Skip to main content

Interface: ElectronSignOptions

Signing options passed to @electron/osx-sign. Electron-builder owns the fields it must control itself — app, keychain, platform, version, optionsForFile, and type (derived from the build flavor: mas-dev → development, otherwise distribution) — and forwards everything else.

Additionally exposes a small set of per-file convenience fields that electron-builder maps internally through optionsForFile.

See​

https://packages.electronjs.org/osx-sign

Extends​

  • Omit<OnlySignOptions, "optionsForFile" | "version" | "type">

Properties​

additionalArguments?​

readonly optional additionalArguments?: string[] | null

Extra arguments passed to each codesign invocation.

Example​

["--deep"]

batchCodesignCalls?​

optional batchCodesignCalls?: boolean

Experimental

Combine all files with identical CLI arguments in a single codesign call instead of running codesign once for each of those files. This minimizes the number of child processes that need to be spawned and reduces the time it takes to sign all files.

Default Value​

false

Inherited from​

Omit.batchCodesignCalls

binaries?​

optional binaries?: string[]

Array of paths to additional binaries that will be signed along with built-ins of Electron.

Default Value​

undefined

Inherited from​

Omit.binaries

entitlements?​

readonly optional entitlements?: string | null

Path to the main app entitlements file. Falls back to build/entitlements.mac.plist if it exists, then to @electron/osx-sign's built-in defaults.

entitlementsInherit?​

readonly optional entitlementsInherit?: string | null

Path to child entitlements inherited by embedded frameworks and bundles. Falls back to build/entitlements.mac.inherit.plist if it exists.

entitlementsLoginHelper?​

readonly optional entitlementsLoginHelper?: string | null

Path to entitlements for the Login Helper. Required when using App Sandbox, because the Login Helper cannot inherit entitlements. Defaults to the value of entitlements.

hardenedRuntime?​

readonly optional hardenedRuntime?: boolean

Whether to enable Hardened Runtime.

Hardened Runtime is a prerequisite for notarization (mandatory on macOS 10.15+). Defaults to true for darwin builds and false for mas-dev.

See​

https://github.com/electron/fuses

identity?​

readonly optional identity?: string | null

The signing identity (certificate name or SHA-1 hash). Applies to both app signing and DMG signing. Prefer the environment variables CSC_LINK / CSC_NAME over hardcoding this value.

  • Not set (default): electron-builder searches the keychain for a valid certificate.
  • null: skip signing entirely.
  • "-": ad-hoc signing (requires disabling library validation — see hardenedRuntime).

identityValidation?​

optional identityValidation?: boolean

Flag to enable/disable validation for the signing identity. If enabled, the SignOptions.identity | identity provided will be validated in the BaseSignOptions.keychain | keychain specified.

Default Value​

true

Inherited from​

Omit.identityValidation

ignore?​

optional ignore?: string | string[] | ((file) => boolean)

Defines files that will be skipped during the code signing process. This property accepts a regex, function or an array of regexes and functions. Elements of other types are treated as RegExp.

File paths matching a regex or returning a true value from a function will be ignored.

Default Value​

undefined

Inherited from​

Omit.ignore

preAutoEntitlements?​

optional preAutoEntitlements?: boolean

Flag to enable/disable entitlements automation tasks necessary for code signing most Electron apps.

  • Adds com.apple.security.application-groups to the entitlements file
  • Fills in the ElectronTeamID property in Info.plist with the provisioning profile's Team Identifier or by parsing the identity name.

Default Value​

true

Inherited from​

Omit.preAutoEntitlements

preEmbedProvisioningProfile?​

optional preEmbedProvisioningProfile?: boolean

Flag to enable/disable the embedding of a provisioning profile into the app's Contents folder. Will use the profile from OnlySignOptions.provisioningProfile if provided. Otherwise, it searches for a .provisionprofile file in the current working directory.

Default Value​

true

Inherited from​

Omit.preEmbedProvisioningProfile

provisioningProfile?​

optional provisioningProfile?: string

Path to a provisioning profile, which can be used to grant restricted entitlements to your app.

See Apple Documentation for more details.

Inherited from​

Omit.provisioningProfile

requirements?​

readonly optional requirements?: string | null

Path to a requirements file. Not applicable for MAS.

strictVerify?​

optional strictVerify?: string | boolean

Flag to enable/disable the --strict flag when verifying the signed application bundle. Also supports string values to specify which strict restrictions to use, see codesign man page for supported values.

Default Value​

true

Inherited from​

Omit.strictVerify

timestamp?​

readonly optional timestamp?: string | null

URL of the timestamp authority server. Passed per-file to codesign --timestamp=<url>.