# native-code-sign
Code signing wrappers using platform-native signing tools.
## macOS
Uses Apple's `codesign` tool.
Set the following environment variables:
- `CODESIGN_IDENTITY`: signing identity (e.g. "Developer ID Application: ...")
- `CODESIGN_CERTIFICATE`: base64-encoded .p12 certificate
- `CODESIGN_CERTIFICATE_PASSWORD`: password for the .p12
- `CODESIGN_OPTIONS`: (optional) extra `--options` value (e.g. `runtime` for hardened runtime / notarization)
An ephemeral keychain is used to store the certificate, temporarily modifying the keychain search
list. This modification is robust to concurrent `cargo-code-sign` invocations, but not to other
programs modifying the keychain search list.
## Windows
Uses Microsoft `signtool.exe`.
Set the following environment variables:
- `SIGNTOOL_CERTIFICATE_PATH`: path to a .pfx certificate file
- `SIGNTOOL_CERTIFICATE_PASSWORD`: password for the .pfx
- `SIGNTOOL_TIMESTAMP_URL`: (optional) RFC 3161 timestamp server URL
- `SIGNTOOL_DESCRIPTION`: (optional) description shown in UAC prompts (signtool `/d` flag)
- `SIGNTOOL_PATH`: (optional) path to signtool.exe (defaults to `signtool.exe` from `PATH`)