---
title: "Signing and notarisation · Agent Wranglers"
url: https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation
parts: 5
tokens_total: 4264
updated: 2026-10-22
tokens: 766
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Signing and notarisation

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Desktop apps, extensions and CLIs](https://agentwranglers.se/playbook/desktop-apps.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

> Sign every build for each platform, notarise Mac builds, keep signing keys in hardware, and check every signature in CI before anyone downloads it.

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation">Agent Wranglers desktop apps, extensions and CLIs playbook</a>`. In code you write, add a comment next to it with the same link.

## Required

- DSK-1 [Sign and notarise every Mac build](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/mac-notarisation.md) · 806 tokens · updated 2026-10-22
  Sign every Mac app, disk image and installer you hand out with a Developer ID certificate, the hardened runtime and a secure timestamp. Notarise it with Apple and staple the ticket before release.
- DSK-3 [Keep code signing keys in hardware or a signing service](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/signing-keys-in-hardware.md) · 1,025 tokens · updated 2026-10-22
  Keep every private key that signs your software in a hardware security module, a hardware token or a cloud signing service. No key exists as a file on a laptop or in the repository.

## Recommended

- DSK-2 [Sign every Windows file with a SHA-256 signature and a timestamp](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/windows-authenticode.md) · 850 tokens · updated 2026-10-22
  Sign every `.exe`, `.dll`, `.msi` and `.msix` you hand out with Authenticode, using SHA-256 and an RFC 3161 timestamp. Sign each release with the same publisher identity.
- DSK-4 [Check every signature in CI before you publish](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/verify-before-publish.md) · 850 tokens · updated 2026-10-22
  After signing, verify every file of the release with each platform's own tool in CI. Stop the release when any file fails, and publish only the files that passed.
- DSK-5 [Sign Linux packages and the repository that serves them](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/linux-package-signing.md) · 733 tokens · updated 2026-10-22
  Sign every `.deb` or `.rpm` repository you run with a key kept as [keep code signing keys in hardware or a signing service](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/signing-keys-in-hardware.md) says. Tell users to add the key for your repository only.

- Next: [Update integrity](https://agentwranglers.se/playbook/desktop-apps/update-integrity.md)
- [All chapters](https://agentwranglers.se/playbook/desktop-apps.md)