PkgFoundry
Catalog npm
Back to packageRELEASE DETAILS

1.0.0

npm

@0x0a0d/sign-app

CLI utility to self-sign macOS apps and binaries with codesign

appmacselfsign
Published21 Mar 2026
Direct dependencies3
Transitive dependenciesNot calculated

README

Current package documentation

sign-app

Self-sign macOS apps/binaries from CLI using codesign.

Requirements

  • macOS
  • Xcode Command Line Tools (xcrun, codesign)
  • Node.js 18+

Usage with bunx / npx

npx -y @0x0a0d/sign-app@latest -x "/Applications/My App.app"

bunx @0x0a0d/sign-app@latest -x "/Applications/My App.app"

bunx @0x0a0d/sign-app@latest --list

bunx @0x0a0d/sign-app@latest "/Applications/My App.app" --clear-quarantine

bunx @0x0a0d/sign-app@latest "/Applications/My App.app" --sudo-xattr

bunx @0x0a0d/sign-app@latest "/Applications/My App.app" --yes

You can also pass any existing file/folder path (not only .app).

Safety warning

  • Code signing can increase the trust level of an app on macOS.
  • Only sign software you built yourself or fully trust.
  • Never sign unknown binaries from untrusted sources.
  • By default, the CLI asks for Y/n confirmation after printing warnings.
  • For non-interactive environments, use --yes (or --quiet).

Options

-i, --identity <value>       Identity passed to codesign (default: -)
-e, --entitlements <path>    Entitlements plist file
-q, --quiet                  Disable safety warning before signing
-y, --yes                    Skip Y/n confirmation after warning
-l, --list                   List signing identities and available entitlements
-x, --clear-quarantine       Run xattr -rd com.apple.quarantine before signing
    --sudo-xattr             Run quarantine cleanup as: sudo xattr -rd com.apple.quarantine
    --no-verify              Skip post-sign verification
    --dry-run                Print commands only, do not execute
-h, --help                   Show help

Local development

npm install
npm run check
npm run build
node dist/cli.js "/Applications/My App.app"

Downloads & popularity

Awaiting observations

No metric observations yet

Download counts and popularity will appear here as the collector receives them.

Declared dependencies 3

Native requirements
3 direct targetsNot calculated transitive count
Package / targetRequirementRelationship
@types/node
Environment
{
  "local_name": "@types/node",
  "alias": false,
  "peer_metadata": null
}
^25.5.0development
oxlint
Environment
{
  "local_name": "oxlint",
  "alias": false,
  "peer_metadata": null
}
^1.56.0development
typescript
Environment
{
  "local_name": "typescript",
  "alias": false,
  "peer_metadata": null
}
^5.9.3development

Distribution files

1 collected
Distribution 1

Source distribution

Source file
Checksums from source
{
  "integrity": "sha512-bUpgasY05D+nh343dFSUryz058xfxMNsXmsn5+SfPY9Xu2RJK2ewuSFGCFsV/BiHeljchnAUN+4NM0IUZPWVtA==",
  "shasum": "adacebcc9b01430d9498b6321980d4a40358f2c5",
  "tarball": "https://registry.npmjs.org/@0x0a0d/sign-app/-/sign-app-1.0.0.tgz",
  "fileCount": 8,
  "unpackedSize": 19727,
  "signatures": [
    {
      "keyid": "SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U",
      "sig": "MEYCIQD+2gQslRjw6w/MZKdj+2s3qWCb7W0dsPDyKanPi/Z22wIhAIVi6FneiLLjITwKdomSVWlKgcB3ov8uiXFMCuSzlDK4"
    }
  ]
}

Metadata history

Meaningful changes
Current collected state Current

Observed since 20 Oct, 22:33 UTC

No superseded metadata states collected. Unchanged observations do not create new revisions.

Record identity

package_version:291cd7fcc333f1b1019fe6d60f77aaa86631aed00a184a4fdd52db686a6c89d4

Other collected versions

View all collected versions →