Building and Signing Desktop Applications for macOS
macOS requires two levels of verification: Code Signing (developer signature) and Notarization (Apple notarization). Without notarization, Gatekeeper blocks the application with the message "cannot be opened because Apple cannot verify it".
Requirements
- Apple Developer Account ($99/year)
- Developer ID Application Certificate
- Xcode Command Line Tools
Electron: build and signing
// electron-builder.yml
mac:
target:
- target: dmg
- target: zip
icon: build/icon.icns
category: public.app-category.productivity
hardenedRuntime: true
gatekeeperAssess: false
entitlements: build/entitlements.mac.plist
entitlementsInherit: build/entitlements.mac.plist
identity: "Developer ID Application: Company Name (TEAM_ID)"
<!-- build/entitlements.mac.plist -->
<?xml version="1.0" encoding="UTF-8"?>
<plist version="1.0">
<dict>
<key>com.apple.security.cs.allow-jit</key><true/>
<key>com.apple.security.cs.allow-unsigned-executable-memory</key><true/>
<key>com.apple.security.cs.allow-dyld-environment-variables</key><true/>
<key>com.apple.security.network.client</key><true/>
</dict>
</plist>
Notarization
# Via notarytool (Xcode 13+)
xcrun notarytool submit AppName.dmg \
--apple-id "[email protected]" \
--password "@keychain:AC_PASSWORD" \
--team-id "TEAM_ID" \
--wait
# Stapling (embedding notarization ticket into file)
xcrun stapler staple AppName.dmg
GitHub Actions for macOS
- uses: actions/checkout@v3
- name: Import Certificate
run: |
echo "$MACOS_CERTIFICATE" | base64 --decode > certificate.p12
security import certificate.p12 -P "$MACOS_CERTIFICATE_PWD" \
-A -t cert -f pkcs12 -k ~/Library/Keychains/login.keychain
- name: Build and Sign
run: npm run build:mac
env:
APPLE_ID: ${{ secrets.APPLE_ID }}
APPLE_ID_PASS: ${{ secrets.APPLE_ID_PASS }}
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
CSC_LINK: ${{ secrets.MACOS_CERTIFICATE }}
CSC_KEY_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PWD }}
Universal Binary (Intel + Apple Silicon)
# electron-builder automatically creates universal binary
npx electron-builder --mac --universal
Universal binary runs natively on M1/M2/M3 without Rosetta 2.
Timeline
Setup of build, signing, and notarization: 3–4 business days.