Desktop apps, extensions and CLIs checklist

Every rule in the desktop apps, extensions and CLIs playbook, by chapter, required rules first. Each links to its own page with how we built it and how to check it. This is a lot to check. An Expert can check it for you.

Signing and notarisation

• Required DSK-1 Sign and notarise every Mac build
• Required DSK-3 Keep code signing keys in hardware or a signing service
• Recommended DSK-2 Sign every Windows file with a SHA-256 signature and a timestamp
• Recommended DSK-4 Check every signature in CI before you publish
• Recommended DSK-5 Sign Linux packages and the repository that serves them

Update integrity

• Required DSK-6 Verify every update's signature before installing it
• Recommended DSK-7 Refuse updates older than the installed version
• Recommended DSK-8 Roll out each update in stages with a stop switch
• Recommended DSK-9 Keep the bundled browser engine current

Web code inside desktop apps

• Required DSK-10 Keep web content away from the operating system
• Recommended DSK-11 Check the sender and content of every message to the main process
• Recommended DSK-12 Open outside links only after checking the address
• Recommended DSK-13 Keep tokens in the system keychain

Browser extensions

• Required DSK-14 Ask for the fewest permissions the extension needs
• Required DSK-15 Ship every line of code inside the package
• Recommended DSK-16 Treat messages from web pages and content scripts as untrusted
• Recommended DSK-17 Keep extension state in storage instead of the background worker
• Recommended DSK-18 Declare data use truthfully in each store
• Recommended DSK-19 Protect the store accounts that publish the extension

Command-line tools

• Required DSK-24 Take secrets from the environment or a file instead of a flag
• Recommended DSK-20 Exit with zero only when the command did everything it was asked
• Recommended DSK-21 Write results to stdout and everything else to stderr
• Recommended DSK-22 Offer JSON output with a stable shape
• Recommended DSK-23 Never wait for input when no person is there
• Recommended DSK-25 Show a dry run and ask before destructive commands
• Recommended DSK-26 Give every command help with an example and a version flag

Show the badge on your project

When your project passes every Required rule, you can show this badge on your site or in your README. It links to this checklist, so anyone can run the same checks.

<a href="https://agentwranglers.se/playbook/desktop-apps/checklist"><img src="https://agentwranglers.se/badge.svg" alt="Checked against the Agent Wranglers desktop apps, extensions and CLIs playbook" width="214" height="20"></a>

[![Checked against the Agent Wranglers desktop apps, extensions and CLIs playbook](https://agentwranglers.se/badge.svg)](https://agentwranglers.se/playbook/desktop-apps/checklist)