Signing a macOS app签署macOS应用程序

Code signing is a security technology that you use to certify that an app was created by you.代码签名是一种安全技术，用于证明应用程序是由您创建的。

On macOS, there are two layers of security technology for application distribution: code signing and notarization.在macOS上，应用程序分发有两层安全技术：代码签名和公证。

• Code Signing is the act of certifying the identity of the app's author and ensuring it was not tampered with before distribution.代码签名是证明应用程序作者身份并确保其在分发前未被篡改的行为。
• Notarization is an extra verification step where the app is sent to Apple servers for an automated malware scan.公证是一个额外的验证步骤，将应用程序发送到苹果服务器进行自动恶意软件扫描。

Prerequisites先决条件

Installing 安装Xcode

Xcode is Apple's integrated development environment (IDE) for development on macOS, iOS, and other platforms.是苹果的集成开发环境（IDE），用于在macOS、iOS和其他平台上进行开发。

Although Electron does not integrate tightly with the IDE itself, Xcode is a helpful tool for installing code signing certificates (see next section) and is required for notarization.尽管Electron与IDE本身没有紧密集成，但Xcode是安装代码签名证书的一个有用工具（见下一节），并且是公证所必需的。

Obtaining signing certificates获取签名证书

Code signing certificates for macOS apps can only be obtained through Apple by purchasing a membership to the Apple Developer Program.macOS应用程序的代码签名证书只能通过购买苹果开发者计划的会员资格通过苹果获得。

To sign Electron apps, you may require two separate certificates:要签署Electron应用程序，您可能需要两个单独的证书：

• The Developer ID Installer certificate is for apps distributed to the Mac App Store.开发者ID安装程序证书适用于分发到Mac应用商店的应用程序。
• The Developer ID Application certificate is for apps distributed outside the Mac App Store.开发者ID应用程序证书适用于在Mac App Store之外分发的应用程序。

Once you have an Apple Developer Program membership, you first need to install them onto your machine. 一旦你拥有了苹果开发者计划的会员资格，你首先需要将它们安装到你的机器上。We recommend loading them through Xcode.我们建议通过Xcode加载它们。

security find-identity -p codesigning -v

Configuring 配置Forge

In Electron Forge, macOS apps are signed and notarized at the Package step by the electron-packager library. 在Electron Forge中，macOS应用程序在打包步骤由electron-packager库进行签名和公证。There is a separate option within your Forge packagerConfig for each one of these settings.在您的ForgepackagerConfig中，每个设置都有一个单独的选项。

osxSign optionsosxSign选项

To enable code signing on macOS, ensure that packagerConfig.osxSign exists in your Forge configuration.要在macOS上启用代码签名，请确保您的Forge配置中存在packagerConfig.osxSign。

module.exports = {
  packagerConfig: {
    osxSign: {} // object must exist even if empty
  }
};

The osxSign config comes with defaults that work out of the box in most cases, so we recommend you start with an empty configuration object.osxSign配置附带的默认值在大多数情况下都是开箱即用的，因此我们建议您从一个空的配置对象开始。

For a full list of configuration options, see the OsxSignOptions type in the Forge API docs. 有关配置选项的完整列表，请参阅Forge API文档中的OsxSignOptions类型。For more detailed information on how to configure these options, see the @electron/osx-sign documentation.有关如何配置这些选项的更多详细信息，请参阅@electron/osx-sign文档。

Customizing entitlements自定义权利

A common use case for modifying the default osxSign configuration is to customize its entitlements. 修改默认osxSign配置的一个常见用例是自定义其权限。In macOS, entitlements are privileges that grant apps certain capabilities (e.g. access to the camera, microphone, or USB devices). 在macOS中，授权是授予应用程序某些功能的特权（例如访问相机、麦克风或USB设备）。These are stored within the code signature in an app's executable file.这些存储在应用程序的可执行文件中的代码签名中。

By default, the @electron/osx-sign tool comes with a set of entitlements that should work on both MAS or direct distribution targets. 默认情况下，@electron/osx-sign签名工具附带一组权限，这些权限应适用于MAS或直接分发目标。See the complete set of default entitlement files on GitHub.请参阅GitHub上的一整套默认权利文件。

module.exports = {
  // ...
  packagerConfig: {
    // ...
    osxSign: {
      optionsForFile: (filePath) => {
        // Here, we keep it simple and return a single entitlements.plist file.在这里，我们保持简单，并返回一个authoritysplist文件。
        // You can use this callback to map different sets of entitlements to specific files in your packaged app.您可以使用此回调将不同的权限集映射到打包应用程序中的特定文件。
        return {
          entitlements: 'path/to/entitlements.plist'
        };
      }
    }
  }
  // ...
};

For further reading on entitlements, see the following pages in Apple developer documentation:有关权利的进一步阅读，请参阅Apple开发人员文档中的以下页面：

• ​Entitlements​
• ​Hardened Runtime​

osxNotarize options选项

The osxNotarize configuration object can be set up to either use the legacy or notarytool strategies. osxNotarize配置对象可以设置为使用遗留legacy或notarytool策略。If you are using Xcode 13 or higher, we strongly recommend using notarytool. 如果您使用的是Xcode 13或更高版本，我们强烈建议您使用notarytool。The legacy tooling will be removed when Apple sunsets altool (projected for Fall 2023).当苹果日落altool（预计2023年秋季）时，legacy工具将被移除。

The notarytool command has three authentication options, which are detailed below. notarytool命令有三个身份验证选项，详细信息如下。Note that you will want to use a forge.config.js configuration so that you can load environment variables into your Forge config.请注意，您需要使用forge.config.js配置，以便将环境变量加载到Forge配置中。

Option 1: Using an app-specific password选项1：使用特定于应用程序的密码

You can generate an app-specific password from Apple to provide your credentials to notarytool. 你可以从苹果公司生成一个特定于应用程序的密码，向notarytool提供你的凭据。This password will need to be regenerated if you change your Apple ID password.如果您更改Apple ID密码，则需要重新生成此密码。

There are two mandatory fields for osxNotarize if you are using this strategy:如果使用此策略，osxNotarize有两个必填字段：

module.exports = {
  // ...
  packagerConfig: {
    // ...
    osxNotarize: {
      tool: 'notarytool',
      appleId: process.env.APPLE_ID,
      appleIdPassword: process.env.APPLE_PASSWORD,
      teamId: process.env.APPLE_TEAM_ID
    }
  }
  // ...
};

Option 2: Using an App Store Connect API key选项2：使用App Store Connect API密钥

You can generate an App Store Connect API key to authenticate notarytool by going to the App Store Connect access page and using the "Keys" tab. 您可以通过转到App Store Connect访问页面并使用“密钥”选项卡生成App Store Connect API密钥以验证notarytool。This API key will look something like AuthKey_ABCD123456.p8 and can only be downloaded once.此API密钥将类似于AuthKey_ABCD123456.p8，并且只能下载一次。

There are three mandatory fields for osxNotarize if you are using this strategy:如果使用此策略，osxNotarize有三个必填字段：

module.exports = {
  // ...
  packagerConfig: {
    // ...
    osxNotarize: {
      tool: 'notarytool',
      appleApiKey: process.env.APPLE_API_KEY,
      appleApiKeyId: process.env.APPLE_API_KEY_ID,
      appleApiIssuer: process.env.APPLE_API_ISSUER
    }
  }
  // ...
};

Option 3: Using a keychain选项3：使用钥匙扣

Instead of providing environment variables to the Forge config passed to notarytool, you can choose to use a macOS keychain containing either set of credentials (either Option 1 or Option 2 above).您可以选择使用包含任意一组凭据的macOS密钥链（上面的选项1或选项2），而不是向传递给notarytool的Forge配置提供环境变量。

You can do this directly in your terminal via the notarytool store-credentials command. For usage information, you can refer to the man page for notarytool:您可以通过notarytool store-credentials命令直接在终端中执行此操作。有关用法信息，您可以参考notarytool的手册页：

man notarytool

There are two mandatory fields for osxNotarize if you are using this strategy:如果使用此策略，osxNotarize有两个必填字段：

module.exports = {
  // ...
  packagerConfig: {
    // ...
    osxNotarize: {
      tool: 'notarytool',
      keychain: 'my-keychain',
      keychainProfile: 'my-keychain-profile'
    }
  }
  // ...
};

Example configuration配置示例

Below is a minimal Forge configuration for osxSign and osxNotarize.以下是osxSign和osxNotarize的最低Forge配置。

module.exports = {
  packagerConfig: {
    osxSign: {},
    osxNotarize: {
      tool: 'notarytool',
      appleId: process.env.APPLE_ID,
      appleIdPassword: process.env.APPLE_PASSWORD,
      teamId: process.env.APPLE_TEAM_ID
    }
  }
};