---
title: "The ultimate guide to signing CLIs for macOS (Darwin)"
url: https://daily.dev/posts/the-ultimate-guide-to-signing-clis-for-macos-darwin--xsojjk5ki
source_url: https://tuist.dev/blog/2024/12/31/signing-macos-clis
type: article
source: "\n      Tuist\n    "
published: 2026-08-23T12:23:50.478Z
updated: 2026-08-23T12:59:58.568Z
tags: ["cicd", "cli", "mac"]
reading_time: 6
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# The ultimate guide to signing CLIs for macOS (Darwin)

**[
      Tuist
    ](https://daily.dev/sources/tuist-blog)** · 6 min read · 0 upvotes · 0 comments

## Summary

A practical walkthrough for signing and notarizing macOS CLI binaries to avoid Gatekeeper's 'cannot check for malicious software' error. Covers what code signing and notarization are, prerequisites (developer account, app-specific password, Xcode tools or the apple-codesign Rust crate), creating a Developer ID Application certificate, signing with codesign, notarizing via notarytool, and setting up the signing process in non-interactive CI environments by exporting a .p12 certificate and building a temporary keychain.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://tuist.dev/blog/2024/12/31/signing-macos-clis>

## Questions this post answers

### How do I fix the error 'cannot be opened because Apple cannot check it for malicious software' for my CLI on macOS?

This error means the CLI has not been signed and notarized by Apple, so Gatekeeper blocks it. Sign the binary with codesign using a Developer ID Application certificate (codesign --sign "$CERTIFICATE_NAME" --timestamp --options runtime), then zip it and submit it via xcrun notarytool submit with your Apple ID, team ID, and app-specific password.

_daily.dev surfaces guides like this for developers shipping cross-platform CLIs to macOS users._

### How do I set up code signing for a macOS CLI in a CI pipeline without Xcode's GUI?

Export the Developer ID Application certificate and its private key as a password-protected .p12 file, base64-encode it, and store it as a CI secret. In the CI job, decode it into a temporary keychain created with security create-keychain, set it as default, unlock it, and import the certificate with security import before running codesign.

_developers automating release pipelines can track workflow patterns like this on daily.dev._

### Can I sign and notarize a macOS app from a Linux CI environment instead of macOS?

Yes, the apple-codesign Rust crate provides a CLI that can sign and notarize Apple artifacts from Linux environments, as an alternative to requiring a macOS machine with Xcode developer tools installed for the signing and notarization steps.

_daily.dev helps developers comparing cross-platform tooling options like apple-codesign stay informed._

## Similar posts on daily.dev

- [Building and Shipping Mac and iOS Apps Without Ever Opening Xcode](https://daily.dev/posts/building-and-shipping-mac-and-ios-apps-without-ever-opening-xcode-hniefalt7) · Hacker News · 2 upvotes · 0 comments
- [Gravity DMG: Sign, notarize, & design DMG packages for your macOS apps](https://daily.dev/posts/gravity-dmg-sign-notarize-design-dmg-packages-for-your-macos-apps-jt9wshgbe) · Product Hunt · 4 upvotes · 0 comments

---

Tags: [#cicd](https://daily.dev/tags/cicd), [#cli](https://daily.dev/tags/cli), [#mac](https://daily.dev/tags/mac)

[View this post on daily.dev](https://daily.dev/posts/the-ultimate-guide-to-signing-clis-for-macos-darwin--xsojjk5ki)