JayBrown

What's wrong with not being backwards-compatible? You can make new Skim versions accept both XAs, with or without the S flag, but make them write #S by default, unless the user opts out in Preferences (see below). True, older Skim versions will not be able to read XAs with the S flag, but you could add a simple command to "Convert metadata to old format" on a per-document basis. And you can add a preferences setting with an opt-in to use only the old format without the S flag. Then users could choose...

Change Skim-proprietary XAs: append "#S" handling flag to preserve metadata

You don't need Keychain Access, and I believe Apple has made it rudimentary on purpose. You should instead use openssl or a GUI frontend like xca, and just add the necessary X509v3 extensions. I think those are extendedKeyUsage=critical,codeSigning keyUsage=critical,digitalSignature subjectKeyIdentifier=hash basicConstraints=critical,CA:FALSE and if you have a certificate chain also: authorityKeyIdentifier=keyid, issuer

Code signing certificate: (1) add SKID ; (2) increase valid-until

PS: the "all output" should also contain all the fields with values from the XMP & a/iXML parts of the metadata. (Good for production contexts with scenes, takes etc.)

Related request: https://sourceforge.net/p/bwfmetaedit/feature-requests/6/

"output all" option in mediainfo format

I think I have everything necessary in terms of compilers etc., but I received lots...