# Manual macOS code signing **URL:** \ **Category:** Build Environment\ **Tags:** macos\ **Created:** [May 27, 2018, 1:38am UTC](https://discuss.circleci.com/t/manual-macos-code-signing/22587 "2018-05-27T01:38:41Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![hotel](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/hotel/32/18479_2.png) [@hotel](https://discuss.circleci.com/u/hotel)\ **Post date:** [May 27, 2018, 1:38am UTC](https://discuss.circleci.com/t/manual-macos-code-signing/22587/1 "2018-05-27T01:38:41Z")
Hi, From the documentation, I see that it’s possible to sign xcode/iOS projects using Fastlane. However, I intend to distribute a pkg installer, which needs to be signed with the productbuild command-line utility. The problem is, productbuild requires that both the certificate and private key be available on the keychain, and as far as I can tell, the only files circleCI will handle in the code signing section are the private keys (.p12) and mobileprovision files (which don’t help me in this case). So the question is: is it at all possible to manually sign code? If not, are there any suggested workarounds? ---
**Author:** ![halfer](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/halfer/32/9083_2.png) [@halfer](https://discuss.circleci.com/u/halfer)\ **Post date:** [May 27, 2018, 3:31pm UTC](https://discuss.circleci.com/t/manual-macos-code-signing/22587/2 "2018-05-27T15:31:17Z")
I don’t know Xcode, but are you able to do this operation locally? If so, it should be possible to do it. What binary would one use? ---
**Author:** ![hotel](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/hotel/32/18479_2.png) [@hotel](https://discuss.circleci.com/u/hotel)\ **Post date:** [May 27, 2018, 5:24pm UTC](https://discuss.circleci.com/t/manual-macos-code-signing/22587/3 "2018-05-27T17:24:29Z")
I’m not sure what you mean-- I’m not using Xcode. macOS has a set of command-line tools for building pkg installers for things that are meant to be distributed without going through the app store, namely `pkgbuild` and `productbuild`. The output of `productbuild` is a .pkg file that users are able to run in the same way a windows user might run an installer. By default though, macOS blocks users from running unsigned installers. To sign the installer, it seems is necessary that both a certificate (presumably .cer file) and a corresponding private key (.p12 file) are accessible in a keychain (see [this page](https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man1/productsign.1.html)). My problem is that I believe circleci handles the files uploaded on the code signing page in a special way, assuming that most people are going to be developing for iOS (which I’m not). Am I misunderstanding that? Can I just upload my cert there as well and have everything Just Work™? ---
**Author:** ![hotel](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/hotel/32/18479_2.png) [@hotel](https://discuss.circleci.com/u/hotel)\ **Post date:** [May 27, 2018, 5:34pm UTC](https://discuss.circleci.com/t/manual-macos-code-signing/22587/4 "2018-05-27T17:34:11Z")
Another way to phrase the question might be to ask how people sign .app bundles using circleci, given that the process is fairly similar (as far as I can tell) ---
**Author:** ![halfer](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/halfer/32/9083_2.png) [@halfer](https://discuss.circleci.com/u/halfer)\ **Post date:** [May 28, 2018, 8:17pm UTC](https://discuss.circleci.com/t/manual-macos-code-signing/22587/5 "2018-05-28T20:17:40Z")
I can’t shed any light on this, as I don’t use this technology. However, since CI really is just a VPS, it should Just Work. I would therefore reiterate my earlier question, which is: are you able to do this operation locally? If so, what command do you issue? ---
**Author:** ![hotel](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/hotel/32/18479_2.png) [@hotel](https://discuss.circleci.com/u/hotel)\ **Post date:** [May 28, 2018, 8:30pm UTC](https://discuss.circleci.com/t/manual-macos-code-signing/22587/6 "2018-05-28T20:30:33Z")
the command is `productsign`, as I mentioned in my post above. _running_ the command is not the issue- the issue lies in identity storage, as Apple expects certain files to be stored in certain places. my question is really only about how I can store the proper files in the proper keychain with circleCI (or whether this is possible) ---
**Author:** ![nickgsc](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/nickgsc/32/15856_2.png) [@nickgsc](https://discuss.circleci.com/u/nickgsc)\ **Post date:** [May 31, 2018, 3:30am UTC](https://discuss.circleci.com/t/manual-macos-code-signing/22587/7 "2018-05-31T03:30:55Z")
I don’t know anything about building Mac apps, but it seems like you could still use [fastlane match](https://docs.fastlane.tools/actions/match/) to manage your signing/keychain requirements There’s a handy helper action called [setup\_circle\_ci](https://docs.fastlane.tools/best-practices/continuous-integration/#circleci-integration) which automatically builds an empty keychain for you that match can then populate ---
**Author:** ![hotel](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/hotel/32/18479_2.png) [@hotel](https://discuss.circleci.com/u/hotel)\ **Post date:** [June 3, 2018, 7:05pm UTC](https://discuss.circleci.com/t/manual-macos-code-signing/22587/8 "2018-06-03T19:05:05Z")
I’ll admit, I was a little skeptical, but now that I’ve looked into it more, match seems like a viable option (though I still have to do a little more research). Thanks for the tip! That said, it looks like circle CI does not support uploading anything other than p12 files (and we need to have both the cer and the p12 for signing third-party installers), so I guess I’ll leave this here as a sort of feature request. ---
**Author:** ![halfer](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/halfer/32/9083_2.png) [@halfer](https://discuss.circleci.com/u/halfer)\ **Post date:** [June 4, 2018, 9:07am UTC](https://discuss.circleci.com/t/manual-macos-code-signing/22587/9 "2018-06-04T09:07:04Z")
> [@hotel](#): > > I’ll leave this here as a sort of feature request Check out [https://circleci.com/ideas](https://circleci.com/ideas) too. ---
**Author:** ![system](https://global.discourse-cdn.com/circleci/original/3X/5/1/511608acda8e85906e15909b57bd0a46c1dbe291.png) [@system](https://discuss.circleci.com/u/system)\ **Post date:** [September 2, 2018, 9:07am UTC](https://discuss.circleci.com/t/manual-macos-code-signing/22587/10 "2018-09-02T09:07:09Z")
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.