Code Signing & Notarization

"An unsigned app isn't 'less polished' — to a modern OS it's 'possibly malware,' and it acts accordingly."

Why Signing Isn't Optional

Modern operating systems guard against unsigned code. On macOS, Gatekeeper blocks an unsigned app with a scary dialog (or refuses to open it at all); on Windows, SmartScreen warns users away. Code signing attaches a cryptographic identity proving who published the app, so the OS — and the user — can trust it. For anything you distribute outside an app store, signing is effectively required, not a nice-to-have.

macOS Needs Two Steps: Sign + Notarize

macOS is the strictest. First you sign with a Developer ID certificate (an Apple Developer account, ~$99/yr). Then you notarize: upload the signed app to Apple, which scans it for malware and issues a ticket the app gets 'stapled' to. Without notarization, even a signed app is blocked by default on current macOS. Tauri can run notarization for you when you provide the Apple credentials as environment variables — typically in CI, never hardcoded.

Windows and the CI Reality

Windows signing uses a code-signing certificate (increasingly an EV or cloud-HSM-backed one). Linux generally doesn't require signing for AppImage/deb, though repositories have their own signing. The practical pattern across all of this: signing identities and Apple credentials live as CI secrets, and your release workflow signs and notarizes automatically. You never want releases to depend on one developer's laptop holding the only copy of a signing identity.

Code

macOS signing/notarization via env (CI secrets)·bash

# macOS: the credentials Tauri uses to sign + notarize (set in CI, not in code).
export APPLE_CERTIFICATE="<base64 of your .p12>"
export APPLE_CERTIFICATE_PASSWORD="<password>"
export APPLE_SIGNING_IDENTITY="Developer ID Application: Your Name (TEAMID)"
export APPLE_ID="you@example.com"
export APPLE_PASSWORD="<app-specific password>"   # for notarization
export APPLE_TEAM_ID="TEAMID"

npm run tauri build   # signs and notarizes when these are present

Exercise

Write the signing plan for the OS you'd ship first. For macOS: what account, what certificate, and the two steps (sign + notarize). For Windows: what kind of certificate and what SmartScreen does without it. Then state where each secret would live (hint: not in your repo). You're mapping the trust layer that turns a binary into something users can open without fear.

Hint

macOS: Apple Developer account → Developer ID cert → sign → notarize (upload to Apple) → staple. Windows: code-signing cert (EV builds reputation faster). Secrets go in CI's encrypted store, referenced as env vars at build time.