Skip to content

Auto-update, code signing and notarization #206

Description

@johan-bell

Today. There is none, and every update is a manual re-download.

Builds carry an ad-hoc signature (app-electron/build/after-pack.cjs) but no Developer ID and no notarization, so macOS 15+ blocks a downloaded copy until the user goes through System Settings → Privacy & Security → Open Anyway → a second confirmation → authentication. Right-click → Open no longer works; Apple removed it. Verified on macOS 26.5.2.

Wanted. electron-updater with a published feed, which requires the whole signing story first:

  • macOS: Developer ID Application certificate, hardenedRuntime: true, entitlements, and notarization (notarize in electron-builder, an app-specific password or App Store Connect API key in CI)
  • Windows: an Authenticode certificate (EV or OV; SmartScreen reputation takes time to build with OV)
  • A release feed and hosting for the artifacts, plus publish config in electron-builder.yml
  • Update UX in the renderer: notify, download in the background, and never restart under a running encode


Migrated from Todo.md item 2, which is removed as the repository is prepared to go public.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions