Code Signierung

Code signing is a security technology to certify that an app was created by you. You should sign your application so it does not trigger any operating system security warnings.

Both Windows and macOS prevent users from running unsigned applications. It is possible to distribute applications without codesigning them - but in order to run them, users need to go through multiple advanced and manual steps.

Wenn Sie eine Elektron-App erstellen, die Sie zu verpacken und zu verteilen beabsichtigen, sollte es Code signiert sein. The Electron ecosystem tooling makes codesigning your apps straightforward - this documentation explains how to sign your apps on both Windows and macOS.

Signing & notarizing macOS builds

Preparing macOS applications for release requires two steps: First, the app needs to be code signed. Then, the app needs to be uploaded to Apple for a process called notarization, where automated systems will further verify that your app isn't doing anything to endanger its users.

To start the process, ensure that you fulfill the requirements for signing and notarizing your app:

1. Enroll in the Apple Developer Program (requires an annual fee)
2. Download and install Xcode - this requires a computer running macOS
3. Generate, download, and install signing certificates

Electron's ecosystem favors configuration and freedom, so there are multiple ways to get your application signed and notarized.

Using Electron Forge

If you're using Electron's favorite build tool, getting your application signed and notarized requires a few additions to your configuration. Forge is a collection of the official Electron tools, using @electron/packager, @electron/osx-sign, and @electron/notarize under the hood.

Detailed instructions on how to configure your application can be found in the Signing macOS Apps guide in the Electron Forge docs.

Using Electron Packager

If you're not using an integrated build pipeline like Forge, you are likely using @electron/packager, which includes @electron/osx-sign and @electron/notarize.

If you're using Packager's API, you can pass in configuration that both signs and notarizes your application. If the example below does not meet your needs, please see @electron/osx-sign and @electron/notarize for the many possible configuration options.

const packager = require('@electron/packager')

packager({
  dir: '/path/to/my/app',
  osxSign: {},
  osxNotarize: {
    appleId: 'felix@felix.fun',
    appleIdPassword: 'my-apple-id-password'
  }
})

Signing Mac App Store applications

See the Mac App Store Guide.

Signing Windows builds

Using Azure Artifact Signing

Azure Artifact Signing (formerly known as Azure Trusted Signing) is Microsoft's modern cloud-based signing service. It is the cheapest option for code signing on Windows, and it gets rid of SmartScreen warnings.

Azure Artifact Signing is currently limited to developers in certain countries. Please refer to the Artifact Signing documentation to see if Artifact Signing is available in your country.

Using jsign for Azure Artifact Signing

For developers on Linux or macOS, jsign can be used to sign Windows apps via Azure Artifact Signing. Example usage:

jsign --storetype TRUSTEDSIGNING \
      --keystore https://eus.codesigning.azure.net/ \
      --storepass $AZURE_ACCESS_TOKEN \
      --alias trusted-sign-acct/AppName \
      --tsaurl http://timestamp.acs.microsoft.com/ \
      --tsmode RFC3161 \