41 lines
1.0 KiB
Markdown
41 lines
1.0 KiB
Markdown
# Code signing (release)
|
|
|
|
## macOS
|
|
|
|
1. Create a **Developer ID Application** certificate in Apple Developer.
|
|
2. Store notary credentials once:
|
|
|
|
```bash
|
|
xcrun notarytool store-credentials "navis-notary" \
|
|
--apple-id "you@example.com" \
|
|
--team-id "TEAMID" \
|
|
--password "app-specific-password"
|
|
```
|
|
|
|
3. Build with identity (packmac picks it up):
|
|
|
|
```bash
|
|
export NAVIS_CODESIGN_IDENTITY="Developer ID Application: Example Ltd (TEAMID)"
|
|
./scripts/build-macos-arm64.sh
|
|
```
|
|
|
|
4. Notarize the DMG:
|
|
|
|
```bash
|
|
export NAVIS_NOTARY_PROFILE="navis-notary"
|
|
./scripts/sign-macos.sh dist/navis-release/darwin-arm64/Navis.dmg
|
|
```
|
|
|
|
Without these env vars, packmac uses **ad-hoc** signing (`-`) — fine for local/dev.
|
|
|
|
## Windows
|
|
|
|
Sign `Navis.exe` with Authenticode (EV or standard code signing cert):
|
|
|
|
```bat
|
|
signtool sign /fd SHA256 /tr http://timestamp.digicert.com /td SHA256 /a dist\navis-release\Navis.exe
|
|
signtool verify /pa dist\navis-release\Navis.exe
|
|
```
|
|
|
|
Then refresh `sha256` in `dist/update.json` (or re-run the Windows release script that stamps it).
|