Getting an audio plugin onto macOS costs $99 a year before a single line of platform-specific code gets written. That is the Apple Developer Program fee, and it renews whether you sell ten copies or ten thousand.
Enrolling as a business drags in a D-U-N-S number, which takes several days on its own. Approval afterwards typically runs another day or two.
Then the certificates start expiring. Apple's developer certificates last a year, and you need separate ones for signing binaries and signing installers, so a lapsed cert can stall a release that was otherwise finished.
Miss the timestamp flag, and Apple rejects the submission outright. Miss the hardened runtime and notarization fails too.
After signing, the whole thing gets wrapped in a zip, dmg, or pkg and submitted to Apple's notary service. Stapling the result works on dmg and pkg files but not on zips, which catches out plenty of first-time releases.
Skip all of it and Gatekeeper simply blocks the install. Your user has to dig into Privacy and Security settings and manually allow the plugin, and they get to repeat that ritual for every update you ship.
Failures are common and unhelpfully worded. Error 4099 shows up constantly, and it usually traces back to a mismatch between the audio and MIDI bus configuration and the plugin type being registered.
Building AUv2 and AUv3 versions at the same time causes its own conflicts. None of this exists on the other side of the fence, where a VST3 dropped into the right folder simply gets scanned by the host.
That asymmetry is most of the answer to why a plugin lands on Windows months before macOS. The audio code is identical. The paperwork, the tooling, and the failure modes are not.
Acceptable storage now means a USB security token, a physical hardware security module, a cloud-based module, or a managed signing service. Some providers responded with roughly triple the previous pricing, and OV certificates are commonly listed from a little over $200 a year.
Physical tokens also have to be shipped to you. Certificates issued before that cutoff kept working as ordinary files until their next renewal, which delayed the pain rather than removing it.
There is a cheaper managed route. Azure Trusted Signing sits at around $9.99 a month for individuals or businesses trading for three years or more, and it clears SmartScreen warnings without a dongle in your desk drawer.
Unsigned Windows builds still install. The user sees a warning, clicks through More Info and Run Anyway, and carries on, which is irritating rather than fatal.
That single difference in severity shapes release order across the whole small-plugin scene. A one-person operation can put out an unsigned Windows build, gather feedback, and fund the Apple side later, which is exactly the pattern behind a scrappy Windows-only synth still waiting on its Mac build.
Mac users end up paying for that in waiting time. The build they eventually get is usually the same DSP wrapped in a different format, held up by an approval queue and a fee rather than by anything to do with the sound.
Enrolling as a business drags in a D-U-N-S number, which takes several days on its own. Approval afterwards typically runs another day or two.
Then the certificates start expiring. Apple's developer certificates last a year, and you need separate ones for signing binaries and signing installers, so a lapsed cert can stall a release that was otherwise finished.
Apple notarization adds a yearly bill to every build
Signing is not one action. Every bundle gets signed individually, so the AU component, the VST3, and any standalone app each take their own pass, all with the hardened runtime enabled and a secure timestamp attached.Miss the timestamp flag, and Apple rejects the submission outright. Miss the hardened runtime and notarization fails too.
After signing, the whole thing gets wrapped in a zip, dmg, or pkg and submitted to Apple's notary service. Stapling the result works on dmg and pkg files but not on zips, which catches out plenty of first-time releases.
Skip all of it and Gatekeeper simply blocks the install. Your user has to dig into Privacy and Security settings and manually allow the plugin, and they get to repeat that ritual for every update you ship.
auval decides whether Logic Pro ever sees your plugin
Apple runs a second gate on top of signing. An Audio Unit v2 plugin has to pass auvaltool, Apple's own validation utility, before Logic Pro will list it at all.Failures are common and unhelpfully worded. Error 4099 shows up constantly, and it usually traces back to a mismatch between the audio and MIDI bus configuration and the plugin type being registered.
Building AUv2 and AUv3 versions at the same time causes its own conflicts. None of this exists on the other side of the fence, where a VST3 dropped into the right folder simply gets scanned by the host.
That asymmetry is most of the answer to why a plugin lands on Windows months before macOS. The audio code is identical. The paperwork, the tooling, and the failure modes are not.
Windows signing got expensive after the 2023 rule change
Windows is cheaper, not free. Since 1 June 2023, private keys for OV code signing certificates have to live in hardware meeting FIPS 140-2 Level 2 or Common Criteria EAL 4+, which killed the old habit of emailing a certificate file around.Acceptable storage now means a USB security token, a physical hardware security module, a cloud-based module, or a managed signing service. Some providers responded with roughly triple the previous pricing, and OV certificates are commonly listed from a little over $200 a year.
Physical tokens also have to be shipped to you. Certificates issued before that cutoff kept working as ordinary files until their next renewal, which delayed the pain rather than removing it.
There is a cheaper managed route. Azure Trusted Signing sits at around $9.99 a month for individuals or businesses trading for three years or more, and it clears SmartScreen warnings without a dongle in your desk drawer.
Unsigned Windows builds still install. The user sees a warning, clicks through More Info and Run Anyway, and carries on, which is irritating rather than fatal.
That single difference in severity shapes release order across the whole small-plugin scene. A one-person operation can put out an unsigned Windows build, gather feedback, and fund the Apple side later, which is exactly the pattern behind a scrappy Windows-only synth still waiting on its Mac build.
Mac users end up paying for that in waiting time. The build they eventually get is usually the same DSP wrapped in a different format, held up by an approval queue and a fee rather than by anything to do with the sound.
