Your signing key should never touch your CI.
Hardware custody for Apple code signing. Your Developer ID key is born inside a dedicated hardware token in our signing vault — yours alone, PIN‑locked, and it has never existed as a file.
base64 developer_id.p12 → MACOS_CERTIFICATE secret → temp keychain on runner → codesign
OIDC token from your CI → policy: repo, ref, workflow → key sealed in hardware → signed artifact returns
Tag a release; a signed, notarized, stapled build comes back. Your signing key never leaves the vault — here’s the round trip.
You tag a release
No certificates, no secrets in your CI — there is nothing to steal.
Proves its identity
A short‑lived identity token, minted per build, expired in minutes.
Policy gate
Repo, branch, and workflow must match your rules — anything else is refused.
Signed in hardware
Your key was born inside a hardware token and has never existed as a file.
Notarized & stapled
Submitted to Apple’s notary service; the ticket is stapled to your build.
Evidence recorded
A tamper‑evident chain ties commit to artifact to signature to notary ticket.