Repository navigation
Sign and notarize macOS builds with Developer ID - #146
Merged
Merged
Conversation
Replace ad-hoc signing with the Developer ID Application certificate and notarize through an App Store Connect API key. forceCodeSigning makes a missing certificate fail the build instead of shipping unsigned. Signing secrets are passed to the mac job only, so the Windows build never tries to sign NSIS with the Apple .p12. Closes #145 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Test release run with publish=false; nothing was released. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
26.15.x passed the .p12 password to `security set-key-partition-list` instead of the temporary keychain's password, so every CSC_LINK build failed with "SecKeychainUnlock: The user name or passphrase you entered is not correct". Fixed upstream in 26.16.0. Refs #145 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Second test release run with publish=false; nothing was released. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Collaborator
Author
|
Test build with
|
The mac artifact bundled both DMGs and both update zips into one ~540 MB zip, so testing a single build meant downloading all four. Each installer is now uploaded with archive: false (upload-artifact v7) and can be downloaded on its own; update metadata stays in a small zipped artifact per platform. The publish job downloads installers with skip-decompress so the mac update .zip files reach the release as-is instead of being extracted. Refs #145 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Third test release run with publish=false; nothing was released. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #145
What changes
package.jsonbuild.mac: drop ad-hocidentity: "-", enablehardenedRuntimeandnotarize, addforceCodeSigningso a missing certificate fails the build instead of shipping unsigned.release.yml: the mac job writes the App Store Connect.p8from a secret to$RUNNER_TEMP(electron-builder'sAPPLE_API_KEYis a path) and gets the signing and notarization env. The Windows job gets empty values, so it never tries to sign NSIS with the Apple.p12.Existing ad-hoc installs reach the signed build through the current mac update path (download the
.dmgfrom GitHub releases and open it), so no manual reinstall is needed. Switching to Squirrel.Mac silent updates can be a follow-up once most users are on a signed build.Before merging
All six repository secrets must exist, or the next mac release fails at signing or notarization:
CSC_LINKCSC_KEY_PASSWORDAPPLE_API_KEY_P8APPLE_API_KEY_IDAPPLE_API_ISSUER(waiting on the account holder)APPLE_TEAM_IDVerify after the first release
Check both arm64 and x64. Local
electron-builder --macwithout the certificate now fails by design. For the old ad-hoc build, add-c.mac.identity=- -c.mac.hardenedRuntime=false -c.mac.notarize=false -c.mac.forceCodeSigning=false.🤖 Generated with Claude Code