Apple Code Signing

The apple-codesign Rust crate and its corresponding rcodesign CLI tool implement code signing for Apple platforms.

We believe this crate provides the most comprehensive implementation of Apple code signing outside the canonical Apple tools. We have support for the following features:

• Signing Mach-O binaries (the executable file format on Apple operating systems).

• Signing, notarizing, and stapling directory bundles (e.g. .app directories).

• Signing, notarizing, and stapling XAR archives / .pkg installers.

• Signing, notarizing, and stapling disk images / .dmg files.

What this all means is that you can sign, notarize, and release Apple software from Linux and Windows without needing access to proprietary Apple software!

Other features include:

• Built-in support for using smart cards (e.g. YubiKeys) for signing and key/certificate management.

• Certificate Signing Request (CSR) support to enable arbitrary private keys (including those generated on smart card devices) to be easily exchanged for Apple-issued code signing certificates.

• Support for dumping and diffing data structures related to code signatures.

• Awareness of Apple’s public PKI infrastructure, including CA certificates and custom X.509 extensions and OIDs used by Apple.

• Documentation and code that are likely a treasure trove for others wanting to play with Apple code signing.

The canonical home of this project is https://github.com/indygreg/PyOxidizer/tree/main/apple-codesign. While this project is developed inside a larger monorepository, it is designed to be used as a standalone project.

• Getting Started
  • Installing
  • Obtaining a Code Signing Certificate
  • Installing Apple Transporter for Notarization
  • Obtaining an Apple Connect API Key
• Using rcodesign
  • Signing with sign
  • Notarizing and Stapling
• Managing Code Signing Certificates
  • Apple Code Signing Certificate Flavors
  • Generating Certificates with Xcode
  • Obtaining a Certificate via a Certificate Signing Request
  • Exporting a Code Signing Certificate to a File
  • Using a Self-Signed Certificate
• Smart Card Support
  • Cargo Feature
  • Limitations
  • Validating Smart Card Integration
  • Pointing Commands at a Smart Card Certificate
  • Importing Certificates Into a Smart Card
  • Creating a Certificate with a Private Key Exclusive to the Smart Card
• Concepts
  • Cryptographic Signatures
  • Code Signing
  • Notarization
  • Notarization Ticket
  • Stapling
  • Mach-O Binaries
  • Bundles
  • DMGs / Disk Images
  • XARs / Flat Packages / .pkg Installers
  • Code Signing Certificate
• Known Issues and Limitations
  • Bundle Handling in General
  • Cannot Sign File Contents of DMGs
  • Cannot Recursively Sign Flat Packages (.pkg Installers)
  • Extra Signing or Time-Stamp Token Operations
  • Long Tail of Random Discrepancies from Apple’s Tooling
• How to Debug and Report Problems
  • Commands to Print Signature Info
  • Reporting Actionable Bugs
• A Primer on Gatekeeper
  • The spctl Tool
• Selectively Bypassing Gatekeeper with Custom Assessment Policies
  • Verifying Assessment Policies
  • Allowing Execution of Binaries Signed by a Specific Certificate
  • Allowing Execution of Binaries Signed by a Trusted CA