sign-app

Self-sign macOS apps/binaries from CLI using codesign.

Requirements

• macOS
• Xcode Command Line Tools (xcrun, codesign)
• Node.js 18+

Usage with bunx / npx

npx -y @0x0a0d/sign-app@latest -x "/Applications/My App.app"

bunx @0x0a0d/sign-app@latest -x "/Applications/My App.app"

bunx @0x0a0d/sign-app@latest --list

bunx @0x0a0d/sign-app@latest "/Applications/My App.app" --clear-quarantine

bunx @0x0a0d/sign-app@latest "/Applications/My App.app" --sudo-xattr

bunx @0x0a0d/sign-app@latest "/Applications/My App.app" --yes

You can also pass any existing file/folder path (not only .app).

Safety warning

• Code signing can increase the trust level of an app on macOS.
• Only sign software you built yourself or fully trust.
• Never sign unknown binaries from untrusted sources.
• By default, the CLI asks for Y/n confirmation after printing warnings.
• For non-interactive environments, use --yes (or --quiet).

Options

-i, --identity <value>       Identity passed to codesign (default: -)
-e, --entitlements <path>    Entitlements plist file
-q, --quiet                  Disable safety warning before signing
-y, --yes                    Skip Y/n confirmation after warning
-l, --list                   List signing identities and available entitlements
-x, --clear-quarantine       Run xattr -rd com.apple.quarantine before signing
    --sudo-xattr             Run quarantine cleanup as: sudo xattr -rd com.apple.quarantine
    --no-verify              Skip post-sign verification
    --dry-run                Print commands only, do not execute
-h, --help                   Show help

Local development

npm install
npm run check
npm run build
node dist/cli.js "/Applications/My App.app"