Code signing

Code signing is a digital signature on the app made with a developer certificate. The system uses it to check who published the app and that it was not changed afterwards. macOS will not open an unsigned app the usual way, and Windows shows a SmartScreen warning about an unknown publisher. This is an overview lesson: the certificates themselves are bought and set up outside Electron.

What signing gives

System	Unsigned	Signed
macOS	A message that the app cannot be opened because the developer cannot be verified	The app opens normally
Windows	A blue SmartScreen window "Windows protected your PC"	The publisher name in the install window, and over time no warnings
Updates	Auto-update does not work on macOS	Works

macOS: signing and notarization

macOS needs:

Membership in the Apple Developer Program (a paid subscription).
A Developer ID Application certificate installed in the Mac's keychain.
Notarization — sending the build to Apple for an automated check.

Forge does both steps during the build when configured:

// forge.config.js
module.exports = {
  packagerConfig: {
    osxSign: {},
    osxNotarize: {
      appleId: process.env.APPLE_ID,
      appleIdPassword: process.env.APPLE_PASSWORD,
      teamId: process.env.APPLE_TEAM_ID,
    },
  },
};

An empty osxSign object means "sign with the keychain certificate using default settings". appleIdPassword is not your normal password but an app-specific password created in your Apple account. Signing and notarizing work only on a Mac.

Windows: an Authenticode certificate

For Windows you buy a code signing certificate from a certificate authority or use cloud signing such as Azure Trusted Signing. A certificate as a .pfx file is given to the Squirrel maker:

// forge.config.js
module.exports = {
  makers: [
    {
      name: '@electron-forge/maker-squirrel',
      config: {
        certificateFile: './certs/notes.pfx',
        certificatePassword: process.env.CERTIFICATE_PASSWORD,
      },
    },
  ],
};

After npm run make the installer and the app inside it are signed. The properties of Setup.exe in Explorer show a Digital Signatures tab with the publisher name.

Signing in CI

When building in GitHub Actions, the certificate and passwords are kept in repository secrets and passed to the build as environment variables. That is why the config above has no passwords — only process.env.

Common mistake

Never write the certificate password or Apple ID straight into forge.config.js or commit the .pfx file to Git. Anyone who sees the repository could sign malware with your name. Keep secrets in environment variables and add the certs/ folder to .gitignore.

Thanks for reading!