Code Signing
OS X and Windows code signing is supported. Windows is dual code-signed (SHA1 & SHA256 hashing algorithms).
On a development machine set environment variable CSC_NAME (and CSC_INSTALLER_NAME if you build for Mac App Store) to your identity.
| Env name | Description |
|---|---|
CSC_LINK |
The HTTPS link (or base64-encoded data) to certificate (*.p12 file). |
CSC_KEY_PASSWORD |
The password to decrypt the certificate given in CSC_LINK. |
CSC_INSTALLER_LINK |
osx-only The HTTPS link (or base64-encoded data) to certificate to sign Mac App Store build (*.p12 file). |
CSC_INSTALLER_KEY_PASSWORD |
osx-only The password to decrypt the certificate given in CSC_INSTALLER_LINK. |
CSC_NAME |
osx-only Name of certificate (to retrieve from login.keychain). Useful on a development machine (not on CI). |
CSC_INSTALLER_NAME |
osx-only Name of installer certificate (to retrieve from login.keychain). Useful on a development machine (not on CI). |
export CSC_NAME="Developer ID Application: Your Name (code)"
To sign app on build server you need to set CSC_LINK, CSC_KEY_PASSWORD (and CSC_INSTALLER_LINK, CSC_INSTALLER_KEY_PASSWORD if you build for Mac App Store):
- Export certificate. Strong password must be used. Consider to not use special characters (for bash) because “values are not escaped when your builds are executed”.
- Upload
*.p12file (e.g. on Google Drive). - Set (Travis or AppVeyor)
CSC_LINKandCSC_KEY_PASSWORDenvironment variables:
travis encrypt "CSC_LINK='https://drive.google.com/uc?export=download&id=***'" --add
travis encrypt 'CSC_KEY_PASSWORD=beAwareAboutBashEscaping!!!' --add
StartSSL is recommended. It can be used to sign OS X app also, so, you don't need to buy Apple Certificate in addition (please note, it works, but we are waiting official confirmation).
