snapshot of https://github.com/mattermost/mattermost.git (master, 2026-09-16; blobs > 131072B omitted)

docs/main/administration-guide/manage/code-signing-custom-builds.mdx

@@ -0,0 +1,128 @@
+---
+title: "Code signing custom builds"
+---
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+<PlanAvailability slug="all-commercial" />
+
+Code signing is an essential process for ensuring the authenticity and integrity of your custom `Mattermost` builds. This guide provides steps on how to code sign a build using your own certificates for Windows, Mac, and Linux.
+
+<Important>
+
+Make sure to follow each operating system's guidelines and best practices for signing applications.
+
+</Important>
+
+## Prerequisites
+
+<Tabs>
+<TabItem value="windows" label="Windows">
+
+1.  **Code Signing Certificate**: Obtain a certificate from a Certificate Authority (CA) or use a self-signed certificate if suitable.
+2.  **SignTool**: Available as part of the Windows SDK.
+
+</TabItem>
+<TabItem value="linux" label="Linux">
+
+1.  **GPG Key**: Create a GPG key if you don't have one.
+2.  **GnuPG**: Install [GnuPG](https://gnupg.org/howtos/card-howto/en/ch02.html) if not already installed.
+
+</TabItem>
+<TabItem value="mac" label="Mac">
+
+1.  **Developer ID Application Certificate**: Obtain from Apple. It requires an Apple Developer account.
+2.  **Xcode**: Ensure [Xcode](https://developer.apple.com/xcode/) is installed.
+
+</TabItem>
+</Tabs>
+
+
+## Process
+
+<Tabs>
+<TabItem value="windows" label="Windows">
+
+1.  **Install SignTool**: Install the Windows SDK to access the `SignTool` utility.
+
+2.  **Obtain a Code Signing Certificate**: Purchase or create a certificate (`.pfx` file) via a CA.
+
+3.  **Import the Certificate**: Open the `.pfx` file and import it into the Windows Certificate Store.
+
+4.  **Sign the Executable**
+
+    - Open the command prompt as Administrator.
+    - Use `SignTool` to sign your executable:
+
+    ``` sh
+    signtool sign /v /s "My" /sha1 <cert hash> /fd SHA256 /tr http://timestamp.digicert.com /td SHA256 <path-to-your-executable>
+    ```
+
+</TabItem>
+<TabItem value="linux" label="Linux">
+
+1.  **Create or Import Your GPG Key**: If you don't have a GPG key, create one:
+
+    ``` sh
+    gpg --full-generate-key
+    ```
+
+    Alternatively, import an existing GPG key, if you have one:
+
+    ``` sh
+    gpg --import /path/to/your-key.asc
+    ```
+
+2.  **Sign the Package**: Use `dpkg-sig` to sign a Debian package:
+
+    ``` sh
+    dpkg-sig --sign builder your-package.deb
+    ```
+
+    Use `rpmsign` to sign an RPM package:
+
+    ``` sh
+    rpmsign --addsign your-package.rpm
+    ```
+
+3.  **Verify the Signature**: Verify the signature of a `.deb` package:
+
+    ``` sh
+    dpkg-sig --verify your-package.deb
+    ```
+
+    Verify the signature of an `.rpm` package:
+
+    ``` sh
+    rpm --checksig your-package.rpm
+    ```
+
+</TabItem>
+<TabItem value="mac" label="Mac">
+
+1.  **Obtain a Code Signing Certificate**: Create a `Developer ID Application` certificate in your Apple Developer account and download it.
+
+2.  **Import the Certificate**: Double-click the certificate to import it into the Keychain.
+
+3.  **Sign the Application**: Use the `codesign` tool from Xcode to sign your application:
+
+    ``` sh
+    codesign --deep --force --verify --verbose --sign "Developer ID Application: Your Name (TeamID)" /path/to/your.app
+    ```
+
+4.  \[Optional\] **Verify the Signature**: Verify the signature to ensure everything is correctly signed:
+
+    ``` sh
+    spctl --assess --verbose=4 /path/to/your.app
+    codesign -dv --verbose=4 /path/to/your.app
+    ```
+
+</TabItem>
+</Tabs>
+
+
+## Summary
+
+- **Windows**: Use `SignTool` from the Windows SDK with your imported code signing certificate.
+- **Mac**: Use `codesign` and `spctl` tools from Xcode with your Apple Developer ID certificate.
+- **Linux**: Use `GnuPG` to create/sign with your GPG key, `dpkg-sig` for `.deb` packages, and `rpmsign` for `.rpm` packages.