code signing & packaging

19 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Code signing prevents OS security warnings

Code signing certifies that an app was created by you. Both Windows and macOS prevent users from running unsigned applications. Unsigned apps trigger operating system security warnings and require users to go through multiple advanced and manual steps to run them.

macOS apps require code signing and notarization

Preparing macOS applications for release requires two steps. First, the app needs to be code signed. Then, the app needs to be uploaded to Apple for a process called notarization, where automated systems verify that the app is not doing anything to endanger users.

macOS code signing requirements

To sign and notarize a macOS app, you must: 1) Enroll in the Apple Developer Program (requires an annual fee), 2) Download and install Xcode (requires a computer running macOS), 3) Generate, download, and install signing certificates.

Notarization definition and purpose

Notarization is a process where Apple's automated systems verify that an app is not doing anything to endanger its users. It is required as part of preparing macOS applications for distribution.

safeStorage requires code signing on macOS

The safeStorage API on macOS requires a valid, consistent code signature. Without proper code signing, macOS may be unable to determine that two builds of an unsigned app are the same app, which can cause the Keychain to prompt the user for permission again after every update.

app.setLoginItemSettings requires code signing on macOS

The app.setLoginItemSettings() API can behave incorrectly on macOS when the app is not packaged, code signed, and notarized. It may silently fail to register login items.

cookieEncryption fuse requires code signing on macOS

The cookieEncryption fuse on macOS requires code signing because it uses the same OS-level access to the Keychain as safeStorage, which relies on a valid code signature.

autoUpdater requires code signing on macOS

The autoUpdater module on macOS requires the app to be signed for automatic updates to work. Squirrel.Mac requires the app to be signed.

Windows code signing requires EV certificate since June 2023

Since June 2023, Microsoft requires software on Windows to be signed with an extended validation (EV) certificate. Simpler certificates like authenticode code signing certificates or software-based OV certificates no longer provide benefits. Windows treats apps signed with these simpler certificates as completely unsigned and displays equivalent warning dialogs.

Windows EV certificates require FIPS 140 Level 2 hardware storage

EV code signing certificates for Windows must be stored on a hardware storage module compliant with FIPS 140 Level 2, Common Criteria EAL 4+, or equivalent. The certificate cannot be simply downloaded onto CI infrastructure. These storage modules resemble USB thumb drives.

Azure Artifact Signing is a cloud-based code signing option for Windows

Azure Artifact Signing (formerly Azure Trusted Signing) is Microsoft's modern cloud-based signing service. It is the cheapest option for code signing on Windows and eliminates SmartScreen warnings. Azure Artifact Signing is currently limited to developers in certain countries.

jsign enables Windows code signing via Azure Artifact Signing

jsign is a tool that allows developers on Linux or macOS to sign Windows apps via Azure Artifact Signing.

Electron Forge recommended for code signing

Electron Forge is recommended for signing Electron apps and installers. It is a collection of official Electron tools that uses @electron/packager, @electron/osx-sign, @electron/notarize, and @electron/windows-sign under the hood.

Electron Packager API code signing example for macOS

Example code using @electron/packager to sign and notarize a macOS app: ```js const packager = require('@electron/packager') packager({ dir: '/path/to/my/app', osxSign: {}, osxNotarize: { appleId: 'felix@felix.fun', appleIdPassword: 'my-apple-id-password' } }) ```

Electron Packager API code signing example for Windows

Example code using @electron/packager to sign a Windows app: ```js const packager = require('@electron/packager') packager({ dir: '/path/to/my/app', windowsSign: { signWithParams: '--my=custom --parameters', signToolPath: 'C:\\Path\\To\\my-custom-tool.exe' } }) ```

electron-winstaller supports windowsSign configuration

electron-winstaller generates Squirrel.Windows installers and uses @electron/windows-sign under the hood. It supports the same windowsSign options as @electron/packager. Example usage shows windowsSign configuration with signWithParams and signToolPath properties.

electron-wix-msi supports windowsSign configuration

electron-wix-msi generates MSI installers for Electron apps and uses @electron/windows-sign under the hood. It supports the same windowsSign options as @electron/packager. The configuration is passed when instantiating MSICreator.

Cloud-based code signing for Windows CI environments

Many certificate providers offer cloud-based signing where the signing hardware is in their data center and developers can use it to remotely sign code. This approach is popular with Electron maintainers because it makes signing applications in CI infrastructure like GitHub Actions and CircleCI relatively easy.

Popular Windows code signing certificate providers

Popular resellers for Windows code signing certificates include: DigiCert EV code signing certificate, GlobalSign EV code signing certificate, Sectigo EV code signing certificate, and SSL.com EV code signing certificate.

Give your agent this brain