Code Signing

[dex4er]

Regarding https://www.electron.build/code-signing.html and https://www.electronforge.io/guides/code-signing/code-signing-macos#osxnotarize-options

We need certificates both for Windows and for MacOS.

We need to store them in GitHub secrets:

WIN_CSC_LINK and WIN_CSC_KEY_PASSWORD for Windows.
CSC_LINK and CSC_KEY_PASSWORD for Mac
also APPLEID, APPLEIDPASS, APPLETEAMID for Mac

Both here in https://github.com/freelensapp/freelens and https://github.com/freelensapp/freelens-nightly-builds

[robertobandini]

Ok @dex4er I'll start today about Apple signing and then I'll continue with Windows.

[robertobandini]

Links:

• https://www.electron.build/code-signing.html
• https://www.electronforge.io/guides/code-signing/code-signing-macos#osxnotarize-options
• https://www.electronjs.org/docs/latest/tutorial/code-signing
• ...

[robertobandini]

Actually I'm waiting an answer by Apple support to complete the process about enrolling to their developer program.
Meanwhile I'll check more about Windows signing.

[dex4er]

More links about Windows:

• Update Docs for cloud-based EV code signing electron/forge#3617
• https://melatonin.dev/blog/how-to-code-sign-windows-installers-with-an-ev-cert-on-github-actions/
• https://icedev.pl/posts/setting-up-ev-code-signing-google-hsm-fips-140-2/
• https://melatonin.dev/blog/code-signing-on-windows-with-azure-trusted-signing/
• https://github.com/azure/trusted-signing-action

It looks like Azure has service for €8.95/month that might be used directly from GitHub, however it is OV, not EV certificate.

https://codesigningsolution.com/the-differences-between-ev-and-ov-code-signing-certificates/

[robertobandini]

More links about Windows:

• Update Docs for cloud-based EV code signing electron/forge#3617
• https://melatonin.dev/blog/how-to-code-sign-windows-installers-with-an-ev-cert-on-github-actions/
• https://icedev.pl/posts/setting-up-ev-code-signing-google-hsm-fips-140-2/
• https://melatonin.dev/blog/code-signing-on-windows-with-azure-trusted-signing/
• https://github.com/azure/trusted-signing-action

It looks like Azure has service for €8.95/month that might be used directly from GitHub, however it is OV, not EV certificate.

https://codesigningsolution.com/the-differences-between-ev-and-ov-code-signing-certificates/

Thank you very much I'll check asap!
Apple has answered with a generic first email, maybe today or tomorrow I'll try again by app on iPhone, let's see.

[dex4er]

I'm closing it: singned packages are provided for MacOS as it's antivirus is not easy to override and Windows packages can be forced to install so we can sign them later.