Overview of Code Signing for Quarto Installers
mainQuarto installers are code-signed and (on macOS) notarized during the official Build Installers workflow (triggered via create-release.yml).
Signing is reserved for official releases. Local builds using quarto-bld will skip the signing process if the required environment variables or secrets are missing.
Key behaviors:
- macOS: If the
Application Developer Idis missing, the build will printwarning: Missing Application Developer Id, not signingand proceed without signing. - Windows: The signing step is gated by repository secrets that are only resolvable by the Apple keychain action and
DigiCert smctlduring official release workflows.