navi/docs/signing.md

Code signing (release)

macOS

1. Create a Developer ID Application certificate in Apple Developer.
2. Store notary credentials once:

xcrun notarytool store-credentials "navis-notary" \
  --apple-id "you@example.com" \
  --team-id "TEAMID" \
  --password "app-specific-password"

3. Build with identity (packmac picks it up):

export NAVIS_CODESIGN_IDENTITY="Developer ID Application: Example Ltd (TEAMID)"
./scripts/build-macos-arm64.sh

4. Notarize the DMG:

export NAVIS_NOTARY_PROFILE="navis-notary"
./scripts/sign-macos.sh dist/navis-release/darwin-arm64/Navis.dmg

Without these env vars, packmac uses ad-hoc signing (-) — fine for local/dev.

Windows

Sign Navis.exe with Authenticode (EV or standard code signing cert):

signtool sign /fd SHA256 /tr http://timestamp.digicert.com /td SHA256 /a dist\navis-release\Navis.exe
signtool verify /pa dist\navis-release\Navis.exe

Then refresh sha256 in dist/update.json (or re-run the Windows release script that stamps it).