---

name: macos-codesign-workflow description: Execute macOS code signing with Developer ID and hardened runtime requirements allowed-tools: Read, Write, Edit, Bash, Glob, Grep tags: [macos, codesigning, developerid, security, apple] graph: domains: [domain:software-engineering] specializations: [specialization:desktop-development] skillAreas: [skill-area:desktop-system-integration, skill-area:desktop-ui-frameworks] roles: [role:desktop-developer, role:fullstack-engineer] workflows: [workflow:feature-development, workflow:release-management]

macos-codesign-workflow

Execute macOS code signing with Developer ID certificates and hardened runtime. This skill handles the complete code signing process for macOS applications.

Capabilities

• Sign app bundles with Developer ID
• Configure hardened runtime
• Sign nested frameworks and binaries
• Configure entitlements
• Verify signatures
• Set up CI/CD signing
• Handle keychain management

Input Schema

{
  "type": "object",
  "properties": {
    "appPath": { "type": "string" },
    "identity": { "type": "string" },
    "entitlements": { "type": "string" },
    "hardenedRuntime": { "type": "boolean", "default": true }
  },
  "required": ["appPath", "identity"]
}

Signing Commands

# Sign app bundle with hardened runtime
codesign --force --options runtime --timestamp \
    --entitlements MyApp.entitlements \
    --sign "Developer ID Application: Company Name (TEAMID)" \
    MyApp.app

# Sign nested components first
find MyApp.app -name "*.dylib" -o -name "*.framework" | \
    xargs -I {} codesign --force --options runtime --timestamp \
    --sign "Developer ID Application: Company Name (TEAMID)" {}

# Verify signature
codesign --verify --deep --strict --verbose=2 MyApp.app
spctl --assess --type execute --verbose MyApp.app

Related Skills

• macos-notarization-workflow
• macos-entitlements-generator