zsign

Follow the platform-specific instructions to build zsign from source.

macOS

Requires pkg-config and openssl via Homebrew.

Linux

Ubuntu / Debian

Requires git, g++, pkg-config, and libssl-dev.

RHEL / CentOS / Alma / Rocky

Install epel-release first, then install git, gcc-c++, pkg-config, and openssl-devel.

Windows

Open build/windows/vs2022/zsign.sln in Visual Studio 2022 and build.

# macOS
brew install pkg-config openssl
git clone https://github.com/zhlynn/zsign.git
cd zsign/build/macos
make clean && make

# Ubuntu / Debian
sudo apt-get install -y git g++ pkg-config libssl-dev
git clone https://github.com/zhlynn/zsign.git
cd zsign/build/linux
make clean && make

You can inject dynamic libraries (.dylib) into Mach-O binaries using zsign.

• Use -l, --dylib to inject a dylib via LC_LOAD_DYLIB.
• Use -w, --weak to inject via LC_LOAD_WEAK_DYLIB.
• Use -P, --inject_extensions to ensure the dylib is also injected into app extensions (PlugIns/*.appex). When using -P, the dylib is kept at the app root and referenced by extensions via a relative path (@executable_path/../../<dylib>).

zsign allows editing several bundle properties during the signing process:

• -b, --bundle_id: Set a new bundle identifier.
• -n, --bundle_name: Set a new display name.
• -r, --bundle_version: Set a new bundle version.
• -M, --min_version: Set MinimumOSVersion in Info.plist.
• -I, --icon: Replace the primary app icon with a new PNG.
• -E, --rm_extensions: Remove all app extensions.
• -W, --rm_watch: Remove watch app from the bundle.
• -U, --rm_uisd: Remove UISupportedDevices from Info.plist.
• -S, --enable_docs: Enable UISupportsDocumentBrowser and UIFileSharingEnabled (Files app integration).

Use zsign to re-sign .ipa packages, Mach-O binaries, or .app bundles using a private key/p12 file and a provisioning profile.

Key Options:

• -k, --pkey: Path to private key or p12 file (PEM or DER).
• -m, --prov: Path to provisioning profile (use multiple -m for extensions).
• -o, --output: Path to the output .ipa file.
• -p, --password: Password for the p12 file.
• -z, --zip_level: Compression level (0-9).
• -f, --force: Force signing without using the .zsign_cache.

On RHEL-based systems, first install epel-release, then install the required build dependencies using yum, and build using make in the Linux build directory.

sudo yum -y install epel-release
sudo yum install -y git gcc-c++ pkg-config openssl-devel
git clone https://github.com/zhlynn/zsign.git
cd zsign/build/linux
make clean && make

The -C, --check flag allows you to inspect certificates in .ipa, .p12, .mobileprovision, .cer, .pem, or Mach-O binaries. It performs an OCSP revocation check against Apple's servers. It reads binaries directly from inside IPA files without requiring extraction.

# Check an IPA
zsign -C demo.ipa

# Check a provisioning profile
zsign -C dev.mobileprovision

# Check a P12/PFX certificate
zsign -C dev.p12 -p 123

# Sign and verify certificate before archiving
zsign -C -k dev.p12 -p 123 -m dev.prov -o output.ipa demo.ipa

On Ubuntu or Debian, install git, g++, pkg-config, and libssl-dev via apt, then build using make in the Linux build directory.

sudo apt install -y git g++ pkg-config libssl-dev
git clone https://github.com/zhlynn/zsign.git
cd zsign/build/linux
make clean && make

To build zsign on macOS, you need pkg-config and openssl. Use Homebrew to install dependencies, then clone the repository and build using make in the macOS build directory.

brew install pkg-config openssl
git clone https://github.com/zhlynn/zsign.git
cd zsign/build/macos
make clean && make

Use the -x, --metadata flag to extract Info.plist fields and the app icon to a directory. This will output a metadata.json file and a PNG file (Apple-optimized CgBI icons are automatically converted to standard PNG).

zsign -k dev.p12 -p 123 -m dev.prov -x ./metadata -o output.ipa demo.ipa

You can change the application's metadata during signing using the -b (Bundle ID) and -n (Display Name) flags.

zsign -k dev.p12 -p 123 -m dev.prov -b 'com.new.bundle.id' -n 'NewName' -o output.ipa demo.ipa

Use the -a flag to perform an ad-hoc signature, which does not require a developer certificate.

zsign -a -o output.ipa demo.ipa