Pace “digital signing” for AAX versions

[Nonlinear]

Questions for anyone here developing AAX plugins. I am just getting started with AAX and have obtained the necessary licenses and tools from both Avid and Pace. I am trying to digest all the documentation for “digital signing” but it’s quite overwhelming.

Two basic things are not clear to me:

1) how do the digital signing certs get to my customers? Do I need to develop an installer package with iLok - are the certs automatically tied to Pro Tools - or what? Neither Pace nor Avid seem to explain how to DISTRIBUTE the “signed” plugin.

2) are the digital certs only required at the time the customer purchases my plugin - or do I have to maintain (pay for) these certs year-after-year to keep the delivered plugins working?

Appreciate any input!

[karbomusic]

I don't know anything about AAX but if you need an official code signing cert from a certificate authority, they are usually pretty expensive. If it is to be signed with a cert you do that as part of the compilation process IIRC.

[Nonlinear]

Originally Posted by karbomusic

I don't know anything about AAX but if you need an official code signing cert from a certificate authority, they are usually pretty expensive. If it is to be signed with a cert you do that as part of the compilation process IIRC.

Yes, the expense was question #2. It’s not clear if I would have to continue to pay for the cert every year once created or just in the year the plugin is issued/sold.

I will contact Pace on Monday - just thought I’d ask here in the meantime for those who work with this.

[karbomusic]

The cert is just to prove you are you, once it is compiled into the plugin, it doesn't need to be renewed for that version of the released plugin (or everyone's plugins would break a year or two after purchase). However, if you compiled a new version 18 months later, you may need a valid cert for that new version. But you are correct to ask Pace et al because I don't know if this is for the actual plugin or the installer itself.

[zabukowski]

Originally Posted by Nonlinear

Questions for anyone here developing AAX plugins. I am just getting started with AAX and have obtained the necessary licenses and tools from both Avid and Pace. I am trying to digest all the documentation for “digital signing” but it’s quite overwhelming.

Two basic things are not clear to me:

1) how do the digital signing certs get to my customers? Do I need to develop an installer package with iLok - are the certs automatically tied to Pro Tools - or what? Neither Pace nor Avid seem to explain how to DISTRIBUTE the “signed” plugin.

2) are the digital certs only required at the time the customer purchases my plugin - or do I have to maintain (pay for) these certs year-after-year to keep the delivered plugins working?

Appreciate any input!

1. when signed, certificate is embeeded into your AAX plugin
2. signed plugins will not expire, even if certificate which was used for signing, has expired (in any case, you must have valid certificate to sign your plugin)

If you are developing AAX plugins for macOS, you should enroll in Apple developer program ($99 per year) - then you can obtain macOS signing certificate from Apple. Additionally, you can export this certificate to .p12 format and use it for signing AAX plugins on Windows without extra cost.

Hope it helps!

[Nonlinear]

Originally Posted by zabukowski

1. when signed, certificate is embeeded into your AAX plugin
2. signed plugins will not expire, even if certificate which was used for signing, has expired (in any case, you must have valid certificate to sign your plugin)

If you are developing AAX plugins for macOS, you should enroll in Apple developer program ($99 per year) - then you can obtain macOS signing certificate from Apple. Additionally, you can export this certificate to .p12 format and use it for signing AAX plugins on Windows without extra cost.

Hope it helps!

Great info. Thank you!

[gstuff]

You need to sign AAX plugins with the PACE signing tool, or, they won't load in non-debug versions of PT. A signed plugin doesn't expire, but your ability to use the PACE tool does, hence why you need a valid subscription. Separately, you can sign your installers with your Apple cert to avoid the "unidentified developer" warning.

[Nonlinear]

Originally Posted by gstuff

You need to sign AAX plugins with the PACE signing tool, or, they won't load in non-debug versions of PT. A signed plugin doesn't expire, but your ability to use the PACE tool does, hence why you need a valid subscription. Separately, you can sign your installers with your Apple cert to avoid the "unidentified developer" warning.

The Pace signing tool is now layered on top of Apple and/or Microsoft digital signatures. You can’t sign with Pace until you have the others first.

Sounds like the best approach is the Apple cert for Mac then exported for Windows. MS certs seem to be about 3x the price ($299/yr).

[gstuff]

Never said it wasn't - I was merely clarifying that AAX need to be signed using the PACE, tool - I've always used my Apple cert on both Mac/Windows.

[earlevel]

Originally Posted by Nonlinear

Questions for anyone here developing AAX plugins. I am just getting started with AAX and have obtained the necessary licenses and tools from both Avid and Pace. I am trying to digest all the documentation for “digital signing” but it’s quite overwhelming.

Actually, a self-signed certificate is adequate for Pro Tools. (But for the installer, you'll need one from a signing authority, if you want to avoid the Mac launch complaint.) Search for generating a self-signed certificate with Keychain Access. You can export it and use it on the Windows side too.