Services.
• G4: Features supported by Apple Push Notification Service.
• G5: App Store Signing and Services.
• G6: ECDSA signing of Software and Services.

In practice, G3, G4, and G5 are sufficient for most scenarios.

Developer Certificates: The final goal!

To focus on the subject, what kind of leaf developer certificates are created from these two types of Intermediate certificates? This scheme will help:

As you can see from the above diagram, there are four main leaf certificates we will use to sign our macOS apps, based on their prefix:

• Developer ID Application. Use this one to code sign a macOS app distributed outside the Mac App Store.
• Developer ID Installer. Use this one to code sign the Installer, DMG or .pgk file of a macOS app distributed outside the Mac App Store.
• Apple Distribution. This certificate is required to code sign a macOS app sent to the AppStore Connect for its distribution through the Mac App Store.
• 3rd Party Mac Developer Installer. This Certificate is required to code sign the package of the app sent to the AppStore Connect. For example, when using the Publish feature from the Xojo IDE.

Creating and Installing the Developer Certificates

As stated in the first article of this series, you need a paid Apple Developer Program membership. Once that’s in place, the easiest way to install these required certificates in your macOS Keychain is through Xcode.

So, if it is the first time you need to install them on a Mac computer:

1. Go to Xcode > Preferences.
2. Select Apple Accounts.
3. Use your developer credentials to login into your developer account, or select it from the list if you are already logged.
4. Select the Team from the list.
5. Click the “Manage Certificates…” button.
6. Click the “+” popup menu in the lower-left corner of the resulting window, and select the developer certificate you want to install (all of these if it is the first time you install them).

Note: Under the hood, Xcode follows the same process described for installing the developer certificates manually.

If you prefer to go through the manual process instead:

1. Access the Apple Developer website.
2. In Certificates, Identifiers & Profiles, click Certificates in the sidebar.
3. On the top left, click the add button (+).
4. Under Software, select Developer ID, then click Continue.
   • Developer ID Application: This certificate is used to code sign your app for distribution outside of the Mac App Store Connect.
   • Developer ID Installer: This certificate is used to sign your app’s installer Package for distribution outside of the Mac App Store Connect.
   • Apple Development: Used to run and debug apps on macOS during development.
   • Apple Distribution: Used to sign apps for submission to App Store Connect.
   • Mac App Distribution: Used to sign macOS apps intended to be distributed through the Mac App Store.
   • Mac Installer Distribution: Used to send the macOS app to the App Store Connect for TestFlight or distribution through the Mac App Store.
5. Follow the instructions to create a certificate signing request.
6. Click Choose File.
7. In the dialog that appears, select the certificate request file (a file with a .certSigningRequest file extension), then click Choose.
8. Click Continue.
9. Click Download.
10. The certificate file (a file with a .cer file extension) appears in your Downloads folder.
11. To install the certificate in your keychain, double-click the downloaded certificate file. The certificate appears in the My Certificates category in Keychain Access.

It’s All About Identities

While Intermediate and Root certificates only have the Public Key on them, so they can verify other (leaf) certificates, the leaf certificates installed on your macOS Login keychain behave a bit different. Let’s see how.

Both if you use Xcode or create the CSR request manually to generate the developer certificates, using the Keychain Access app for that, in both of these scenarios a Private Key will be created and stored locally on your keychain as part of the process. Only the public key section of that private key is sent to the Apple servers so it can be included in the generated developer certificate. Once any of the possible developer certificates is downloaded and installed in the keychain, such certificate will have its private key associated with it:

The pair of the developer certificate and the associated private key is what is called an Identity.

Code signing With Developer Certificates

In fact, while we often say or hear “code signing with certificates,” the real signing of the app is done with the private key associated with that certificate. The certificate itself (and thus the public key portion of that key pair) is included in the signing process. This allows macOS to verify the signature each time the user runs the app

Do you remember the diagram showing how the “Ad-Hoc” code signing process works? Let’s compare it when the same process is done using a “Developer ID Application” Certificate… and, most important, the associated private key:

As you can see, in this case the data is cyphered using the private key from the developer certificate and, then, the certificate itself is stored as part of the app itself. So, if for example we build this time an empty Desktop app for macOS using the Developer ID Application, and open the resulting CodeResources file in a text editor we will see something different compared with the Ad-Hoc signed version:

In this case the field requirement associated with each file and hash value is significantly more strict. In fact, it makes reference to the Chain of Trust Gatekeeper is required to follow and validate. In plain English, the highlighted lines come to say something like:

1. Hey! make sure there is a Developer ID Application certificate (Apple Extension attribute —OID— 1.2.840.113635.100.6.1.13 for the X.509 certificate), for the developer with a TeamID BW7PU32485.
2. Next, verify such certificate is issued by the “Apple Developer ID Certificate Authority” (other of the Apple-specific X.509 extension, attribute or OID. In this case: 1.2.840.113635.100.6.2.6).
3. And finally, go down through the Chain of Trust and verify the previous one with the Anchor certificate (Apple Root CA, do you remember?)

So far so good. But how we can know if the app meets these requirements; and what about the certificates themselves? Well, it’s easy to check both using the codesign tool.

Open a Terminal window and type the following command:

codesign --verify -vvv "MyApp.app"

The output will be something similar to this:

As you can see in the highlighted lines, yes, it satisfies the Designated Requirements we saw in our CodeResources file! Also, the previous line states that it is valid on disk. That means:

• All of the expected files are present.
• There are no extra files.
• None of the files have been modified.
• A basic trust evaluation of the leaf certificate was successful.
• And it satisfies its own Designated Requirements (DR).

It is even possible to see the Chain of Trust for the code signature issuing:

codesign --display -vv "MyApp.app" 

And if you are curious enough, it is even possible to extract the embedded certificates stored in the CMS structure within the code signature:

codesign --display --extract-certificates "MyApp.app"

As result it will, usually, create three files. Take a closer look at the “Issuer” and “Subject” lines; specially on the Subject line for the OU value (Organizative Unit or, using Apple wording, the TeamID) for the codesign0 file. Do you remember the “leaf[subject.OU=BW7PU32485]” data from the CodeResources file? :

codesign0. This is the file for the Leaf certificate; in our example “Developer ID Application”.

codesign1. This one is for the Intermediate Certificate; in our example “Apple Developer ID Certificate Authority”.

codesign2. This one is for the Anchor Certificate; in our example “Apple Root CA”

As shown by the Issuer line in the codesign0 file for our “Developer ID Application,” it points to the previous certificate in the trust chain—the Developer ID Certification Authority. The codesign1 file for the extracted Developer ID Certification Authority points to the Apple Certification Authority in its Issuer field. Finally, the codesign1 certificate points to itself because, as the Root Certificate, it serves as the anchor for the trust chain.

Wrapping up

In this second article, we delved deeper into how Apple Developer certificates work, how a macOS app is signed (Ad-Hoc or with a specific developer certificate), and how the OS’s security features validate the signing when a user tries to run the app.

In the next article, we will cover more details about signing apps for the two main distribution types: Direct distribution and Mac App Store. We will also discuss what happens when certificates expire and how to troubleshoot the most common issues related to development certificates.

Javier Menendez is an engineer at Xojo and has been using Xojo since 1998. He lives in Castellón, Spain and hosts regular Xojo hangouts en español. Ask Javier questions on Twitter at @XojoES or on the Xojo Forum.

• Facebook
• X
• LinkedIn
• GitHub
• YouTube

Code Signing on macOS: What Developers Need to Know

• Part 1, Get Started
• Part 2, Code Signing With Developer Certificates
• Part 3, Entitlements and Provisioning Profiles
• Part 4, How Xojo helps with Certificates, Signing and Distribution

This blog series provides a clear, practical overview of how certificates work, with a focus on signing and distributing macOS applications. Some concepts apply to digital certificates in general, while others are specific to the macOS code signing process. By the end of the series, you’ll understand what certificates are, why they matter, and the role they play when building and distributing a macOS app.

The Developer ID field in the Build Settings > macOS > Sign Inspector Panel is our starting point:

By default, this field is empty. When you click Build, the app bundle (and its contents) is signed using a more relaxed security configuration. This does not require an explicit developer certificate and does not verify that the app comes from a known, trusted developer.

This type of signing is called Ad-Hoc signing. It is perfectly fine when debugging from the IDE or when building apps you intend to run locally.

In earlier versions of macOS, it was even possible to distribute and run Ad-Hoc–signed apps on other Macs, as long as the user explicitly chose to trust them. While this is still technically possible on recent versions of macOS, Apple has continued to tighten security, making it increasingly difficult for users to launch Ad-Hoc–signed applications.

In most cases, Gatekeeper will intervene and prevent the app from launching. Since the system cannot verify the identity of a trusted developer, it treats the app as unverified. With Ad-Hoc signing, macOS can only confirm that the app has not been modified since it was signed, it cannot validate who created it.

Under the hood: How “Ad-Hoc” signing works

Every time an app is signed (including all the contents inside its bundle) macOS uses Apple’s codesign tool. When Ad-Hoc signing is applied, the simplified process works roughly like this:

• A hash value (a unique digital fingerprint) is calculated for every file in the app bundle, whether it is executable or not, as well as for the bundle itself.
• These hash values are stored inside the app bundle, in the _CodeSignature folder.
• If the app contains multiple architectures (for example, x86 and ARM), the process is repeated for each supported architecture.

When a user double-clicks the app to launch it, macOS performs a similar verification process:

• It recalculates the hash value for every file in the bundle.
• It compares the newly calculated values with those stored in the _CodeSignature folder and if any hash differs from the stored value, macOS determines that the bundle has been modified since it was signed and it will refuse to launch the app.

Want to see this in action? Create a new Desktop project in the Xojo IDE, save it to your Documents folder, and build it for macOS.

Next, locate the built app in Finder. Control-click it and choose “Show Package Contents.” Then open the Contents > _CodeSignature folder and inspect the CodeResources file using your favorite text editor. You’ll see a list of hash values and digests corresponding to every file in the app bundle.

Apple Developer Certificates: Establishing Trust on macOS

What must you do so your apps are recognized as first-class citizens on macOS and can be distributed without Gatekeeper intervening? The answer is likely familiar: enroll in the Apple Developer Program (currently US $99 per year).

Among its many benefits, membership in the Apple Developer Program allows you to create your own Developer ID certificates. When you use these certificates to sign your apps, macOS can validate the signature and identify you as the verified developer distributing the software.

But how is this trust established and verified? To answer that, we need to start at the very root, literally!

Every computer, smartphone, tablet, and many other devices come with preinstalled Root Certificates. These certificates are issued by trusted organizations known as Root Certificate Authorities (CAs), including Apple. They serve as the foundation of a chain of trust, allowing other certificates issued by those authorities to be verified.

Technically speaking, a Root Certificate Authority (CA) is the top-level trusted entity in a public key infrastructure (PKI). It issues self-signed root certificates that act as the trust anchor for verifying other digital certificates. In other words, it is the foundation upon which the entire certificate trust model is built.

It is easy to take a look to these installed on your Mac:

1. Open Keychain Access.
2. Select Certificates at the top of the window.
3. In the sidebar, choose System Roots.
4. You will then see the complete list of root certificates trusted by macOS.

You’ll notice that there are three different Apple Root CA certificates. Why?

Each X.509 certificate contains detailed metadata defining its cryptographic properties and permitted usage. This includes the key type (such as RSA or ECDSA), the public key length, and the signature algorithm used.

• Apple Root CA: Is a RSA type, with a public key length of 2048 bits that uses the SHA-1 algorithm.
• Apple Root CA-G2: Is a RSA type, with a public key length of 4096 bits that uses the SHA-384 algorithm.
• Apple Root CA-G3: Is a ECDSA type, with a public key length of 384 bits that uses the SHA-384 algorithm.

Intermediate Certificates and the Chain of Trust

Root certificates are highly valuable and sensitive, so they are rarely used directly to sign end-user certificates (also called “Leaf” certificates). In the case of macOS app development, the developer’s certificate is the Leaf. This is where Intermediate Certificates come into play.

In simple terms, Intermediate Certificates are signed by Root Certificates and, in turn, are used to sign Leaf certificates. This protects the Root certificate from direct exposure. Together, the Root, Intermediate, and Leaf certificates form what is called the “Chain of Trust.”

The Chain of Trust verification starts with the Leaf certificate and works upward through the Intermediate to the Root. This same process occurs whenever you visit a secure website, make an online payment, or transmit sensitive data securely.

For example, the Leaf certificate is validated against its Intermediate certificate. If the Intermediate certificate is missing or expired, the Leaf certificate is considered invalid. Similarly, the Intermediate certificate itself must be validated against the Root certificate. If the Root certificate is missing or expired, the Intermediate is invalid, and all Leaf certificates signed by it are also invalid.

The same process happens when you sign your macOS apps: macOS validates the entire certificate chain before allowing the app to run.

Finally, certificates closer to the Root generally have longer validity periods. Leaf certificates must be renewed more frequently, while Root certificates are valid for many years.

Wrapping up

In this first article, we covered the fundamentals of digital certificates and their role in macOS app security. In the next article, we will focus specifically on Apple Developer certificates and how they enable trusted app distribution.

Javier Menendez is an engineer at Xojo and has been using Xojo since 1998. He lives in Castellón, Spain and hosts regular Xojo hangouts en español. Ask Javier questions on Twitter at @XojoES or on the Xojo Forum.

• Facebook
• X
• LinkedIn
• GitHub
• YouTube

Code Signing on macOS: What Developers Need to Know

• Part 1, Get Started
• Part 2, Code Signing With Developer Certificates
• Part 3, Entitlements and Provisioning Profiles
• Part 4, How Xojo helps with Certificates, Signing and Distribution

macOS 26 and iOS 26

Over time, Apple has brought the user experiences of macOS and iOS closer together. macOS 26 and iOS 26, now aligned in version numbers, also share more similarities than ever in their user experience. These updates represent the most significant user experience changes from Apple since iOS was introduced in 2007 and Aqua for macOS seven years earlier. With such a big update, especially when designing elements to work on both large computers displays as well as small smartphone screens, it’s no surprise there’s some tweaking requiring after release. Clearly, Apple is still refining its platforms.

We continue to update Xojo as Apple defines its preferred user experience, ensuring that you can deliver the best possible experience to your users.

WinUI

We are also hard at work upgrading our Windows framework to WinUI, providing a modern user experience for Windows apps. You can see our progress in each release by enabling the Use WinUI (Experimental) option on the Advanced tab in Windows build settings. The “Experimental” label is a reminder that the feature is still evolving, and it will be removed once WinUI is fully ready. Our goal has always been to keep Xojo on a steady path, prepared for whatever challenges lie ahead.

Conclusion

On behalf of the entire Xojo team, I can say that we love what we do and we appreciate your support in allowing us to do it. We are Xojo users ourselves (after all, we make Xojo with Xojo) and we enjoy seeing what you make with it. With that in mind, feel free to tell us about your creations. Send your screenshots, descriptions and your story to hello@xojo.com.

Passkeys Demo

In this demo, we will be creating a new account using just our email. Using a platform authenticator, like Apple Passkeys or Windows Hello will make this pretty easy. They are integrated in the operating system and synced across devices. I will be using macOS with the integrated Passwords app, but this is supported in Windows through Windows Hello, or you could store, sync and use Passkeys using a Google Chrome Profile.

As you can see, there is no intermediate step. No need to use a separate app to store your passwords securely. A Passkey will be generated and stored in the authenticator in one simple step. This Passkey will be automatically synced across devices and available on my iPhone.

Opening the Password application, I already can confirm my new Passkey has been stored for “localhost”. Notice the user name is also there, meaning you won’t need to fill it during the login process.

The username isn’t important or even required, it’s just to display a friendly name for this user. A Passkey will include the user ID, which can be any arbitrary String you want. In my example, I’ve used the new Random.UUID method, but this is completely up to you. And this is transparent for the end user.

Now, let’s try to login:

That’s it!

Another thing to notice is, while I have several Passkeys for different websites, only the relevant Passkey can be used. This makes Phishing attacks useless. End users won’t be able to use a Passkey anywhere else, just on the website where it has been created. And also, users won’t be able to send their password by mistake to an attacker because … they can’t!

For web application developers, another interesting thing to note is that you won’t be able to store a Passkey insecurely. Even if your database gets compromised, a hacker won’t be able to use the stored public keys to authenticate those users with another service. To make it easier to understand, you will be storing a lock, not the key used to open it.

Other User Journeys

My demo is just the classic email / password sign up / sign in workflow, but without using a password. Passkeys is based on WebAuthn (part of FIDO2) and there are several ways you can use this technology in your web application. For example, you could use a shared computer and still be able to securely log in using your mobile. The platform will display a QR code you can read with your phone camera, and grant the access from your personal device.

In my example application, the user can sign up using different emails. If the Passwords app encounters more than one for my domain it will allow the user to specify the Passkey to use:

Xojo will take care of preparing the WebAuthn steps, verifying signatures and doing the common busy work for you. You will have to decide which workflow makes sense for your application and perform any further verifications, like sending a verification email on register, to ensure this user owns that account.

Multi-Factor Authentication

If you already require your users to authenticate with a username (or email) and a password, you could use WebUserAuthentication as a second factor. That means the user will need to provide something this person knows (a username and password combination) in addition to something the user has (the authenticator device)

Other common multi-factor authentication schemes are email magic links and time-based one-time passwords, “TOTP”.

More factors equal better security, of course. But as usual when it comes to security, you’ll have to find the sweet spot between secure and comfortable.

Usernameless + Passwordless Authentication … Wait, What?!?

“How can I authenticate without providing my username or email?”. This is where real new possibilities arise. When you use a username with a password that only Chuck Norris and you know, this becomes a “proof of identity” (at least in theory, in practice a hacker could compromise an account using a weak password)

When using an authenticator without a username or password, it becomes a “proof of possession” of the authenticator device.

Again, think about it as a locker’s lock and a key. Everyone can see the lock, but only people with the correct key can open it. The public key would be the door’s lock, while the authenticator device would be the key. You can share the key with another person you trust to grant this person access to the contents behind that door. The difference with a real-life lock is that we will be using a really secure one, with a security key.

As long as you can proof you have a valid “key” to authenticate, you are granted to continue.

Consider the following scenario. The company could have a web application that uses a traditional username + password authentication but, for really special activities, the user needs to authenticate with a physical USB key authenticator device that is shared by everyone in the office.

Other use cases are obviously when privacy is involved. A private journal, or a private blogging service, voting. The inconvenience in this case is the user won’t be able to recover the account if they lose access to the authenticator. In this case, you might want to offer a different recovery solution, like printing a very long recovery code. If they also lose the recovery code, they will permanently lose the account.

How To Use The New Control

As you do with any other non-visual control, like a WebTimer, you can just drop the new WebUserAuthentication control into your WebPage.

Then configure its properties. The most important one is the Domain field. It must match the domain name where your application will be deployed. If you want to test it locally without using HTTPS, it must be “localhost” (“127.0.0.1” won’t work)

There are four events available:

You can use RegistrationSucceeded and AuthenticationSucceeded to interact with your Database, store the details and redirect the user to their dashboard.

In RegistrationSucceeded, a WebAuthenticationCredential will be given to you. This is a data transfer object with the following properties you need to store in your database:

• ID
• PublicKey
• AuthenticationAttempts
• DisplayName

Error will be fired when something goes wrong. A message will also show with the details about what happened, but it isn’t meant to be shared with the end user. During the sign up and sign in processes, you should display generic messages for security, to avoid letting bad actors know what’s going on. If you need to inform the user something related to these messages, you can send them an automated email instead.

CredentialRequested will be fired during the authentication ceremony. A userId and a credentialId will be given to you, and you should return a new WebAuthenticationCredential instance with the details coming from the RegistrationSucceededEvent.

Also, when AuthenticationSucceeded happens, the event will come with an authenticationAttempts parameter. This will be an incremental value used to update your credentials. This is part of the WebAuthn protocol sign in ceremony used to detect cloned authenticators, which is supported by Xojo. Please notice this value might come always as “0” when using Safari, for example, but Google Chrome will increase its value each time.

You can initiate a Registration or Authentication ceremony by calling Register or Authenticate, respectively.

• Register(userId As String, username As String = “”, displayName As String = “”)
  The parameter userId is required, the new credential will be built specifically for it. It can be anything that makes sense in your application, like an auto-incremental number or a random UUID . The other parameters are meant for giving the credential a friendly name. The username could be a nickname, or an email. In workflows where you allow the user to store more than one passkey, the displayName could be something like “Backup key”.
• Authenticate(Optional allowCredentials() As String)
  This will initiate the authentication ceremony. You can optionally pass an array of credential IDs, allowed for the user trying to get access to the protected resource.

Adoption and Compatibility

Not every user may know they even exist, what they are, how they work or if they will be more secure than using their pet’s name and birthdate. This can cause some friction. Other users that adopted the usage from day one might have at least two physical USB keys. They expect your application to allow them to enter more than one, just in case they lose their main USB key.

Passkeys are here to stay and their adoption will continue growing on web services. That said, depending on the combination of operating system and browser, there are some gotchas. Google Chrome or Firefox should work on every operating system. Apple users will probably obtain the best user experience if they’re tied to this ecosystem. Linux users using alternative browsers could experience some challenges.

If compatibility is a must for your application, you should still offer an alternative to Passkeys. For example, legacy passwords, or “magic login links” sent by email.

Wrapping Up

We are sure Passkeys will be the norm in the coming years. Read more in the Xojo Docs. Xojo is ready to embrace them and you can start adopting them in your Xojo Web application today!

Ricardo has always been curious about how things work. Growing up surrounded by computers he became interested in web technologies in the dial-up connections era. Xojo has been his secret weapon and language of preference since 2018. When he’s not online, chances are he will be scuba diving … or crocheting amigurumis. Find Ricardo on Twitter @piradoiv.

• Facebook
• X
• LinkedIn
• GitHub
• YouTube

At this point technical assistance, feature updates and security updates is no longer provided.

Released in July 2015, Windows 10 had a good run. It was well-received and served many millions of people well. When it was introduced, Microsoft said that Windows 10 would be the “last version of Windows“, but given where we are now that clearly did not end up being true.

If your development machine is still running Windows 10, you really need to get it upgraded to Windows 11. Unfortunately, many perfectly usable computers running Windows 10 do not meet the system requirements for Windows 11, which leaves a lot of people in the lurch. If you really have to stick with Windows 10 for a while longer, Microsoft will sell you an Extended Security Update for $30. This will extend support one more year, so out to late 2026.

What does this mean for Xojo? Nothing just yet. We still have Windows 10 as a supported OS, but don’t expect that to last much longer. Once an OS vendor drops support for an OS, we have to follow that guidance at some point. Expect Xojo to discontinue Windows 10 support at some point in 2026.

Paul learned to program in BASIC at age 13 and has programmed in more languages than he remembers, with Xojo being an obvious favorite. When not working on Xojo, you can find him talking about retrocomputing at Goto 10 and on Mastodon @lefebvre@hachyderm.io.

• Facebook
• X
• LinkedIn
• GitHub
• YouTube

Apparently, vibe coding is the latest and greatest thing in software development, or so I hear from the younger generation. It seems like it’s all about using AI tools to generate code based on natural language prompts. You tell the AI what you want to build, and it spits out the code. No more late nights wrestling with syntax errors, no more meticulously planning out every class and function. You just… vibe it into existence.

The Origin Story

The term gained traction thanks to Andrej Karpathy, a prominent figure in AI (OpenAI, Tesla). He described ‘vibe coding’ as fully embracing AI generation, iterating based on natural language, and potentially minimizing direct code interaction or even deep review. This idea – letting the ‘vibe’ of the requirement guide the AI, potentially bypassing meticulous human coding – is where the conversation gets really interesting, and perhaps, a little unsettling for seasoned developers.

How It Works (Supposedly)

From what I gather, the process involves describing your desired outcome in plain English (even voice commands are suggested), letting AI generate the code. You then refine through further prompts. The most discussed and debated aspect? The suggestion by proponents that deep, line-by-line understanding of the generated code might become less critical than iterating on the high-level ‘vibe’.

My (Slightly Jaded) Take

Look, progress is essential, and making development more accessible is a worthy goal. We see this with low-code/no-code platforms and the genuine utility of AI assistants. However, as someone who values robust, understandable, and maintainable code, principles that are core to Xojo’s design philosophy, the notion of accepting code without fully grasping its mechanics raises serious questions.

We’ve spent years learning that the devil is in the details: edge cases, security vulnerabilities, performance bottlenecks. Can a ‘vibe’ truly account for all that?

As one Reddit user aptly put it, ‘Coding is easy, testing and maintaining is hard.’ That deep understanding is crucial for the hard parts.

The Potential Upsides (Maybe)

Okay, I’ll admit, there might be some potential benefits to this “vibe coding” thing.

• Rapid Prototyping: It could be useful for quickly creating prototypes and experimenting with new ideas.
• Lower Barrier to Entry: It might allow non-developers to build simple applications and bring their ideas to life.
• Increased Productivity: It could free up developers to focus on higher-level tasks like architecture and problem-solving.

The Concerns (Definitely)

But here are the things that keep me up at night:

• Lack of Understanding: If you don’t understand the code, how can you possibly debug it or fix it when things go wrong?
• Hidden Risks (Security & Quality): Could relying heavily on AI without rigorous review introduce subtle bugs or security flaws that aren’t immediately apparent?
• The Maintainability Maze: What happens to long-term maintainability when the original ‘author’ (the AI) has no memory, and the human overseer lacks deep understanding of the implementation?
• Erosion of Craftsmanship?: Does over-reliance risk deskilling developers or devaluing the rigorous problem-solving at the heart of good engineering?

My Verdict

So, is ‘vibe coding’ poised to take over software development? For complex, critical applications, it seems unlikely in its purest form. The risks associated with a lack of deep understanding are simply too high. However, dismissing the power of AI in coding would be equally misguided.

These tools are becoming powerful assistants. The key isn’t choosing between ‘vibes’ and traditional coding; it’s about intelligent integration. Use AI to accelerate development, handle boilerplate, and explore ideas. But never relinquish the crucial step of understanding, testing, and refining the output.

Fundamentals matter. Clarity, solid architecture, and maintainability, the very things Xojo is built to facilitate, become more important, not less, in an AI-assisted world. We need to leverage these tools wisely, as co-pilots, not as autopilots flying blind.

But, what do you think? Am I simply being a traditionalist coder, or do you share some of my concerns regarding “vibe coding”? Let’s discuss it in the Xojo forums. Share your experiences and perspectives. Navigating this evolution is something we should do together as a community.

Gabriel is a digital marketing enthusiast who loves coding with Xojo to create cool software tools for any platform. He is always eager to learn and share new ideas!

• Facebook
• X
• LinkedIn
• GitHub
• YouTube

Introducing the Xojo IDE for Linux ARM64

With the release of Xojo 2025r1, however, everything has changed. Now, for the first time, developers can run the Xojo IDE directly on their Raspberry Pi 64-bit device. This means you can write, build, and test your applications all from within the same environment. The seamless integration allows for faster iteration and a smoother workflow, giving you more control over your development process. Not only can you now run the Xojo IDE on a Pi, but also on any Linux ARM64 distro.

What is Supported?

Nearly all the features you love about working in the Xojo IDE on other platforms are now available with the Linux ARM64 IDE, with the exception of building macOS and Mobile (Android/iOS) apps. Instead of remotely debugging your Raspberry Pi app using the Xojo IDE on Windows, you can now remotely debug your Windows app using the Xojo IDE on Pi!

For best results, we recommend a Raspberry Pi 5 or 500 with 8GB of RAM.

Xojo Loves Pi!

With the Xojo IDE now available for Linux ARM64, we’re making our case as the go-to solution for Raspberry Pi developers. The simplicity, cross-platform support, and power makes Xojo an attractive choice for those looking to build apps on the Pi, without the complexity of traditional programming environments.

NOTE: You can build Linux apps with Xojo for free, no license required. Just select Linux in Build Settings, then choose ARM or x86 architecture in the Inspector.

William Yu grew up in Canada learning to program BASIC on a Vic-20. He is Xojo’s resident Windows and Linux engineer, among his many other skills. Some may say he has joined the dark side here in the USA, but he will always be a Canadian at heart.

• Facebook
• X
• LinkedIn
• GitHub
• YouTube

Like 4D, Xojo has a drag and drop user interface builder, a Code Editor, a Debugger and a Compiler as well as a cross-platform framework. While 4D now has an object-oriented language as an option, Xojo has always been object-oriented. The language is a dot syntax not unlike Javascript. You do not have to become an experienced object-oriented programmer to use Xojo. One of its strengths is that you can learn incrementally.

Xojo supports database application development but there are differences between how it and 4D handles that. 4D has its own database engine and query syntax. Xojo supports SQLite, PostgreSQL, MySQL and ODBC for accessing databases. Unsurprisingly it uses SQL as its query syntax. Because 4D is solely designed for database application development, it ties the user interface you create to tables in the database. Xojo does not. 4D’s model prevents you from having to write code to get data from database records in and out of your user interface. While by default Xojo does not provide this, it provides an add-on called DBKit which assists you in connecting to and interacting with databases.

Xojo supports desktop development for Linux, macOS, Windows and Raspberry Pi (Linux on ARM). It supports web development as well and mobile development for iOS and Android. You can also build console apps which can be handy when you need an app with no user interface to run on a server. Xojo uses native controls and compiles to native machine code for x86 and ARM. Whether you come to Xojo to build desktop, web or mobile apps, you’ll find that 95% of what you learn and the code you write will be applicable to all targets. With the exception of iOS (which because of Apple’s requirements must be built from a Mac) you can build your apps from any platform to any platform. Xojo also includes a Remote Debugger which allows you to build from one operating system and run on another. For example, you might do your development on macOS but want to debug on Windows to track down a Windows-specific issue. With the Remote Debugger, this is quite easy.

Xojo is free to use for development. You only purchase a license when you need to deploy. This is a developer license, not a deployment license. That means that you can deploy as many applications as you like to as many users as you like, without any additional cost. Each developer purchases their own license. A Xojo license comes with 12 months of updates. The new Xojo releases available during your license period continue to be available to you even after your license expires. Renewing your license gets you another 12 months of updates. If you only need to deploy cross-platform desktop applications, the Xojo Desktop license is $399USD. Yearly updates are also $399USD. If you wish to build for any platform we support, the Pro license is $799USD. Yearly updates are also $799USD. Compare licenses and find more pricing details at our webstore.

If you’d like to give Xojo a spin, I recommend starting with the QuickStart and then the full tutorial. After that, check out DBKit, the video and its tutorial which will make it easier to build database-oriented applications. These are the desktop tutorials but there are also tutorials for mobile and web application development. Because Xojo is a general, cross-platform development tool rather than one specifically for database applications, what you build with it is truly limited only by your imagination. If you have any further questions, please reach out to us. Our user forum is also filled with experienced and enthusiastic Xojo users that answer and have answered hundreds of questions. And the Xojo Blog has many posts on database development with Xojo.

Geoff Perlman is the Founder and CEO of Xojo. When he’s not leading the Xojo team he can be found playing drums in Austin, Texas and spending time with his family.

• Facebook
• X
• LinkedIn
• GitHub
• YouTube

On November 12th Thomas Kurtz, the co-inventor (along with John Kemeny who passed in 1992) of the BASIC programming language died at the age of 96. It would be difficult to overstate the impact he had on computing. BASIC made it possible for so many people (myself included) to begin their journey into programming.

In the late 1970s I became interested in learning to code. My father, who was an electrical engineer and coded in Fortran at work, brought home a book that taught the basics of programming. Written and published by Apple, it appeared to only cover 6502 Assembler, the chip that was in the Apple II. Just a few pages in my eyes began to glaze over and I started to wonder if programming was really for me. Fortunately, I flipped the book over to find it was actually two books in one. From the other side it was a book about AppleSoft BASIC. As I looked at the language, it made immediate sense to me. Assembler was too low level and not a great first language but BASIC was ideal for this purpose. I learned enough to get going and my life was forever changed.

Programming has evolved a lot since then but we still design Xojo with the same principle that Thomas and John espoused with their original version of BASIC: that programming should be accessible to anyone with an interest. We have many users whose first experience with programming was with Xojo just as mine was with BASIC. In our own way, Xojo is continuing what Thomas and John began. Today more people have the ability to learn programming than ever before. Thomas and John both were true pioneers that contributed significantly to making that happen.

Geoff Perlman is the Founder and CEO of Xojo. When he’s not leading the Xojo team he can be found playing drums in Austin, Texas and spending time with his family.

• Facebook
• X
• LinkedIn
• GitHub
• YouTube

My answer was, of course, “Let me have a look and get back to you.”

I went to my favourite dev tool, Xojo, and went through the process of developing a solution. The connection is a REST API, so I’ll start with a web project and use the HandleURL event. And I’ll use a URLConnection to pass on the request.  Wait … could it be that simple?

Function HandleURL(request As WebRequest, response As WebResponse) Handles HandleURL as Boolean

  // Create the outbound connection
  Var connector As New URLConnection
 
  // Copy the content of the request
  connector.SetRequestContent(request.Body, request.MIMEType)

  // Send the request
  Var result As String
  Try
    result = connector.SendSync("POST", kAddress + request.Path)
  Catch err As RuntimeException
    // Catch DNS, Certificate & Timeout errors
    response.Status = 500
    response.Write(err.Message)
    Return True
  End

  // Return the result of the request
  response.Status = connector.HTTPStatusCode
  response.Write(result)

  Return True

End Function

The answer is, “Yes!”  This is all the code in the entire project.

You will notice that there is no security, but in this instance that is fine as the virtual machine is running this is on the same network as the client server and the firewall is configured to only allow connections from that server.

After processing over 60 thousand requests, memory use is 7.3MB and never exceeded 13MB. CPU usage was at the maximum 1.5%.

Even after using Xojo for 20 years this still blows my mind.

Wayne Golding has been a Xojo developer since 2005 and is a Xojo MVP. He operates the IT Company Axis Direct Ltd which primarily develops applications using Xojo that integrate with Xero www.xero.com. Wayne’s hobby is robotics where he uses Xojo to build applications for his Raspberry Pi, often implementing IoT for remote control.

• Facebook
• X
• LinkedIn
• GitHub
• YouTube

This article examines Xojo’s capabilities by building a simple web API service. You will learn to handle different HTTP methods, manage requests, and send meaningful responses. Xojo’s simplicity makes it an excellent choice for experienced developers transitioning from other languages, as well as those familiar with its user-friendly language.

Foundation: The HandleURL Function

Defining API Endpoints for GET Requests

GET requests are primarily used to retrieve data. To handle these requests effectively, let’s see how to define API endpoints that correspond to specific data or actions in the following code example:

If request.Method = "GET" Then
  Select Case request.Path
  Case "time"
    Var currentTime As String = DateTime.Now.ToString("yyyy-MM-dd HH:mm:ss")
    response.Write("{""message"": """ + currentTime + """}")
    response.Status = 200
    Return True
  Case "hello"
    response.Write("{""message"": ""Hello, World!""}")
    response.Status = 200
    Return True
  End Select
End If

Here, we define two endpoints: /time and /hello.

A GET request to /time will return the current date and time in JSON format, while a request to /hello will return a friendly “Hello, World!” greeting.

The response.Status is set to 200, indicating a successful response. Learn more here about HTTP status codes.

Defining API Endpoints for POST Requests

While GET requests primarily retrieve data, POST requests submit data to the API for processing. Consider submitting a form online – you are sending data to the server via a POST request.

If request.Method = "POST" Then
  Select Case request.Path
  Case "some-data"
    Try
      Var jReceivedData As New JSONItem(request.Body)
      Response.Write(jReceivedData.ToString)
      Response.Status = 200
      Return True
    Catch e As JSONException
      response.Write("{""error"": ""Internal Server Error""}")
      response.Status = 500
      Return True
    End Try
  End Select
End If

In this example, a POST request to the /some-data endpoint expects to receive JSON data (request.Body) for processing.

If the data is successfully parsed, the API responds with the received data.

Otherwise, an error status and message are returned to the client.

Bringing it all Together

Now that you know how to manage “GET” and “POST” requests, you can start building more complex APIs, with different endpoints available for different methods. To further illustrate API endpoint development, consider the following detailed code example that can be used as template:

Function HandleURL(request As WebRequest, response As WebResponse) Handles HandleURL as Boolean
  response.MIMEType = "application/json"
  
  Try
    Select Case request.Method
    Case "GET"
      
      Select Case request.Path
      Case "time"
        Var currentTime As String = DateTime.Now.ToString("yyyy-MM-dd HH:mm:ss")
        response.Write("{""message"": """ + currentTime + """}")
        response.Status = 200
        Return True
      Case "hello"
        response.Write("{""message"": ""Hello, World!""}")
        response.Status = 200
        Return True
      Else
        response.Write("{""error"": ""Not Found""}")
        response.Status = 404
        Return True
      End Select
      
    Case "POST"
      
      Select Case request.Path
      Case "some-data"
        Try
          Var jReceivedData As New JSONItem(request.Body)
          Response.Write(jReceivedData.ToString)
          Response.Status = 200
          Return True
        Catch e As JSONException
          response.Write("{""error"": ""Internal Server Error""}")
          response.Status = 500
          Return True
        End Try
      Else
        response.Write("{""error"": ""Not Found""}")
        response.Status = 404
        Return True
      End Select
      
    End Select
    
  Catch e As RuntimeException
    response.Write("{""error"": ""Internal Server Error""}")
    response.Status = 500
    Return True
  End Try
  
  response.Write("{""error"": ""Not Found""}")
  response.Status = 404
  Return True
  
End Function

Small note: observe the start line within the HandleURL function.

response.MIMEType = "application/json"

This line of code informs the client (browser, application) that the API service is responding using the JSON format. Setting the MIMEType to “application/json” is best practice and helps prevent any potential parsing errors on the client side.

Next Steps

You might notice that some code is repeating itself (hint: the error responses), so a good idea would be to create a helper method that deals with this particular type of code repetition. Additionally, consider moving the code from the HandleURL function to a separate method that is then invoked within the HandleURL function for improved organization. This restructuring will enhance code organization, making it easier to maintain, read, and improve the efficiency of the program.

P.S.: You should also check the article about microservices and their purpose to get a better idea of what kind of API interfaces you can create.

Gabriel is a digital marketing enthusiast who loves coding with Xojo to create cool software tools for any platform. He is always eager to learn and share new ideas!

• Facebook
• X
• LinkedIn
• GitHub
• YouTube

Threading Models

Cooperative Threads: This is the threading model that Xojo has traditionally supported and continues to offer. In this model, threads must voluntarily yield control at specific points that we define. This ensures that most operations in Xojo code are thread-safe, as we manage access to MemoryBlocks, Arrays, etc. However, this approach can lead to inefficiencies if a thread fails to yield, potentially blocking UI, and because only one thread runs at a time, it doesn’t fully utilize multiple cores or truly run in parallel.

Preemptive Threads: Introduced in Xojo 2024r3, this new thread type allows threads to be interrupted at any point, enhancing responsiveness and fully utilizing multiple cores. While this model provides significant performance improvements, it also introduces new challenges. Because threads can be interrupted at any time, you’ll need to be more diligent about locking resources, such as MemoryBlocks and Arrays, to avoid potential race conditions.

Using Preemptive Threads

We’ve added a new Thread.Type property that allows you to switch your threads to the new preemptive thread model, here’s how you can start one up:

Thread1.Type = Threads.Types.Preemptive
Thread1.Start

You can set this property either before starting your thread or while the thread is running. However, if changing it while the thread is active, it must be done safely from within the running thread itself, and not externally.

Event Window1.Opening
  // Start the thread and setup the type in the Run event instead
  Thread1.Start
End Event

Sub Thread1.Run
  Me.Type = Threads.Types.Preemptive
  // Run a very long process preemptively.
  newMemBlock = memBlock.Compress
  
  Me.Type = Threads.Types.Cooperative
  // Switching to cooperative mode and modifying a shared array safely.
  mySharedArray.Add("New item")
End Sub

Concurrency and Synchronization

As mentioned earlier, cooperative threads avoid many of the issues that arise with preemptive threads, since we control when thread switching occurs. With preemptive threads, however, you can no longer safely modify things, like shared arrays, the same way you could before with cooperative threads. To manage this, you’ll need to use tools like CriticalSections and Semaphores more frequently to protect your shared resources.

The challenge lies in efficiently supporting both threading models while enabling the main thread to synchronize with either type. To address this, we’ve added a new Type property to CriticalSection and Semaphores, which must match the thread type you’re using to protect shared resources.

// Imagine the main thread and two additional threads all trying to access a Dictionary simultaneously.
Sub RunTest
  Thread1.Type = Thread.Types.Preemptive
  Thread2.Type = Thread.Types.Preemptive

  CSLock = New CriticalSection
  // Since we are using this CriticalSection in preemptive threads,
  // the synchronization type must be compatible.
  CSLock.Type = Thread1.Type

  Thread1.Start
  Thread2.Start

  Do
    CSLock.Enter
    MyDictionary.RemoveAll
    CSLock.Leave
  Loop
End Sub

Sub Thread1.Run
  Do
    CSLock.Enter
    MyDictionary.Value("Random1") = Rnd
    CSLock.Leave
  Loop
End Sub

Sub Thread2.Run
  Do
    CSLock.Enter
    MyDictionary.Value("Random2") = Rnd
    CSLock.Leave
  Loop
End Sub

What things are thread-safe?

We’ve updated our framework to safeguard areas that were previously not preemptive thread-safe. For the most part, our entire framework is now safe for concurrent use with preemptive threads, with a few exceptions like XojoScript and Runtime.IterateObjects. When sharing resources such as MemoryBlocks, Dictionaries, or Arrays among threads, you may need to use CriticalSections or Semaphores to ensure safe access. However, if you’re only reading from these resources without modifying them, synchronization is not required. You’ll be happy to know that calling Thread.AddUserInterfaceUpdate from a preemptive thread is also safe.

Performance Considerations

With the ability to switch your threads to preemptive, there are some performance factors to consider. While running 100 threads at once might seem appealing, it often leads to over-utilizing your system’s resources. For optimal efficiency, it’s best to limit the number of threads to match the number of available cores. To assist with this, we’ve introduced the new System.CoreCount, which helps you determine the number of cores on your system.

While Xojo’s framework doesn’t shield you from every potential issue, we do handle synchronization for key operations like object creation and destruction. However, you may notice these actions are slower in preemptive threads due to the extra synchronization required.

Usage and Examples

There’s no question that preemptive threads offer significant advantages, and when used correctly, they can greatly enhance your app’s performance. Check out our threading example projects included with the 2024r3 release to see preemptive threads in action and enjoy weaving these new threads into your future apps!

A special thanks to our MVPs for their invaluable help in refining and testing this new feature! Be sure to check out the new ThreadPool example for some practical, real-world use cases and read MVP Kem Tekinay’s blog post Preemptive Threads Are Here and They Are …. Pretty Good.

Need More Information? Read more about preemptive threads in the Xojo Documentation and Blog. Or read about Semaphore and CriticalSection.

William Yu grew up in Canada learning to program BASIC on a Vic-20. He is Xojo’s resident Windows and Linux engineer, among his many other skills. Some may say he has joined the dark side here in the USA, but he will always be a Canadian at heart.

• Facebook
• X
• LinkedIn
• GitHub
• YouTube

Microservices offer a alternative to traditional monolithic architectures where all application components are tightly coupled. Instead of one large, monolithic codebase, microservices consist of multiple independent services, each responsible for a specific functionality.

Understanding Microservices and Their Operation

Microservices are like building blocks for your applications. Each block is independent and performs a specific task, but they work together to create a complete and functional system.

Consider a food ordering website built with microservices. You might have:

• User Authentication: Manages user logins and registration, offering flexibility for future user management features.
• Product Catalog: Manages restaurant menus and items, enabling quick updates and personalized recommendations.
• Order Management: Processes orders and tracks their status, providing real-time order updates to users.
• Payment Processing: Handles payment transactions securely, ensuring seamless and reliable payments.
• Delivery Management: Connects with delivery services and tracks deliveries, offering real-time delivery updates and convenient tracking.

Benefits of Microservices

Microservices offer several advantages for building modern applications:

• Improved Scalability: Microservices enable you to scale individual services based on demand, allocating resources more efficiently. For instance, during a holiday sale, you can scale the order processing service independently to handle peak demand.
• Enhanced Flexibility: Each microservice is independent and can be developed, deployed, and updated independently. This makes it easier to adapt to changing requirements and introduce new features quickly.
• Increased Resilience: If one microservice fails, it will not affect the other services. This ensures that your application stays available even if there are issues with a specific component.
• Simplified Development: Smaller, focused services are easier to understand, develop, and assess. This makes it easier for teams to work independently and contribute to various parts of the application.
• Improved Deployment: Microservices can be deployed independently, which speeds up the deployment process and allows for continuous integration and delivery.
• Easier to Manage: Microservices are easier to manage than monolithic applications, as they are smaller and more focused. This makes it easier to find and resolve issues.

Challenges of Implementing Microservices

While microservices offer many benefits, implementing them comes with its own set of challenges:

• Greater Complexity: Compared to managing a monolithic application, maintaining a distributed system with several independent services can be more difficult. You will need to address issues like service discovery, communication, and data consistency.
• Distributed Debugging: Debugging issues in a microservices architecture can be more challenging, as you need to track down problems across multiple services.
• Data Consistency: Maintaining data consistency across multiple services can be difficult, especially when services update data independently.
• Testing and Deployment: Testing and deploying multiple services can be more complex than testing and deploying a single monolithic application.
• Security: Securing a microservices architecture requires careful planning, as you need to secure communication between services and protect data across multiple points.
• Team Coordination: Collaborating with multiple teams responsible for different services can require increased coordination and communication.

When to Use Microservices

Microservices are not a one-size-fits-all solution. They are best suited for certain scenarios and are not be the ideal choice for others. Here are some factors to consider when deciding whether to use microservices:

• Complex Applications: If you are building a large and complex application with many interconnected components, microservices can help you manage complexity and improve scalability.
• Rapid Development and Deployment: Microservices allow for faster development and deployment cycles, as teams can work independently on different services.
• Continuous Integration and Delivery (CI/CD): Microservices are well-suited for CI/CD workflows, as they can be independently deployed and tested.
• Scalability and Flexibility: If your application needs to scale rapidly to handle peak loads or adapt to changing requirements, microservices can provide the necessary flexibility.

However, if your application is simple and you do not need the benefits of a distributed architecture, a monolithic approach might be more suitable. The decision of whether to use microservices depends on the specific needs of your project.

Best Practices for Building and Managing Microservices

• Define Clear Service Boundaries: Carefully define the boundaries of each service, ensuring that each service has a specific purpose and a well-defined API.
• Use a Consistent Design Pattern: Adopt a consistent design pattern for your microservices, such as RESTful APIs or message queues, to simplify communication and integration.
• Use Service Discovery: Use service discovery to simplify how services find and connect with each other, reducing the complexity of managing service dependencies and network configurations – Xojo provides built-in features that makes service discovery easy.
• Manage Communication Patterns: Choose the right communication patterns, such as synchronous or asynchronous, based on the needs of your services.
• Ensure Data Consistency: Design your services to support data consistency, especially when multiple services share data (check how to use Semaphores or CriticalSection in Xojo).
• Implement Robust Error Handling: Build in robust error handling mechanisms to ensure that services can recover from failures and handle exceptions gracefully – check this article for ways to write clean and maintainable code in Xojo.
• Automate Deployment and Monitoring: Automate the deployment process and implement comprehensive monitoring to ensure that your microservices are running smoothly – here are some articles on how to automate the deploying process of Xojo built application for different project types.
• Use DevOps Practices: Embrace DevOps practices to streamline development, testing, and deployment of your microservices.

Microservices offer a powerful approach to building complex and scalable applications. However, implementing microservices requires careful consideration of the challenges involved. This is where Xojo shines, making the process easy and simple. With its cross-platform app development capabilities, supporting desktop, web, and mobile platforms, and its intuitive visual environment, Xojo empowers developers of all skill levels to create scalable and reliable applications based on microservices architecture.

Gabriel is a digital marketing enthusiast who loves coding with Xojo to create cool software tools for any platform. He is always eager to learn and share new ideas!

• Facebook
• X
• LinkedIn
• GitHub
• YouTube

Want to learn about using microservices with Xojo? Xojo Engineer Ricardo Cruz discuss the reasons for considering microservices, their benefits, challenges and best practices in this XDC 2023 video.

In fact, Apple recommends to Notarize the software even if you are going to distribute it from your own website, outside of the Mac App Store. But, don’t be scared! Currently there are good third parties options available that ease the path, like App Wrapper from Ohanaware, or some OpenSource options as for example Xojo2DMG; and through this article you will see how to enable Sandboxing, runtime hardening and even Notarizing on a simple example app. Of course, this will touch only the basics and it is up to you to read the related Apple Documentation to add the entries, both the Entitlements and additional keys/values in the app Info.plist file, required by the purposes of your particular app, for example file access, camera or mic access, network access, etc.

A Bit of Common Ground

At this point, your head may be spinning if you are unfamiliar with these app security terms; so, what do Sandbox, hardened runtime and Notarizing mean when they are applied to macOS apps?

Sandboxing

When a macOS app is sandboxed, that means that macOS will create an exclusive container for everything related to the app the first time it is launched. This is what happens when installing an iOS app, too! Such a container will have its own structure to access things like documents, pictures, downloads, etc. Think about it as the own private execution space for the app:

Of course, there are entitlements waiting for you so your sandboxed app can access the files created by other apps (including the Desktop, Downloads, Movies, Music and Picture folders), among other things.

Hardened Runtime

When enabled for your macOS app, hardened runtime adds an extra layer of protection to the running code itself. For example, it prevents certain classes of exploits, like code injection, dynamically linked library (DLL) hijacking, and process memory space tampering. This kind of protection is also enhanced by the System Integrity Protection (SIP).

Notarization

In brief, this is a third layer of confidence for the potential users of your macOS app. When the app is notarized, that ensures to the user that the Developer ID-signed software you distribute has been checked by Apple for malicious components. This is not related with the Apple Review process of your app when it is submitted to the Mac App Store, it’s related to the macOS Gatekeeper technology. So, when a Notarized app is downloaded from Internet, for example, Gatekeeper will use the notarization ticket attached to your app/DMG file to provide more meaningful information about the origin of the app, including if it is safe for the user to open it.

Preparation

In order to follow this article, you will need:

• Xojo. Download it for macOS if you have not done yet.
• macOS 11.3 or later.
• Xcode 13 or later. Run it at least one time and make sure that all its required components and SDKs are installed.
• Apple Developer ID. This needs to be a paid Apple Developer membership. Also, make sure you have your Developer certificates installed in the Mac.
• A working Internet connection.

With all of this in place, open Xojo to create a macOS Desktop project and do some basic layout in the by default window. It is not required to add any functionality to keep the focus in the task at hand. Then, use Build Settings > macOS > Mac App Name to give an appropriate name to the built application (for this example I named it “SandboxedApp”).

Lastly, save the project (for example into the Documents folder) and click the Build button to build the app! It is not required at this point to assign the Developer ID in the Build Settings > macOS > Sign section, because we are going to sign it (again) in the next steps.

Creating the Entitlements File

The entitlements file is pretty similar to the Info.plist file you probably already know that is in charge of storing the required keys and values for the app to properly work. Both of these are in XML format, and the only difference is that while the Info.plist file is created for you by Xojo, the Entitlements file needs to be, currently, manually created for you.

So, open your text editor of choice (there a lot of there out there, both free and paid ones; personally I tend to use BBEdit from BareBones Software). Add the following lines to the text document and save it with the name “Entitlements.plist” (if you keep it next to the saved built macOS app, the better). This is the file where you will probably want to add more entitlement entries as your app requires them:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist SYSTEM "file://localhost/System/Library/DTDs/PropertyList.dtd">
<plist version="0.9">
<dict>
  <key>com.apple.security.app-sandbox</key>
  <true/>
</dict>
</plist>

Sandbox Your App

With the compiled app and the entitlements file in place, open the Terminal app and type the following command and press the return key:

> codesign --force --deep --timestamp --entitlements <path-to-your-entitlements.plist-file> -s "Developer ID Application: <your-full-developer-name (including-the-team-id)>" <path-to-the-bundle-of-your-app>

Once executed, run the “SandboxedApp”, open the Activity Monitor app and make sure that the Sandbox option is enabled under the View > Columns options. Then, use the search box of the main window to filter the displayed processes so it only displays your app. Take a look to the value under the Sandbox column and you will see that the app is now Sandboxed, and the Container for it has been created under the Library/Containers path. Quit the app when you are done.

Hardened Runtime

With our app already sandboxed, let’s look how to add the hardened option to it. Once again, type the following command in the Terminal prompt:

> codesign --force --deep --options runtime --timestamp --entitlements <path-to-your-entitlements.plist-file> -s "Developer ID Application: <your-full-developer-name (including-the-team-id)>" <path-to-the-bundle-of-your-app>

As you can see, it doesn’t vary much from the previous command. All it adds is the “–options runtime” text in charge of enabling the runtime hardening. Also, as you might guess, using this command will enable the Sandboxing of the app and also the runtime hardening, at all once.

Do you want to check if it worked? Well, type the following command at the Terminal prompt:

> codesign --display --verbose <path-to-the-bundle-of-your-app>

It will produce an output similar to this one:

Executable=<path-to-the-executable>
Identifier=com.xojo.sandboxedapp
Format=app bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=43297 flags=0x10000(runtime) hashes=1342+7 location=embedded
Signature size=9100
Timestamp=13 Aug 2024 at 12:51:28 PM
Info.plist entries=15
TeamIdentifier=************
Runtime Version=11.1.0
Sealed Resources version=2 rules=13 files=4
Internal requirements count=1 size=184

It is the “flags=0x1000(runtime)” which shows that, in fact, the app runtime is hardened. Congrats!

Notarizing the App

This is the final step, but is going to require an extra step from your side. Because the notarytool command line tool, used for notarizing the app, is going to require the ID and password from your Apple ID account, plus the fact that it uses 2FA authentication, it is very convenient to create an app specific password for it.

Creating an App-Specific Password

In order to create the password used by the notarytool process, follow this steps:

1. Sign in to appleid.apple.com
2. In the Sign-in and Security section, select the App-Specific Passwords option:

3. The previous action will bring a new dialog displaying all the app-specific passwords already created. Click the “+” button to add a new one:

4. Type a meaningful name for as the “Title” or description for your new password in the presented dialog (notarytool could be a good one):

5. Once you click the Create button it is possible that you will be asked to authenticate again using your Apple ID. Once done, a new dialog will present the generated password to you. Copy it and write it down (or paste it) into a safe place, because we are going to need it in the next step.

Adding the notarytool specific password to the Keychain

Because this app-specific password is going to be used by the notarytool command line tool, it would be very convenient to have it stored in the macOS Keychain. To do so, type the following command at the Terminal prompt, and press the Return key:

> xcrun notarytool store-credentials "notarytool-password" --apple-id "<your-apple-ID>" --team-id <your-developer-team-id> --password <the-password-copied-from-the-previous-step>

Once executed, you will be able to see the password added to the Keychain app under the name of “notarytool-password”:

Creating a Zip file for your app

The notarization process is handled by the Apple notary service running in the Internet, what means that notarytool needs to send (upload) the bundle of your app in an appropriate format. There are two options: as a DMG file (that needs to be signed before submitting), or as a zipped file, what is even faster and easier (Trivia: Did you know how easy it is to create Zip files in Xojo code?)

So, in order to upload our app for notarization, we need to create a Zip file first. Once again, it is time to type a new command at the Terminal prompt:

> /usr/bin/ditto -c -k --keepParent <path-to-app-bundle> <path-to-generated-zip-file/file-name.zip>

Uploading the app for Notarization

With our Zip file in place, we now have all the pieces to send it to the notarization process. The time spent by that process may (and will) vary depending of several factors.

In order to send the file, type the following command at the Terminal prompt:

> xcrun notarytool submit <path-to-zip-file/file-name.zip> --keychain-profile "notarytool-password" --wait 

After pressing the Return key, the process will start and the Terminal will output information about the progress; something similar to this:

Conducting pre-submission checks for <name-of-your-zip-file> and initiating connection to the Apple notary service...
Submission ID received
  id: <some-id-number-goes-here>
Upload progress: 100.00% (8.65 MB of 8.65 MB)   
Successfully uploaded file
  id: <some-id-number-goes-here>
  path: <path-of-the-zip-file>
Waiting for processing to complete.
Current status: Accepted........
Processing complete
  id: <keep-this-id-in-a-safe-place-you-will-need-it-later>
  status: Accepted

Have you seen the last line? The “status: Accepted” means that everything worked OK, and the notarization process has been successful, but it’s better if we check! Type the following command at the Terminal prompt. This one will ask the notarytool command to download the log file in JSON format to be saved at the desired path. It is a good habit to do it, because such a log file will include some eventual error and explanation about possible errors during the notarization process, including those related to the app itself:

> xcrun notarytool log <put-here-the-value-you-saved-in-a-secure-place-from-the-id-field-in-the-previous-output> --keychain-profile "notarytool-password" <path-to-save-the-log.json>

Staple the Ticket!

Assuming that everything worked OK, it is time to staple the notarization ticket to the app itself. It is not required, but is convenient to avoid online checks when the user runs the app, or Gatekeeper inspects it.

Yeah, that means using a new command from Terminal on the already signed, sandboxed and runtime hardened app bundle (not the Zip file you created for submitting using notarytool):

> xcrun stapler staple "<path-to-the-signed-sandboxed-and-hardened-app-bundle>"

After that, you can check that everything went OK using the following command:

> spctl -a -vvv -t install <path-to-the-signed-sandboxed-and-hardened-app-bundle>

And you should get something similar to this as the output:

source=Notarized Developer ID
origin=<your-full-developer-ID-Application>

App Distribution

That’s fine, but you will probably want to distribute your app from the Internet using a DMG container. In that case, follow these steps:

1. Create a DMG container (file).
2. Copy your already notarized app bundle into it.
3. Notarize the DMG file.
4. Staple the ticket to the DMG file.

That way the DMG container will be Notarized along with the app bundle inside it.

In Summary

As we did see, all the process of sandboxing, runtime hardening and Notarization involves a bunch of commands from the terminal, including the creation of the Zip file. But the good news is that all the process could be automated using Xojo itself! (take a look to the Shell class and the Zip method from the FolderItem class if you are not familiar with them).

As I said before, this article only on touches the basics and doesn’t dig into Provisioning Profile creation (associated with Capabilities required by the app), the Entitlements your app may need to properly work, among other topics; so you may find these Apple Developer Documentation of interest:

– Provisioning profiles.
– macOS Entitlements.
– macOS Sandbox.
– macOS Hardened Runtime.
– macOS Notarization.

Happy Xojo Coding!

Javier Menendez is an engineer at Xojo and has been using Xojo since 1998. He lives in Castellón, Spain and hosts regular Xojo hangouts en español. Ask Javier questions on Twitter at @XojoES or on the Xojo Forum.

• Facebook
• X
• LinkedIn
• GitHub
• YouTube

More in this series on distributing Mac apps:

• Sandboxing, Hardened Runtime and Notarization arrives to the Xojo IDE
• macOS Apps: From Sandboxing to Notarization, The Basics
• Uploading macOS Builds to App Store Connect
• Provisioning Profiles for macOS Apps

Some of you might not have noticed because, until recently, most people didn’t think much about Windows ARM. After all, nearly everyone still runs Windows on x86-64 CPUs. But lately, Windows on ARM is starting to get more traction, both in the press and in the market.

Back in May, Qualcomm announced the Snapdragon Dev Kit for Windows. This is supposed to be a $900 mini PC (about the size of a Mac mini) for developing Windows ARM apps for the Snapdragon X Elite SoC (system on a chip). I say “supposed to be” because although the press release says it was intended to go on sale on June 18, I can only find pre-order pages for it, so it seems to not be available just yet or out-of-stock.

There have been other ARM PCs for Windows in the past, but their performance has always been less than desirable. The new Snapdragon X Elite is supposed to be roughly equivalent to Apple M3 SoCs.

You don’t have to wait for Qualcomm as Copilot+ PCs and laptops with Snapdragon SoCs are starting to appear elsewhere. Lenovo has the ThinkPad T14s Gen 6, which at about $1700 is not exactly a bargain, but is in the ballpark of many Mac laptops. The Yoga Slim 7x is even cheaper starting at just $1200.

But I’m not here to sell Lenovo products. I’m just pointing out that Windows on ARM is becoming a reality, if slowly. That might be starting to change given Intel’s recent troubles with its Raptor Lake CPUs and most recent earnings report, however. Take it with a grain of salt, but Qualcomm is predicting that Windows ARM could reach 50% of Windows PC market within five years.

That sounds astonishing, but change often happens slowly then all at once.

Building for Windows ARM with Xojo

The good news is that with Xojo you are already prepared for this. To build your existing Xojo desktop project for Windows ARM, you just need to change one property in the Windows Build Settings and click Build. There is no step 3.

Xojo can also build Windows apps for x86-64 and x86-32, which pretty much covers all your bases. Not to mention that it can build macOS apps, Linux apps, web apps, iOS apps and Android apps.

And if you already have an Apple Silicon Mac then you don’t even need to purchase a Windows ARM computer. You can run Windows ARM as a virtual machine on a Mac using Parallels or VMware Fusion. You’ll still need to get your own license for Windows 11, however.

Although you can make your own Windows ARM apps with Xojo today, there are a couple temporary limitations to keep in mind. The first one is that XojoScript is not yet available. The other is that Xojo itself is not yet a native Windows ARM app. Both of these are because the Xojo compiler itself is not yet native on Windows ARM. That will change, but for now Xojo itself runs perfectly fine using the Prism x86-64 emulation layer in Windows. In addition you can use the Remote Debugger to test your apps on Windows ARM from another computer.

Will Windows ARM replace Intel like it did for Macs? It seems hard to believe, but the wind seems to be blowing in that direction. To make sure you’re prepared, download Xojo for free today and start creating your own ARM apps!

Paul learned to program in BASIC at age 13 and has programmed in more languages than he remembers, with Xojo being an obvious favorite. When not working on Xojo, you can find him talking about retrocomputing at Goto 10 and on Mastodon @lefebvre@hachyderm.io.

Presented with choosing what development tool is best for your main, full-stack development needs, let’s discuss the benefits of Xojo development platform for your next web project. With its simplicity, flexibility, and powerful features, Xojo will help you create high-quality web applications quickly and efficiently, with the added bonus of covering backend and frontend development in the same IDE—no more language switching—while also lowering your overall costs.

Overview of Full-Stack Development

Full-stack development covers the entire spectrum of technologies and skills required to create a fully functional web application. This approach involves both the frontend, which users interact with directly, and the backend, which powers the application.

At its core, full-stack development refers to the ability to work on both the client-side and server-side of an application. This means that full-stack developers should be proficient in frontend technologies such as HTML, CSS, JavaScript, as well as backend technologies like Node.js, Python, and frameworks such as React and Django. Full-stack developers possess a broad skill set that includes designing user interfaces, managing databases, and server logic, enabling them to oversee the entire development process.

Usually, a full-stack developer handles:

• Frontend Technologies: These consist of HTML for structure, CSS for styling, and JavaScript for interactivity, crucial for crafting engaging user interfaces. Frameworks such as React, Angular, and Vue.js are also typical choices for building dynamic web applications.
• Backend Technologies: This segment covers server-side programming languages like Node.js, Python, Ruby, and PHP, coupled with frameworks such as Express, Django, and Ruby on Rails, essential for robust backend development. Databases, both relational (e.g., MySQL, PostgreSQL) and NoSQL (e.g., MongoDB), are also crucial for data management.
• APIs (Application Programming Interfaces): APIs enable simple communication between frontend clients and backend applications/servers, facilitating the exchange of data. RESTful APIs and GraphQL are common approaches used in modern web applications.

Advantages in adopting a full-stack approach in software development:

• Faster Development Cycles: With a single developer or a small team capable of handling both frontend and backend tasks, projects can progress more quickly, reducing the time to market.
• Easy Integration: Full-stack developers have a comprehensive understanding of how the different components of an application interact, leading to better integration and fewer compatibility issues.
• Enhanced Problem-Solving: By possessing a complete view of the application, full-stack developers can identify and resolve issues more efficiently, improving overall project quality.

Why choose Xojo as a full-stack development solution?

When it comes to full-stack development, selecting the right programming language(s) or frameworks can significantly impact the efficiency and effectiveness of your projects. Xojo is a powerful choice for anyone seeking a robust, user-friendly and versatile development environment that provides everything needed to transform their ideas into fully fledged, working software products, no matter the platform or environment.

Xojo features ideal for full-stack development:

• Built-in Web Server: Xojo has its own built-in web server that allows developers to easily test and deploy web applications (on Linux or Windows servers) without the need for additional software. There is no need to set up complicated web server technologies or deal with compatibility issues and security. Xojo handles all of that for you. In production, you can run a web app built with Xojo as stand-alone or behind Apache or Nginx. You decide what works best for your project.
• Visual Development Environment: Xojo offers a visual development environment that allows developers to design user interfaces using drag-and-drop elements. This approach simplifies the process of creating appealing applications, accessible to both novice and experienced developers.
• Object-Oriented Programming: Xojo is object-oriented programming (OOP), enabling developers to create modular and reusable code. OOP encourages better organization and maintainability of applications, making it easier to scale projects over time.
• Compiled Code: Xojo compiles code into machine code, which results in fast and efficient web applications. In the event that some bad actors gain access to your server, rest assured that Xojo built web apps are more secure than those built with other tools.

In addition to these features, while many programming languages cater to full-stack development by combining and utilizing multiple external solutions, Xojo distinguishes itself as an ideal, singular solution. Compared to languages like JavaScript, Ruby, PHP or Python, Xojo has a gentle learning curve, making it an attractive option for beginners. Its syntax is straightforward and resembles natural language, which helps new developers learn concepts quickly. Xojo’s visual tools and drag-and-drop features enable developers to prototype applications rapidly. This is particularly advantageous for startups and businesses looking to iterate and launch products quickly.

Xojo for Frontend Development

Creating an engaging and user-friendly frontend is crucial for any web application. With Xojo, developers can quickly prototype and design visually appealing interfaces without the need for 3rd party tools or additional frameworks.

Xojo’s visual development environment makes building user interfaces an easy and enjoyable thing. With its drag-and-drop interface, developers can easily design and layout their GUI components- buttons, labels, and text fields- without needing any code at all. This intuitive approach allows developers to focus on the logic of the application rather than getting bogged down by low-level details.

So, what makes Xojo’s frontend capabilities so effective? For starters, it allows frontend developers to quickly:

• Prototype and test ideas without writing code;
• Easily create complex layouts and designs;
• Focus on the logic of the application rather than the UI;
• Collaborate more effectively with designers and other team members.

Example: A simple web app frontend built with Xojo

To illustrate the power of Xojo’s visual development environment, let’s take a look at a simple web app frontend built using Xojo. In this example, we’ll create a basic to-do list application with a user-friendly interface without writing any HTML, CSS or JavaScript code.

Coding Backend Functionality and Connecting it to the Frontend

While users interact with the frontend of apps, it’s the backend that does the heavy lifting, handling data and core functionality. Xojo makes building these backend systems easier for developers with useful features that create efficient server-side applications without unnecessary complexity. Xojo is a practical choice for developers who want to build solid, functional backends for web (and even desktop or mobile) apps without getting bogged down in overly complicated processes. Here are some notable aspects:

• Database Integration: Xojo supports out-of-the box connections to a variety of databases, including MySQL/MariaDB, PostgreSQL, SQLite, and ODBC. Besides the built-in database classes, now there’s also the DBKit project and the new DatabaseConnection project item.
• RESTful API Creation: Xojo makes it easy to create RESTful APIs, which are essential for enabling communication between the frontend and backend of a web application. By defining endpoints and handling HTTP requests and responses, developers can facilitate data exchange and enhance the interactivity of their varied applications and clients (web, desktop or mobile).
• Session Management: Managing user sessions is crucial for web applications, especially those that require user authentication. Xojo provides built-in support for easy session handling, allowing developers to track user activity and maintain state across different pages, improving the overall user experience.

Integrating the Frontend and Backend

Full-stack development works best when the frontend and backend of an app work well together. Xojo makes this easier by offering a single app development software solution for both parts. Developers can use the same programming language throughout the whole project, which saves time and reduces complications. This approach helps programmers focus on creating a smooth user experience without switching between different tools or languages.

Here are some key points worth taking into account when you want to start building your next successful application:

• Unified Language for Development: One of the standout features of Xojo is that it allows developers to work in one programming language, eliminating the need to switch between multiple languages like HTML, CSS, or JavaScript. This means that both the frontend and backend logic can be implemented using Xojo’s straightforward syntax, streamlining the development process, no matter the OS platform they’re building for.
• Single Integrated Development Environment (IDE): Xojo’s IDE serves as a centralized hub for managing both frontend design and backend coding. Developers can design user interfaces visually, drag and drop elements, and simultaneously write the corresponding backend code without needing to leave the IDE. This integration enables a more intuitive workflow, reducing the chances of errors and inconsistencies.

As the demand for agile and efficient software development continues to rise, the choice of programming language solutions and frameworks can have a significant impact on both project timelines and budgets. Xojo stands out as a compelling alternative for developers and teams accustomed to traditional stacks like LAMP (Linux, Apache, MySQL, and PHP) or MEAN (MongoDB, Express.js, Angular, and Node.js) or any other.

For organizations and startups already familiar with other development stacks, transitioning to Xojo can lead to significant savings in training costs. Xojo’s intuitive interface and single programming language approach mean that team members can quickly adapt without needing extensive retraining. This is especially beneficial for companies looking to onboard new developers or expand their teams. And as an extra plus, using Xojo, you can expand your application supported platforms to include building native desktop clients (Mac, Windows, Linux) or mobile clients (iOS, Android) , all with just one codebase.

And let’s not forget that managing a full-stack application typically involves maintaining multiple technologies, which can result in higher operational costs. Xojo minimizes the need for additional languages and frameworks, resulting in lower maintenance overhead costs and increased efficiency in full-stack development. Updates, debugging, and scaling become more straightforward, allowing teams to allocate resources more effectively.

Is it fair to call Xojo not just a great full-stack development suite but a full-stack development suite that truly optimizes the entire development process and maximizes productivity?

Gabriel is a digital marketing enthusiast who loves coding with Xojo to create cool software tools for any platform. He is always eager to learn and share new ideas!

Last week, I attended the WWDC 2024 event in Cupertino. It took place in both the original Infinite Loop campus, as well as the Apple Park “spaceship” campus which opened in 2017 and cost $5 billion to build. Apple’s WWDC events are no longer a traditional developer conference. The developer session videos are all uploaded for free, and even the keynote is a prerecorded, so event attendees see it at the same time as the rest of the world. Instead, this is more of a social event – an opportunity to meet fellow developers, bump into some famous people, and take advantage of Apple’s hospitality. I found the event uplifting and exciting, and I was able to talk with many people and share perspectives with them. 

Inside the Infinite Loop campus – rumors of a free bar may or may not be greatly exaggerated

The event was a great opportunity to share ideas and plans with other developers

Now, you might think that the event is solely for Swift developers, but this is not entirely true. Of course, Apple are constantly pitching their chosen language and frameworks at the event, but there is also a recognition that many people develop software for Apple platforms in tools other than Swift and Xcode. Of the people I spoke to, quite a number of people were using something other than Swift (including an Apple engineer!). Many of the sessions from WWDC are naturally catered towards Swift developers, but there are still some that will be useful to Xojo developers. I’ve highlighted a selection of videos below, along with my own description.

I want more stuff

When browsing WWDC videos, if you come across new functionality or an API that isn’t exposed in Xojo, the best course of action is to create a feature request at https://tracker.xojo.com. But don’t stop there. Tell the community about your request on the forum and ask them to give the request a “thumbs up” if they agree. This helps the Xojo team gauge interest. For some requests, you may also want to rope in support from me or one of the other MVPs, so that we can potentially engage with the team directly on your behalf at one of our regular meetings.

At each WWDC, Apple releases beta versions of its new tools and operating systems. These are very early versions, especially at this point in the beta cycle, and should not be installed on your main machines without very good reason. Early anecdotal evidence suggestions few problems with Sequoia (the new version of macOS) and Xojo apps, but testing such software should be done in virtual machines or on machines that you don’t use for your daily coding. When Xojo support for the new OS and the new version of Xcode becomes official, the System Requirements page will be updated at https://documentation.xojo.com/resources/system_requirements_for_current_release.html

Highlighted WWDC 2024 videos

“What’s new in App Store Connect”

Take better advantage of the App Store, get your app nominated for featuring and more.

“Add personality to your app through UX writing”

This is a quintessentially Apple presentation, but it may be thought provoking. What is the tone of your app? Does it matter for your market?

“Implement App Store Offers”

Self-explanatory from the title. Most of this will require the use of MBS plugins.

“Platforms State of the Union 5-Minute Recap”

The full State of the Union presentation, which follows the main keynote each WWDC, is rather lengthy and not required viewing for Xojo developers. But the five minute recap is worth watching to get an overview.

“Build multilingual-ready apps”

A lot of this video involves Swift code but there is still useful information for everyone in this.

Notes: 

• Apple also have a “Expanding your app to new markets” document at https://developer.apple.com/localization/. 
• To take advantage of much of this in your Xojo apps, see https://documentation.xojo.com/topics/localizing_your_apps/introduction_to_app_localization.html

“What’s new in SF Symbols 6”

SF Symbols (SF stands for San Francisco) is a library of thousands of clean and simple symbols for use in Apple platforms only. Apple typically updates this yearly.

Notes:

• To take advantage of SF Symbols in your iOS apps, use the Picture.SystemImage method. See the docs at https://documentation.xojo.com/api/graphics/picture.html#picture-systemimage
• There is no built-in support for SF Symbols in Xojo Mac apps, but you can still take advantage of them. See this blog post for details: https://blog.xojo.com/2021/10/21/quicktip-using-sf-symbols-in-macos-revisited/
• Tell Xojo that this support should really be built-in! Lend your support to this case; https://tracker.xojo.com/xojoinc/xojo/-/issues/60751
• Whilst SF Symbols is Apple-only, there is also a library of images built into Xojo for Android developments, also using the Picture.SystemImage method.
• Browse SF Symbols on your Mac (and get their names for use in Xojo) by downloading the SF Symbols utility from https://developer.apple.com/sf-symbols/

More videos

Want to watch even more videos? (Shouldn’t you be coding?) Subscribe to the official Xojo YouTube channel and also see videos from the recent Monkeybread Software conference, including presentations from Xojo engineers and other MVPs. https://www.youtube.com/@MonkeybreadSoftware/videos

Gavin is a Xojo MVP and is based in the UK. He has been a Xojo developer since the first version in 1998.

Throughout that time, software development has generally become more difficult with developers having to learn a wide variety of tools and programming languages, many of which are the hot thing for a short while and then disappear afterwards for the next hot new thing as the cycle repeats.

Up until recently this was not as big a deal for tech companies because they could just hire their way out of the problem. Teams got big and bloated, often because the tools being used were large, complex, rapidly changing and difficult to learn. So the solution, in opposition of the Mythical Man Month, was to throw more people at it. This was feasible because of 0% interest rates and the relative ease of raising capital.

But that era is over. Interest rates are no longer historically low and raising capital for companies is now much harder and less desirable than it once was. This means technology companies are reducing staff and hiring more judiciously. Fewer people now have to do more with less.

The idea of a “one person framework” is that there should be a way for a single developer to create software using just one development framework. This is not a new idea, but it is being talked about again because of these recent changes with how technology companies work. In many ways, Xojo is the original one person framework. From its inception, with inspiration from Visual Basic, Xojo let you make complete apps more efficiently without having to also learn other tools, languages or frameworks.

So what can Xojo, as a one person framework, do for you? Xojo lets you build most of the apps your company is likely to need, using only Xojo itself and its easy-to learn object-oriented programming language (which is similar to Visual Basic and Python, languages that many people already are familiar with). Xojo is a cross-platform, integrated development environment (IDE) that combines an object-oriented programming language, visual designer, code editor, debugger and more into one tool and one framework.

With Xojo you can make apps for most of the commonly used platforms that your business is likely to need.

Desktop Apps

Xojo has been a great way to make desktop apps since its inception in 1998. Unlike Java, Electron or other frameworks you’ve seen throughout the years, Xojo makes native apps and can do so for the major desktop platforms: Windows, macOS and Linux. Yes, that includes native ARM and x86 apps as well.

With a single project, you can click one button to have Xojo build separate native apps for each of those platforms. To further drive that point home, the Xojo IDE itself is a desktop app made with Xojo that runs on Windows, macOS and Linux.

With Xojo you have access to many commonly-used controls and the Xojo framework with support for databases, JSON, XML, RegEx, Zip/Unzip, networking and so much more.

Web Apps

Since 2010, Xojo has been able to make web apps. Xojo uses a somewhat unique approach to web apps by running compiled code on the web server. This code communicates to the app running on the web browser using an internal JavaScript framework and Bootstrap for the UI, which you don’t really need to worry about. It’s all handled automatically.

This approach is great for business purposes as it lets you make web apps using a development pattern that is very similar to what is used to make desktop apps.

If you don’t want to deal with the hassle of managing your own web app server, Xojo even offers Xojo Cloud as a fully managed web hosting service with 1-click deployment of your Xojo web apps.

Mobile Apps

Mobile support first appeared for iOS in 2013 and Android support was recently added in 2023. Using Xojo to make native mobile apps that can be deployed in their respective app stores is yet another way Xojo can help one person make more apps.

A developer that already knows how to use Xojo can jump right into mobile development without having to learn yet another IDE and programming language.

Console Apps

Console apps are text apps that run from the command line. These app are great for automating internal processes or other command-line tools. You can even build Console apps that communicate with other console apps to build a chain of tools for processing or converting data, for example.

Xojo Framework

A single person can create all of the above types of apps because Xojo uses the same programming language for all of them. And as mentioned above, the Xojo framework has many built-in features and is broadly compatible across all the different project types. There are differences, of course, but we strive for consistency and compatibility.

For just a few of its many capabilities, all platforms have the same framework classes and methods for things such as Dictionary, Set, URLConnection, files, SQLite, and most graphics. And speaking of examples, Xojo includes over 400 example projects from which to learn.

Could Xojo Work For You?

As you should now realize, a single developer using Xojo could reasonably create a desktop app (for Windows, macOS and Linux), a web app, and mobile apps for iOS and Android. If you previously had multiple teams of multiple people creating that many apps, then Xojo could really save you a lot of money and time.

Will you use Xojo to make the next Photoshop, FaceBook, Excel or Google Docs clone? Perhaps not, but most companies don’t create those types of apps. Xojo does a lot, but it does not and cannot do everything. There is a limit to what any single framework can do, otherwise it becomes too large for its own good, collapsing under its own weight.

Instead, most businesses have much different needs and often require specially created software. For business apps, especially bespoke small-business apps, Xojo can often be an ideal solution by allowing apps to be created faster, more easily and at less cost than can be done with other tools. This saves you money and time, both of which are in short supply these days.

Xojo is free for learning, development and testing! Give it a spin to see what it can do for you.

Paul learned to program in BASIC at age 13 and has programmed in more languages than he remembers, with Xojo being an obvious favorite. When not working on Xojo, you can find him talking about retrocomputing at Goto 10 and on Mastodon @lefebvre@hachyderm.io.

• Facebook
• X
• LinkedIn
• GitHub
• YouTube

This paper probably explains the biggest issue regarding SQL that persists to this day: its pronunciation.

I always flip between saying “sequel” and “ess cue ell” depending on context. The authors used SEQUEL as an acronym of Structured English QUEry Language. Over time this was referred to as Structured Query Language and the initialism of SQL took hold. Still, the pronunciation of sequel seems to have also stuck. Anyway, pronounce it how you want — I won’t judge.

I’ve sometimes seen people claim that SQL stands for Standard Query Language. As the above clearly shows, that is not true. And if you’ve used SQL at all with more than one database, you also have empirical evidence that there is not much standard about it beyond the main keywords.

The paper itself is only about 15 pages, so not long at all. I found this surprising as I expected it to be some lengthy and detailed specification written for academics.

But it’s not.

It starts by talking about the relational model of data, a somewhat new concept at the time (first described in 1969), and the predicate calculus, introducing a sublanguage called SQUARE, which strikes me a somewhat functional way of querying relational data. Math nerds do love their functional languages.

The authors then go on to introduce SEQUEL as a substitute for SQUARE and it’s here where we see the first syntax that you might recognize:

SELECT NAME
FROM   EMP
WHERE  DEPT = ’TOY’

Boolean expressions in the WHERE clause are also covered along with functions in the SELECT clause. These are all things still being used to this day.

The main justification the authors use for SEQUEL is that the concepts of predicate calculus and SQUARE require “too much sophistication for the ordinary user”. I won’t argue with that!

They drive that point home by showing how to get data results using some example queries, first by using SQUARE and then comparing to the SEQUEL equivalents. Their first query is this:

Find the names of managers who manage more than ten employees.

Note that for this example, there is a previously defined database with one of the tables as follows:

EMP (NAME, DEPT, MGR, SAL, COMM)

The SQUARE example looks like this:

I’m not going to even try to explain this. Read the paper if you’re curious.

Here’s the SEQUEL version:

SELECT   MGR
FROM     EMP
GROUP BY MGR
WHERE    COUNT (NAME) > 10

Well, now. That certainly makes more sense to me. I’ll bet that everyone reading this knows exactly how to parse out the SEQUEL command. It would actually work as-is in a database such as SQLite today!

There are other examples in the paper as well. Like I said, it’s somewhat short so you might find it to be an interesting read.

Happy 50th Birthday, SEQUEL (SQL)!!

Paul learned to program in BASIC at age 13 and has programmed in more languages than he remembers, with Xojo being an obvious favorite. When not working on Xojo, you can find him talking about retrocomputing at Goto 10 and on Mastodon @lefebvre@hachyderm.io.

What are Git and GitHub?

Git is an open-source version control system, also known as a source control system. Created by Linus Torvalds in 2005, it is now the most popular version control system, supplanting Subversion a while ago.

GitHub is an online Git hosting service, now owned by Microsoft. GitHub provides additional features beyond just Git hosting, but for this post we will focus on its Git hosting. GitHub is free to use for both public and private repositories.

A repository is essentially a place to store a project. Public repositories are great ways to share open-source projects. Others can view and download the source code. Private repositories are only visible to you and are great for your own internal projects.

Git is a distributed version control system, which just means that the source code can be versioned locally and on the server, only synchronizing when necessary. For simplicity it is common to keep both in sync, however. Older version control systems such as Subversion were server-based and versions were only ever kept on the server. A distributed version control system is slightly more complex, but it does have the advantage of making it easier to work offline.

A version control system tracks changes made to text files, something that is incredibly useful when it comes to source code. Tracking changes is a very common task that is needed while programming. You may have seen people save their projects as MyProject1, MyProject2, MyProjectNewVersion, etc. That is a rudimentary way of trying to ensure you don’t lose changes as you update your code. With version control and the Xojo version control project file format you get a much more flexible technique.

When you save your project using the Xojo version control project file format (called Xojo Project) in the file selector, each project item is saved as its own file on the drive. And each of these files is plain text — you could view them using a text editor if you wanted.

You might be thinking: “I’m just a single developer, I don’t need this extra complexity.” But version control systems are not just for multi-person teams. Sure, version control is a great way to make sure that different team members don’t make different changes to the same code. But version tracking is useful to everyone. Even as a single developer, being able to review previous changes, and revert changes if they don’t work out can be a lifesaver. It removes any “fear of breaking things” from your workflow. Plus, having your source code on a remote server (GitHub) can also function as one of your source code backups.

A Quick Example

To give you an example of how this works, consider a single text file that exists in Git: ReadMe.txt

Initially it contains just this text:

Hello!

You pull down the file to your computer (I’ll define Git terms like these below) to work on it. Opening the file in a text editor, you change its text to this and save:

Hello, Xojo!

Now the file on your computer contains that text. This is called the working copy. The file in the repository still has the text “Hello!”. Now you can do a couple useful things.

You can ask to see the differences between the file in the repository and the one in the working copy. When doing so, most tools will highlight the line that changed, showing the repository contents on the left and the working copy contents on the right. This is a wonderful way to review changes made to code.

The other thing you can do is commit the change to the repository. This adds this file to the repository and makes it the latest version. In Git you’ll then be able to see that this file has two versions and you’ll be able to see what the file looked like for each version.

These two things mean that you will never again lose any work. Anytime you make a change to your code that you want to save as a version in the repository, you commit it. You don’t want to commit after every change as that is too granular and will be hard to manage, but it means you can safely make a bunch of big changes to something and still be able to go back and review what the code looked like previously.

The other useful thing you can do is revert changes. If, after saving the file with “Hello, Xojo!” you realize that was a mistake, you can go back to the previous version by choosing to revert the file. This discards the local working copy and pulls down the most recent revision from the repository.

I realize that this might all seem rather different and confusing, but once you do this on a couple small projects you’ll get the hang of it and you will never want to go back to using MyProject1, MyProject2 again!

Terminology

Repository: This is essentially a place to store a group of files, which for our purposes will be a Xojo project saved in the version control file format (Xojo Project).

Clone: Copies the repository to your computer so you can work on it

Fetch: Updates the local repository with any changes that are stored on the server

Pull: Similar to fetch, except that it also copies the changes into the working copy

Commit: Add the changed file to the repository as a new version

Push: Pushes the committed file to the server (GitHub). Often this is done as a single step: Commit and Push.

Working Copy: Your local copy of the repository and the file

General GitHub Usage

With Xojo, the general workflow you will use is:

1. Create repository on GitHub for the project.
2. Pull it down to a folder on your computer.
3. Create a Xojo project.
4. Save it in Xojo Project (text) format into the above folder.
5. Commit and Push it to GitHub.
6. Make additional changes to the Xojo project.
7. Commit and Push to GitHub as necessary.

Create a GitHub Account

If you don’t already have a GitHub account, you’ll need to create one. Head on over to the sign up page to start the process:

Create a Repository

Now that you have a GitHub account, you’ll want to go to your GitHub home page and click the “New Repository” button.

As mentioned above, a repository is essentially where your project is stored. You’ll typically want a separate repository for each project. This is what the new repository form looks like:

For open-source projects you’ll want to make sure “Public” is selected as it’s not really open-source if it is not public. For a public repository, be sure to come up with a catchy “repository name” and always include a description. Choose “Private” for internal projects.

I always check “Add a README file”, which adds an empty README file to the repository. You can update it later, but it is where you’ll briefly describe the project and how to use it (using Markdown). The README is shown by default when you go to the repository in a web browser.

You should also select “Xojo” for the gitignore template (click the dropdown and type “xojo”). This identifies the project as using the Xojo programming language, which helps with searches and also marks the “uistate” file (which contains user-specific UI settings, such as window sizes and positions) so that it is not included in the project.

Last is the license. For most public open-source projects, I recommend the MIT License, which essentially allows anyone to use your code however they want. For private projects, you can leave it at “None”.

Click the Create Repository button to create the repository.

Clone the Repository to your Computer

With the repository created, you can view it on the GitHub website for you account:

From here you’ll be able to see the files in the repository, along with other information.

You are now ready to “clone” the repository to your computer. This copies the repository files to a folder on your computer so you can modify its files. Of course, the only files in the repository will be LICENSE and the empty README.md, but it is still necessary to do the clone so that you can create the folder where you will then add your Xojo code.

In order to clone, you’ll want to use a Git client application. There are many to choose from, but two free ones are the official GitHub Desktop and Atlassian SourceTree. GitHub Desktop is simpler so that is the one I’ll show here.

Download GitHub Desktop: https://desktop.github.com

Start GitHub Desktop and click “Sign into GitHub.com”.

On the Configure Git page, enter the name and email you want to use to identify your commits.

Click Finish on the next page to show the main screen where you have the option of creating new repositories or cloning a repository. Since we already created a repository online in the previous section, you want to select “Clone a Repository” (you can also choose this from the File menu). In the list, choose the repository you created above, choose your local folder location (Choose…) and click Clone.

You now have a folder on your disk where you can add your Xojo project. This is what the repository looks like in GitHub Desktop:

Note: If you are using another Git client, you will choose its “clone a repository from URL” feature and then provide the URL shown in the “Clone or Download” button on the repository page.

Add Your Xojo Project Code

Start Xojo and open the project you want for the repository you cloned (or you can just create a new project). Click “Save As”, make sure the Format is “Xojo Project” and choose the folder you created when you cloned the repository.

Go back to GitHub Desktop and you’ll now see all the Xojo files appearing in the list as “changed files”. (For this test I used a Xojo SQLiteExample.)

You now need to “Commit” these changes. By default they are all selected/checked in GitHub Desktop so you can enter a brief summary and description (for the first commit, often “Initial commit.” is used, but I used “Initial Xojo commit.”) and then click the “Commit to main” button.

Each time you commit you want to be sure to type a clear summary and description of the changes. This will be helpful later when you are reviewing prior commits.

This marked the files as committed in your local repository, which is needed before you can push the changes up to the online repository. Generally speaking you want to commit things after you have made changes that you want to track. You don’t need to immediately push the changes up to the server (online repository) each time, however, people often do as it is simpler. Some Git clients even offer a single button or command to commit and push in one step.

For this initial commit you definitely want to push the commit to the server, so click the button in the toolbar that says “Push origin”. This pushes the commit to the origin, which is the GitHub repository in this case.

If you now go back to the GitHub repository online and refresh the page you’ll now see the files have been committed:

Sharing Your Public Project

If you created a public repository then it is now available on GitHub for anyone to use. People can find it by searching or you can share the URL (perhaps in the Xojo Forum).

Since I published a public project, anyone can use it. This means that they can clone it and push changes to your project as “pull requests”. A pull request is a change that a user has made that they would also like you to apply to your project. Since this is your project, others cannot directly change it without you adding them as contributors. However, you can review these pull requests and choose to pull and merge the change into your project if you want. Or you can reject the pull request — it’s all up to you since it’s your project.

Changing and Updating Your Project

You’ll likely be continuing to change your project to fix bugs and add features. Each change you make shows up in GitHub Desktop where you can commit it and then push it to the server.

As an example, go back to Xojo and make a change to the project. I added some comments to the AddTeamRow method. After saving, the changes are now visible in GitHub Desktop:

You can see the one file that was changed, SQLiteWindow, and the changes (or diff) is shown in the viewer. Here you can see the changes by the blue highlighted lines in the gutter. The first change indicates that line 386 was removed and replaced, with the change noting that “Please” was added.

The next two changes indicate that new lines were added to the code.

It’s always good to review code like this before you commit it to make sure the changes are what you expect.

You can now Commit this change (always add Summary and Description text so you know the reason for the change!) and then Push it to the server (Push origin).

Discarding Changes

Say you’ve made changes to your Xojo project, but realize you’ve really messed things up and want to go back to the way the code was. For example, say I’ve accidentally deleted a bunch of code in the ShowData method and saved the project. In GitHub Desktop, it would look like this:

You can see the big red area indicating the code that was removed.

To discard this change, I can right-click on SQLiteWindow in GitHub Desktop and select Discard Changes. This pops up a confirmation dialog and clicking Discard Changes will restore the file to its previous version, which is the version of the file that was last committed to the repository.

After doing this, you will need to close the project in Xojo and then re-open it so that it can refresh its internal project structures to reflect the discarded changes. After doing that, you can go back to the ShowData method to see that the code is restored.

This capability is a big reason why version control is also incredibly useful for solo developers.

Using or Cloning Other Repositories

Don’t forget that you can also use other people’s public repositories. To do so you’ll want to click the “Clone or Download” button on the repository page.

For simple usage, where you just want to grab the current version of the repository because you don’t intend to change anything, you can then click the Download ZIP button. Once downloaded, unzip the file and then open the project in Xojo where you can use it or copy/paste it into your own projects (review the license agreement before you use projects, of course).

You’ll want to clone a project when you want to manage it using GitHub Desktop (or your GitHub client of choice). This allows you to fetch/pull updates from the online repository and also allows you to make your own changes and push them up to the server where the repository owner will get them as pull requests, as described above.

Change Your Default Project Format

You might find it worthwhile to change your default project format to be the version control format. This way it will always be selected by default when you save. You can change this in Xojo’s General Settings:

Pro Tip: When saving a project for the first time in version control format, it is always a good idea to save into a newly created folder. This ensures that all your files will be neatly contained in one place and won’t accidentally override something else that may have been in the folder.

Git Going

If you’ve created Xojo projects in public repositories on GitHub, be sure to share them in the forum!

This post just scratches the surface of what GitHub does and also only touches lightly on Git and the concept of source control in general. If you’d like to use Git for source control, but would prefer an alternative to GitHub you might also want to check out Atlassian BitBucket which also offers free Git hosting for both private and public repositories.

Paul learned to program in BASIC at age 13 and has programmed in more languages than he remembers, with Xojo being an obvious favorite. When not working on Xojo, you can find him talking about retrocomputing at Goto 10 and on Mastodon @lefebvre@hachyderm.io.

Xojo Linux is Free

We have made building for Linux free and included in the Xojo IDE! This means that on Linux you get a version control ready IDE, along with the ability to build desktop and console Linux apps (including Raspberry Pi), all for free. Launch Xojo 2024r1 (or any later release of Xojo) and open any desktop or console project, go to Build Settings, select Linux and in the Inspector choose the appropriate Architecture that matches the Linux OS you want your app to work on, either ARM or x86. Click Build to compile your project to a standalone app that you can then run on Linux – no license required.

Wrapping Up

All these changes were made based on feedback from the Xojo community and to better match the changing ways that people develop and share software projects. With this change Xojo continues its dedication to supporting Linux.

Download Xojo to get started.

Edited 07/2025 to reflect changes to licensing.

As an example of how you might use ChatGPT in Xojo, I looked for a way to turn statements into questions. So I ask ChatGPT:

Turn “numerical limits of double in xojo” into a sentence.

ChatGPT’s response is:

What are the numerical limits of the double data type in XOJO?

Getting Started

Before you can run the example to test out the ChatGPTConnection class or use it in your own projects, you’ll need to do three things:

1. Create an account at OpenAI.com. This is free.
2. Add a payment method to your account (to use ChatGPT via an API, you need pay – more on that in a bit).
3. Get an API key. You’ll need to have added a payment method before you can get an API key.

One you have done this, open the ChatGPT Example project, open the ChatGPTConnection class and in the Inspector assign your API key to the APIKey constant. Now you can run the example. The example presents a window where you converse with ChatGPT.

Each window is a separate context. Try choosing File > New Conversation. Referring to questions you asked in another window won’t work because in this example each has its own context.

Using the ChatGPT Classes in Your Project

To use the ChatGPTConnection class in your project, copy both the ChatGPTConnection and the ChatGPTException classes to your project.

To use the ChatGPTConnection class, either drag it onto a window, webpage or mobile screen or create an instance in code. Most of the work is done by a single method: ReplyToPrompt. The syntax for ReplyToPrompt is:

ReplyToPrompt(prompt As String, Optional MaintainContext As Boolean = False) As String

In its simplest form, just pass your prompt and the class will return ChatGPT’s response. For example:

Var gpt As New ChatGPTConnection
Var response As String = gpt.ReplyToPrompt("Where were the 1980 Olympic Games held?")
MessageBox(response)

When you want ChatGPT to consider past requests in the same session, pass True for the MaintainContext parameter. This tells the ChatGPTConnection class to keep a history of all your requests and the responses from ChatGPT which it then sends along with your new request each time you call the ReplyToPrompt method. The amount of text you can send is not unlimited so only set MaintainContext to True when you really do need it to consider previous requests and responses. ChatGPTConnection defaults to GPT 3.5 Turbo which has a maximum limit of 16,385 tokens per context. A token is a number of characters. The conversion is approximately 4 characters per token. Think of a token as a typical word. When you set the MaintainContext property to True, the ChatGPTConnection class monitors your usage of tokens. When it gets to 90% of the allowed maximum for the model you are using, it will start trimming the oldest requests and responses from your history (stored in the ContextHistory property) to avoid you going over the limit.

ChatGPTConnection Class Properties

You don’t need to set any of the properties in the ChatGPTConnection class as they all have useful default values. However, if you want to use a model different from the default (gpt-3.5-turbo), you can set the Model property before calling the ReplyToPrompt method. You can find a list of models here. Models have different limits as to how many tokens you can use so when you change the Model property, make sure to also change the MaximumTokensPerContext property to the appropriate value for the model. The Temperature property indicates how creative ChatGPT will be. Another way of saying this is how much it will hallucinate. Its value range is from 0 (don’t hallucinate at all) to 2 (hallucinate all you want). The default is 0.5. Finally, the TimeOut property is how long ReplyToPrompt will wait for a response. The default is 30 seconds.

If anything goes wrong, the ChatGPTConnection class will raise a ChatGPTException so make sure to put your calls to the ReplyToPrompt method in a Try Catch statement:

Try
   Var gpt As New ChatGPTConnection
   Var response As String = gpt.ReplyToPrompt("Where were the 1980 Olympic Games held?")    MessageBox(response)
Catch e As ChatGPTException
  MessageBox("Error: " + e.Message)
End Try

Pricing for ChatGPT is by millions of tokens. Chat GPT 3.5 is relatively inexpensive so if it gives you the results you want, use it. As of this writing, every 1 million words/tokens you send it will only cost 50 cents in US dollars. Every 1 million words/tokens you get back in response will cost $1.50 USD. If you need higher quality responses, consider Chat GPT 4.

Geoff Perlman is the Founder and CEO of Xojo. When he’s not leading the Xojo team he can be found playing drums in Austin, Texas and spending time with his family.