Signing
Signing puts your company’s name on the apps almyty builds for you. When someone installs your assistant’s desktop or terminal app, their computer checks who published it; a signed app names you, an unsigned one shows a warning or “Unknown publisher”. For example, a signed Mac app opens without the “cannot be checked for malicious software” warning.
You sign with your own code-signing certificate: a file your company gets from Apple, or from a certificate company for Windows, that proves an app comes from you.
Sign an app
- On Credentials, add a code-signing credential: the certificate file (
.p12or.pfx) and its password. For Mac apps, add your App Store Connect key too, so the app can also be notarised (checked and approved by Apple). - On the desktop or terminal app’s channel page, pick that credential under Sign with.
- Click Build.
If you pick nothing, the app is built unsigned and the page says so. almyty never picks a certificate for you.
A half-filled certificate credential is refused when you save it, rather than producing an app that looks signed and is not.
What happens on each platform
| Platform | What happens | Result |
|---|---|---|
| macOS | signed, notarised by Apple, and the approval attached to the app | opens without a warning |
| Windows | signed, with a trusted timestamp | shows your name as publisher instead of “Unknown” |
| Linux | nothing to sign | unaffected |
Worth knowing:
- Signed is not the same as notarised on a Mac. Macs check the notarisation, not just the signature, so a signed but un-notarised app still warns on download. That is why Mac signing needs both your Developer ID certificate and an App Store Connect key. A build tells you when it is signed but not notarised.
- A build says what actually happened. If the app was built but could not be signed, you still get the file, with a sentence explaining why it is unsigned. A build only fails when there is no usable app.
- You are told before, not after. The page shows what will be unsigned before you build, so you learn that Macs will refuse the app before you send the link to two hundred people.
How your certificate is protected
Whoever holds your certificate can publish software as you, so almyty treats it like a password. It is stored encrypted, like every other key. During a build it is placed on the build machine only for that one build, removed before anything else is cleaned up, and never shown in the build log you see.
For developers
macOS apps are signed with a hardened runtime, notarised and stapled. Windows executables are signed with an RFC 3161 trusted timestamp.