Code Signing

Sign and notarize your zero-native app for distribution.

macOS signing

Sign the bundle with a Developer ID:

zero-native package --target macos --signing identity --identity "Developer ID Application: Your Name"

Signing modes:

Mode	Description
`none`	No signing (default)
`adhoc`	Ad-hoc signing for local testing
`identity`	Sign with a named identity (requires `--identity`)

Signing flags

Flag	Description
`--signing`	Signing mode: `none`, `adhoc`, or `identity`
`--identity`	Code signing identity name
`--entitlements`	Path to entitlements file (e.g. `assets/zero-native.entitlements`)
`--team-id`	Apple Developer Team ID

Notarization

The framework repository includes a zig build notarize helper for local release testing:

zig build notarize

Generated apps should use zero-native package --target macos --signing identity ... unless they add their own notarize build step. This helper does not invoke xcrun notarytool directly. After the signed package is created, submit it for notarization manually:

xcrun notarytool submit zig-out/package/your-app.zip --apple-id "you@example.com" --team-id "TEAMID" --password "@keychain:AC_PASSWORD" --wait
xcrun stapler staple zig-out/package/your-app.app

Chromium apps

Chromium packages include Chromium Embedded Framework.framework inside the .app. Sign and notarize the final package after CEF has been bundled so the app binary, helper executables, and embedded framework are covered by the same distribution identity.

zero-native cef install --version <pinned-version>
zig build
zero-native package --target macos --signing identity --identity "Developer ID Application: Your Name"
hdiutil create -volname "Your App" -srcfolder zig-out/package/your-app.app -ov -format UDZO zig-out/package/your-app.dmg

Use .web_engine = "chromium" and .cef = .{ .dir = "third_party/cef/macos", .auto_install = false } in app.zon for the normal signing path. -Dweb-engine, --web-engine, -Dcef-dir, and --cef-dir remain available for temporary overrides.

If Gatekeeper rejects the app, check that the CEF framework is present in Contents/Frameworks, that every nested helper is signed, and that the package was rebuilt after any CEF version change.

DMG creation

Create a distributable disk image:

zig build dmg

Entitlements

The project includes assets/zero-native.entitlements as a starting point. Customize it for your app's needs (e.g. network access, file system access, camera).