---
title: "Check every signature in CI before you · Agent Wranglers"
url: https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/verify-before-publish
id: DSK-4
level: Recommended
updated: 2026-10-22
tokens: 895
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Check every signature in CI before you publish

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Signing and notarisation](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

- ID: DSK-4
- Level: Recommended
- Chapter: [Signing and notarisation](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation.md)
- Rule: After signing, verify every file of the release with each platform's own tool in CI. Stop the release when any file fails, and publish only the files that passed.
- Check: Remove the signature from one helper file in a test build. The release job fails and names the file. The checksums on the download page match the files in the store or bucket.
- How: A signing step can pass while it skips a nested helper, a framework or a file added late. The users then find out. Run `codesign --verify --deep --strict` and `spctl` on Mac, `signtool verify /pa` on Windows, and `gpg --verify` or `rpm -K` on Linux packages. Publish the files the check ran on, never a rebuild, as [build releases only in CI and verify them before deploy](https://agentwranglers.se/playbook/engineering/build-test-and-deploy/build-in-ci-and-verify.md) says. Publish a checksum list and keep the files unchanged, as [make release tags and files immutable](https://agentwranglers.se/playbook/engineering/build-test-and-deploy/immutable-releases.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```bash
codesign --verify --deep --strict --verbose=2 "Ledgerly.app"
spctl --assess --type execute "Ledgerly.app"
sha256sum dist/* > dist/SHA256SUMS
```

### Plain text example

```powershell
Get-ChildItem .\dist -Recurse -Include *.exe,*.dll,*.msi | ForEach-Object { signtool verify /pa $_.FullName; if ($LASTEXITCODE) { exit 1 } }
```

## Sources

- [Microsoft, SignTool (verify command)](https://learn.microsoft.com/en-us/windows/win32/seccrypto/signtool)
- [Apple TN2206, macOS Code Signing In Depth](https://developer.apple.com/library/archive/technotes/tn2206/_index.html)

## Related rules

- ENG-11 [Build releases only in CI and verify them before deploy](https://agentwranglers.se/playbook/engineering/build-test-and-deploy/build-in-ci-and-verify.md) in Engineering
- ENG-42 [Make release tags and files immutable](https://agentwranglers.se/playbook/engineering/build-test-and-deploy/immutable-releases.md) in Engineering

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/verify-before-publish">Agent Wranglers desktop apps, extensions and CLIs playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Keep code signing keys in hardware or a signing service](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/signing-keys-in-hardware.md)
- Next: [Sign Linux packages and the repository that serves them](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/linux-package-signing.md)
- [Signing and notarisation](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation.md)