Code Signing – macOS & Windows

Code Signing – macOS & Windows

macOS notarization (Gatekeeper)

1. Enroll in the Apple Developer Program.
2. Export a Developer ID Application certificate.
3. Sign the app bundle:

codesign --deep --force --options runtime --entitlements entitlements.plist \
  --sign "Developer ID Application: Your Name (TEAMID)" MyApp.app

4. Notarize with xcrun altool (or notarytool in newer Xcode):

xcrun notarytool submit MyApp.app --apple-id YOUR_ID --password APP_SPECIFIC_PASSWORD --team-id TEAMID

5. Once notarized, staple the ticket:

xcrun stapler staple MyApp.app

Windows code signing

1. Purchase a code‑signing certificate (or use a free OpenSSL self‑signed cert for testing).
2. Sign the executable with signtool:

signtool sign /f cert.pfx /p YOUR_PASSWORD /tr http://timestamp.digicert.com /td sha256 /fd sha256 dist/MyApp Setup.exe

3. Verify:

signtool verify /pa /v dist/MyApp Setup.exe

Both platforms require the signature to be embedded before creating the installer; electron-builder can run the signing step automatically if you provide the appropriate config.