223
code signing
also notarization, Gatekeeper, Authenticode
The OS checks who signed the binary. Unsigned apps are blocked, not just warned, on current systems.
What is code signing?
Code signing attaches an identity to the app. macOS then wants notarization and a stapled ticket so Gatekeeper can check it offline. Windows uses Authenticode so SmartScreen is not a brick wall. Auto-update only works if the new build is signed by the same identity.
Why does code signing matter when vibe coding?
A generated release is a zip of an unsigned binary. It runs on the author machine and fails on the first other Mac. The fix attempted in chat is “right-click, Open,” which is not a release.
How do you do code signing?
Sign every build you hand to someone else. Notarize macOS builds. Use the same certificate the updater expects. Do not commit the certificate or the password.
How do you ask a model for code signing?
Sign (app) with the release identity and notarize the macOS build. Staple the ticket. Do not disable Gatekeeper. Do not put the certificate in the repo.
What goes wrong with code signing?
Signing the app and not the nested helpers, frameworks, or the updater. One unsigned piece fails the check.