Agent WranglersSigning and notarisation
Sign every build for each platform, notarise Mac builds, keep signing keys in hardware, and check every signature in CI before anyone downloads it.
- Required 2
- Recommended 3
Required
Sign and notarise every Mac build
DSK-1Sign every Mac app, disk image and installer you hand out with a Developer ID certificate, the hardened runtime and a secure timestamp. Notarise it with Apple and staple the ticket before release.
Keep code signing keys in hardware or a signing service
DSK-3Keep every private key that signs your software in a hardware security module, a hardware token or a cloud signing service. No key exists as a file on a laptop or in the repository.
Recommended
Sign every Windows file with a SHA-256 signature and a timestamp
DSK-2Sign every
.exe,.dll,.msiand.msixyou hand out with Authenticode, using SHA-256 and an RFC 3161 timestamp. Sign each release with the same publisher identity.Check every signature in CI before you publish
DSK-4After signing, verify every file of the release with each platform's own tool in CI. Stop the release when any file fails, and publish only the files that passed.
Sign Linux packages and the repository that serves them
DSK-5Sign every
.debor.rpmrepository you run with a key kept as keep code signing keys in hardware or a signing service says. Tell users to add the key for your repository only.
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation">Agent Wranglers desktop apps, extensions and CLIs playbook</a>. In code you write, add a comment next to it with the same link.