@electron/osx-sign Documentation

When migrating from the legacy electron-osx-sign package to @electron/osx-sign, you should adopt the new API surface and defaults to ensure a more secure and safe application.

If you need to maintain identical behavior to your old configuration, you must map the old flat options object to the new structure. Key changes include:

• Entitlements: The specific flags 'entitlements-inherit' and 'entitlements-loginhelper' have been removed. Instead, use the optionsForFile callback to return specific entitlements for different files.
• Signature Flags: The 'restrict' flag has been removed; use optionsForFile.signatureFlags instead.
• Signature Size: The 'signature-size' option has been removed.
• Naming Conventions: Many keys have moved from kebab-case (e.g., identity-validation) to camelCase (e.g., identityValidation).

const oldOptions = {
  app: 'path/to/app',
  binaries: ['a', 'b'],
  entitlements: 'path/to/entitlements',
  'entitlements-inherit': 'path/to/inherited-entitlements', // Removed, use optionsForFile.entitlements
  'entitlements-loginhelper': 'path/to/login-entitlements', // Removed, use optionsForFile.entitlements
  entitlementsForFile: (filePath, codesignArgs) => 'path/to/different-entitlements',
  'gatekeeper-assess': true,
  hardenedRuntime: true,
  identity: 'My Identity',
  'identity-validation': false,
  keychain: 'Login.keychain',
  ignore: /bad-files/,
  platform: 'darwin',
  'pre-auto-entitlements': true,
  'pre-embed-provisioning-profile': true,
  provisioning-profile: 'path/to/provisioning-profile',
  requirements: 'custom-requirements',
  restrict: true, // Removed, use optionsForFile.signatureFlags
  'signature-flags': 'foo,bar,thing',
  'signature-size': 12000, // Removed
  'strict-verify': true,
  timestamp: 'https://timestamp-server',
  type: 'distribution',
  version: '1.2.3',
}

const newOptions = {
  app: oldOptions.app,
  binaries: oldOptions.binaries,
  optionsForFile: (filePath) => ({
    // Ensure you return the right entitlements path here based on the file being signed.
    // E.g. The Login Helper should get oldOptions['entitlements-loginhelper']
    entitlements: getEntitlementsForFile(filePath),
    hardenedRuntime: oldOptions.hardenedRuntime,
    signatureFlags: oldOptions['signature-flags'],
    timestamp: oldOptions.timestamp,
  }),
  identity: oldOptions.identity,
  identityValidation: oldOptions['identity-validation'],
  keychain: oldOptions.keychain,
  ignore: oldOptions.ignore,
  platform: oldOptions.platform,
  preAutoEntitlements: oldOptions['pre-auto-entitlements'],
  preEmbedProvisioningProfile: oldOptions['pre-embed-provisioning-profile'],
  provisioningProfile: oldOptions['provisioning-profile'],
  strictVerify: oldOptions['strict-verify'],
  type: oldOptions.type,
  version: oldOptions.version,
}

When signing for the Mac App Store, you must provide a Provisioning Profile. Use the following options:

• platform: Set to "mas" (auto-detected if using Packager/Forge).
• type: Set to "distribution" (default) for App Store Connect submission.
• provisioningProfile: Path to your .provisionprofile (defaults to current working directory).
• keychain: Name of the keychain (defaults to system default login keychain).

Note on running distribution builds locally: By default, @electron/osx-sign adds com.apple.developer.team-identifier to a temporary copy of your entitlements, which prevents the app from running locally. To allow local execution, set preAutoEntitlements: false and manually add ElectronTeamID to your Info.plist and com.apple.security.application-groups to your entitlements file.

import { sign } from '@electron/osx-sign'
const opts = {
  app: 'path/to/my.app',
  platform: "mas",
  type: "distribution",
  provisioningProfile: 'path/to/my.provisionprofile',
  keychain: 'my-keychain',
};
sign(opts)
  .then(() => {
    // Application signed
  })
  .catch((err) => {
    // Handle error
  });