DSK-4Recommended

Check every signature in CI before you publish

After signing, verify every file of the release with each platform's own tool in CI. Stop the release when any file fails, and publish only the files that passed.

By Agent Wranglers. Updated 22 October 2026.

How to do it

A signing step can pass while it skips a nested helper, a framework or a file added late. The users then find out. Run codesign --verify --deep --strict and spctl on Mac, signtool verify /pa on Windows, and gpg --verify or rpm -K on Linux packages. Publish the files the check ran on, never a rebuild, as build releases only in CI and verify them before deploy says. Publish a checksum list and keep the files unchanged, as make release tags and files immutable says.

Examples

Shell example

codesign --verify --deep --strict --verbose=2 "Ledgerly.app"
spctl --assess --type execute "Ledgerly.app"
sha256sum dist/* > dist/SHA256SUMS

Plain text example

Get-ChildItem .\dist -Recurse -Include *.exe,*.dll,*.msi | ForEach-Object { signtool verify /pa $_.FullName; if ($LASTEXITCODE) { exit 1 } }

How to check

Remove the signature from one helper file in a test build. The release job fails and names the file. The checksums on the download page match the files in the store or bucket.

Sources

ENG-11 Build releases only in CI and verify them before deploy in Engineering
ENG-42 Make release tags and files immutable in Engineering

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/verify-before-publish">Agent Wranglers desktop apps, extensions and CLIs playbook</a>. In code you write, add a comment next to it with the same link.