Signing & notarization overview

DeepPhe installers are code-signed so that macOS Gatekeeper and Windows SmartScreen trust them. There are two independent signing concerns:

1. The installer media — the .dmg / .exe produced by install4j. Signed and (on macOS) notarized by install4j during build-all.sh.
2. The downloadable payloads — the platform binaries the launcher fetches from DeepPhe-Dist at install time. Signed separately by sign-windows-assets.sh.

Secrets stay out of Git

No passwords, PINs, keystores, or private keys are stored in this repository or in this documentation. Everything below refers to credentials supplied at build time — via environment variables or the macOS keychain — never checked in.

1. Installer media signing (install4j)

Signing configuration lives inside DeepPhe-and-Launcher.install4j:

• macOS: a PKCS#12 keystore (keys/DeepPhe.p12) plus notarization through an Apple ID. install4j staples the notarization ticket to the DMG.
• Windows: the YubiKey via PKCS#11 (libykcs11.dylib), identified by the certificate issuer/subject/serial recorded in the project.

You pass the passwords to build-all.sh through environment variables, which it forwards to install4jc:

Variable	Signs
MAC_KEYSTORE_PASSWORD	macOS media
APPLE_ID_PASSWORD	macOS notarization (app-specific password)
WIN_KEYSTORE_PASSWORD	Windows media

To skip all of it for a local build:

./build-all.sh --no-installer-signing

This passes --disable-signing --disable-notarization to install4j.

Certificate chain for Windows

The YubiKey holds only the leaf certificate. install4j embeds the full chain by reading public .cer files from a directory you point it at via the sys.ext.certDir compiler variable. build-all.sh sets this to keys/certchain/ automatically when that folder exists. Those .cer files are public certificates, not secrets.

2. Downloadable payload signing

The Windows .exe payloads on the DeepPhe-Dist releases are signed in place by sign-windows-assets.sh, which uses jsign with the YubiKey and re-uploads them. macOS/Linux payloads are handled through their own release process.

Run it as part of a full build:

./build-all.sh --sign

What counts as a secret?

From the repo's own guidance:

• Secrets (never commit): passwords, app-specific passwords, keystores / certificate containers (*.p12, *.pfx, *.jks, *.keystore), private keys (*.pem, *.key), keychains, YubiKey PINs, notarization credentials.
• Not secrets by themselves: Apple IDs, publisher names, and public project URLs that appear in install4j files; public .cer chain certificates.

The .gitignore blocks new certificate containers from being added, and the keys/ and old_keys/ directories are ignored entirely. See Repo layout.