Signaro 5.5 Build 1.7.9

Post-renewal certificate cleanup — delete a superseded certificate right from the app once its replacement is confirmed healthy — plus fixes for three related certificate-expiry notification bugs.

Downloads

Artifact	Contents
Signaro-5.5-1.7.9.dmg	Drag-and-drop app bundle (SignaroCLI embedded at Contents/Helpers/)
Signaro-5.5-1.7.9-Installer.pkg	Installs Signaro.app → /Applications and signarocli → /usr/local/bin
SignaroCLI-5.5-1.7.9.pkg	CLI only → /usr/local/bin/signarocli

All artifacts are Developer ID-signed, notarized, and stapled.

New

• Post-renewal certificate cleanup — once a renewed certificate's replacement is confirmed present and healthy (same Team ID and certificate type, later non-expired expiry), Signaro offers a Delete… action for the superseded one: a hint row in the certificate picker, and a new "Renewed — Safe to Clean Up" section in the stethoscope diagnostic. Removes the full identity (certificate + private key) via SecItemDelete after an explicit destructive confirmation naming both certificates. Never reachable without a confirmed replacement, so it can't strand signing capability.

Fixed

• Daily expiry check could evaluate a stale, already-deleted certificate — the daily background check read a cached identity list only refreshed at app launch, so a certificate removed any other way (Keychain Access, security CLI) kept re-triggering "expiring/expired" notifications indefinitely. It now re-queries the keychain live on every check.
• Delivered expiry notifications never got retracted — a delivered macOS notification is never cleared automatically, not even by rebuilding or relaunching the app. The daily check now reconciles Notification Center's actual delivered list against current certificate state and retracts anything stale.
• "Signaro switched certificates" notification re-fired on every app launch — its dedup guard was in-memory only and reset every relaunch, while the persisted "last used" pointer only advances on a confirmed distribution workflow. The guard now persists, with matching retraction for any already-delivered stale copy.

Build

• MARKETING_VERSION 5.5, CURRENT_PROJECT_VERSION 1.7.9, CLI version string SignaroCLI 5.5 Build 1.7.9.
• Test suite: 228 tests across 29 classes, all green (adds CertificateLifecycleMonitorTests, IdentityManagerDeleteTests).

See RELEASE_NOTES.md for full details.

Signaro 5.5 Build 1.7.10

Fix: the certificate renewal CSR save panel now suggests a filename matching the certificate being renewed, instead of the same generic name every time.

Downloads

Artifact	Contents
Signaro-5.5-1.7.10.dmg	Drag-and-drop app bundle (SignaroCLI embedded at Contents/Helpers/)
Signaro-5.5-1.7.10-Installer.pkg	Installs Signaro.app → /Applications and signarocli → /usr/local/bin
SignaroCLI-5.5-1.7.10.pkg	CLI only → /usr/local/bin/signarocli

All artifacts are Developer ID-signed, notarized, and stapled.

Fixed

• Renewal CSR save panel always suggested the same filename — regardless of which certificate you were renewing, the save panel defaulted to Signaro-Renewal.certSigningRequest. Renewing more than one certificate type in the same folder meant every save offered to overwrite the last one. The suggested filename is now derived from the certificate being renewed (e.g. Developer ID Application - Jesus Ayala (N859JA9UCJ).certSigningRequest), falling back to the generic name only when no certificate is selected.

Build

• MARKETING_VERSION 5.5, CURRENT_PROJECT_VERSION 1.7.10, CLI version string SignaroCLI 5.5 Build 1.7.10.
• Test suite: 232 tests across 30 classes, all green (adds CertificateRenewalTests).

See RELEASE_NOTES.md for full details.

Signaro 5.5 Build 1.7.8

In-app Help catches up with the app — a complete certificate-renewal walkthrough, the lifecycle indicator system explained, and every remaining surface documented. Content-only release over 1.7.7.

Downloads

Artifact	Contents
Signaro-5.5-1.7.8.dmg	Drag-and-drop app bundle (SignaroCLI embedded at Contents/Helpers/)
Signaro-5.5-1.7.8-Installer.pkg	Installs Signaro.app → /Applications and signarocli → /usr/local/bin
SignaroCLI-5.5-1.7.8.pkg	CLI only → /usr/local/bin/signarocli

All artifacts are Developer ID-signed, notarized, and stapled.

Documentation

• "Renewing an Expiring Certificate" — the Renew… flow end to end: CSR generation with the private key created in this Mac's login keychain (and why the issued .cer must be opened on the same Mac), portal upload with the same certificate type, profile regeneration afterward, and how the diagnostic explains an in-flight or misdirected renewal ("missing its private key" / "awaiting a certificate").
• "Certificate & Profile Lifecycle Indicators" — the 90-day model behind the countdown pill, the type · trust · expiry summary line, and the .mobileprovision banner, on both tabs and in Auto mode.
• New sections for every remaining surface — Validation Mode (Detailed vs Quick), the Certificate Diagnostic's three finding types, and resuming interrupted batch workflows.
• Updated sections — Safety Guards now lists the expired-certificate, OCSP-revocation, and expired-profile hard stops; the iOS Analysis Card section covers the regenerate link and Auto-mode summaries; Distribution Workflows documents Create DMG's appearance customization.

Build

• MARKETING_VERSION 5.5, CURRENT_PROJECT_VERSION 1.7.8, CLI version string SignaroCLI 5.5 Build 1.7.8.
• No code changes over 1.7.7. Test suite: 218 tests across 27 classes, all green.

See RELEASE_NOTES.md for full details.

Signaro 5.5 Build 1.7.7

iOS re-sign tab reaches full certificate-lifecycle parity — pill, expiry lines, in-app renewal, and a .mobileprovision banner, all live in Auto mode — plus a hard stop for expired provisioning profiles.

Downloads

Artifact	Contents
Signaro-5.5-1.7.7.dmg	Drag-and-drop app bundle (SignaroCLI embedded at Contents/Helpers/)
Signaro-5.5-1.7.7-Installer.pkg	Installs Signaro.app → /Applications and signarocli → /usr/local/bin
SignaroCLI-5.5-1.7.7.pkg	CLI only → /usr/local/bin/signarocli

All artifacts are Developer ID-signed, notarized, and stapled.

New

• iOS re-sign tab: lifecycle parity with the macOS tab — the signing-identity row gains the urgency pill ("32 days"), the consolidated type · trust · exact expiry line, the Renew… menu (built-in CSR generation + portal deep link), and the orphaned-certificate hint — retiring the old 14-day text tags for the 90-day lifecycle model.
• Auto mode shows what will actually sign — when every queued IPA resolves to the same identity, the picker row displays its pill, expiry line, and Renew…, whether cards are collapsed or expanded. Mixed resolutions defer to the per-IPA cards.
• .mobileprovision banner — the detected profile gets a severity-tinted banner at the picker: a .mobileprovision chip, the profile name, "Expires date — N days" matching the identity line's format, and an inline Regenerate in portal… link inside the 90-day window. Redundant hint rows stand down when the banner carries the same fact.
• Expired provisioning profiles are a hard stop — a drag-in .mobileprovision override (or cached analysis) carrying an expired profile previously re-signed successfully and died at install. Analysis now predicts Blocked with the expiry date and full remediation (regenerate in portal → Xcode → Download Manual Profiles), nested-bundle overrides included, re-enforced at sign time. SignaroCLI ios analyze/ios resign inherit the block.

Changed

• The profile "Regenerate in portal…" trigger is aligned to the same 90-day lifecycle model as every other indicator (was a 14-day window that hid the link while the pill beside it warned).

Build

• MARKETING_VERSION 5.5, CURRENT_PROJECT_VERSION 1.7.7, CLI version string SignaroCLI 5.5 Build 1.7.7.
• Test suite: 218 tests across 27 classes, all green.

See RELEASE_NOTES.md for full details.

Signaro 5.5 Build 1.7.6

Orphaned-certificate detection — Signaro now finds signing certificates whose private key is missing and explains how to fix them, and tracks in-flight Renew… key pairs to completion.

Downloads

Artifact	Contents
Signaro-5.5-1.7.6.dmg	Drag-and-drop app bundle (SignaroCLI embedded at Contents/Helpers/)
Signaro-5.5-1.7.6-Installer.pkg	Installs Signaro.app → /Applications and signarocli → /usr/local/bin
SignaroCLI-5.5-1.7.6.pkg	CLI only → /usr/local/bin/signarocli

All artifacts are Developer ID-signed, notarized, and stapled.

New

• Orphaned-certificate detection — a signing certificate whose private key is missing can never appear in the certificate picker (macOS only enumerates cert+key pairs), while Keychain Access shows it plainly. That's the classic confusion after moving Macs — and the failure mode of Renew… when the issued certificate is downloaded on a different Mac than the one that generated the CSR. Signaro now scans for these orphans: an orange hint appears under the picker, and the stethoscope diagnostic lists each orphaned certificate with its expiry and the fix (export a .p12 from the originating Mac, or renew from here). Expired orphans are ignored — cleanup clutter, not blockers.
• Renewal keys tracked to completion — the diagnostic also lists Renew…-generated private keys still waiting for their certificate, so an in-flight renewal is visible and an abandoned one is identifiable (and safe to delete in Keychain Access).

Build

• MARKETING_VERSION 5.5, CURRENT_PROJECT_VERSION 1.7.6, CLI version string SignaroCLI 5.5 Build 1.7.6.
• Test suite: 199 tests across 26 classes, all green.

See RELEASE_NOTES.md for full details.

Signaro 5.5 Build 1.7.5

Certificate lifecycle at a glance — a consolidated type · trust · expiry summary line, a status pill that finally renders (and only when it matters), and in-app renewal with built-in CSR generation.

Downloads

Artifact	Contents
Signaro-5.5-1.7.5.dmg	Drag-and-drop app bundle (SignaroCLI embedded at Contents/Helpers/)
Signaro-5.5-1.7.5-Installer.pkg	Installs Signaro.app → /Applications and signarocli → /usr/local/bin
SignaroCLI-5.5-1.7.5.pkg	CLI only → /usr/local/bin/signarocli

All artifacts are Developer ID-signed, notarized, and stapled.

New

• Consolidated certificate metadata line — the picker's "Selected: …" and "This certificate is trusted." rows become one line: type · trust · exact expiry ("Developer ID Application · Trusted · Valid until Jul 5, 2027"). Inside the 90-day window it turns amber and names the date and countdown ("Expires Aug 6, 2026 — 32 days"); expired or unknown expiry turns red; an untrusted certificate escalates the line even when its dates are fine — the summary can never look healthier than the warning pill above it.
• Renew… with built-in CSR generation — when the selected certificate is expiring or expired, a Renew… menu appears next to the picker. Generate CSR & Open Portal… creates a 2048-bit RSA key pair in your login keychain (so the certificate Apple issues pairs into a working identity), saves a portal-ready .certSigningRequest, reveals it in Finder, and opens the developer portal's create-certificate page — no Keychain Access round-trip. CSR generation is built in (PKCS#10, verified against openssl req -verify in the test suite).

Fixed

• Certificate status pill never rendered — the countdown pill lived inside the picker menu's label, which macOS flattens to icon + text, silently dropping styled views. It now sits beside the picker and appears from the 90-day advisory window onward ("32 days", "Expired") — deliberately quiet when healthy, so its arrival is the signal.

Build

• MARKETING_VERSION 5.5, CURRENT_PROJECT_VERSION 1.7.5, CLI version string SignaroCLI 5.5 Build 1.7.5.
• Test suite: 190 tests across 25 classes, all green.

See RELEASE_NOTES.md for full details.

Signaro 5.5 Build 1.7.4

Signing safety hardening — expired-certificate and revoked-certificate hard stops, fail-closed nested-bundle entitlement preservation — and a fix for the SignaroCLI validate hang.

Downloads

Artifact	Contents
Signaro-5.5-1.7.4.dmg	Drag-and-drop app bundle (SignaroCLI embedded at Contents/Helpers/)
Signaro-5.5-1.7.4-Installer.pkg	Installs Signaro.app → /Applications and signarocli → /usr/local/bin
SignaroCLI-5.5-1.7.4.pkg	CLI only → /usr/local/bin/signarocli

All artifacts are Developer ID-signed, notarized, and stapled.

New

• Expired-certificate hard stop for iOS re-signing — an expired signing certificate signs cleanly and passes local codesign --verify, but the resulting IPA fails to install on every device. Re-signing with one is now Blocked at analysis (with the expiry date and remediation in the message) and refused again at sign time. The check reads the certificate's expiry from the keychain and from the authoritative DER copy embedded in the provisioning profile, so a stale profile whose embedded certificate has expired is caught even when keychain metadata is missing. Expired identities stay visible in the picker with their ⚠ EXPIRED tag; "expires soon" remains advisory.
• Nested-bundle entitlement preservation (macOS signing) — helpers, XPC services, and extensions inside a .app now get fail-closed entitlement handling: if their existing entitlements cannot be extracted, signing stops instead of silently stripping them, and after signing each nested bundle Signaro re-reads what was actually written and verifies every intended entitlement key survived.
• Per-bundle post-sign entitlement verification (iOS re-signing) — the intended-vs-written entitlement check now runs for every nested .appex and Watch bundle, not just the main app; dropped keys surface as a Degraded status instead of passing silently.
• Certificate revocation blocking in the signing flows — the OCSP revocation checker (previously opt-in via SignaroCLI identities list --check-revocation) is now consulted automatically: iOS re-sign analysis runs it concurrently with the rest of the analysis and shows Blocked on an affirmative revocation, sign time re-enforces it, and the notarization readiness check treats a revoked selected certificate as a critical issue. Soft-fail preserved: only an affirmative "revoked" verdict blocks — network trouble never does.

Fixed

• SignaroCLI validate hang — validate (and the GUI's comprehensive validation, which shares the code path) could hang indefinitely due to a lost process-exit notification in a bespoke process runner, with a latent deadlock on outputs over 64 KB. The checker now uses the same hardened process runner as the rest of the app.
• Auth-mode picker binding (follow-up to 1.7.3) — the shared binding now reads and writes the raw storage directly instead of routing through the computed property.

Build

• MARKETING_VERSION 5.5, CURRENT_PROJECT_VERSION 1.7.4, CLI version string SignaroCLI 5.5 Build 1.7.4.
• Test suite: 178 tests across 24 classes, all green.

See RELEASE_NOTES.md for full details.

Signaro 5.5 Build 1.7.3

Connected-device install, App Store Connect device registry, and certificate revocation checking.

Downloads

Artifact	Contents
Signaro-5.5-1.7.3.dmg	Drag-and-drop app bundle (SignaroCLI embedded at Contents/Helpers/)
Signaro-5.5-1.7.3-Installer.pkg	Installs Signaro.app → /Applications and signarocli → /usr/local/bin
SignaroCLI-5.5-1.7.3.pkg	CLI only → /usr/local/bin/signarocli

All artifacts are Developer ID-signed, notarized, and stapled.

New

• Check This Mac's Devices — one click in the UDID coverage section fills the coverage field with the UDID of every device paired with this Mac via devicectl (iOS 17+, Xcode 15+), deduplicated and preserving hand-typed entries. Rows for known devices show the device name and connection state. Manual UDID pasting remains fully supported.
• Install on Device… — after a successful re-sign of an Ad Hoc, Development, or Enterprise IPA, install the output directly onto a connected device — the ground-truth verification that a re-sign worked. Blocked installs are explained up front (device not connected, UDID not in profile, Developer Mode off).
• CLI: devices list and ios install — list devices known to this Mac (name, model, OS, UDID, connection state, Developer Mode) and install a re-signed .ipa/.app onto one by UDID or name.
• CLI: devices registered — read-only view of the team's device registry in App Store Connect (ASC API key with App Manager/Admin role). --udid <u1,u2> tells you whether a non-covered UDID means "profile is stale — regenerate it" or "device never registered — registering consumes annual quota." Device registration and profile regeneration are deliberately not implemented.
• CLI: identities list --check-revocation — verifies each signing certificate against Apple's OCSP responder. A revoked certificate signs cleanly but fails later at Gatekeeper/notarization; this catches it up front. Soft-fail: network trouble is never reported as a revocation.
• In-app Help — new sections covering connected devices, on-device install, the team device registry (including step-by-step ASC API key creation and the App Manager role caveat), and the revocation check.

Fixed

• "Publishing changes from within view updates" runtime warning from the authentication-mode picker in the notarization/distribution credential dialogs — the rebuilt picker's no-op selection write re-published mid-update; no-op writes are now dropped.
• Stale CLI --version string — the 1.7.2 binary still reported 1.7.1; the version string is now correct.

Build

• MARKETING_VERSION 5.5, CURRENT_PROJECT_VERSION 1.7.3, CLI version string 5.5.1.7.3.
• New shared services (Foundation/Security/CryptoKit only, no third-party dependencies): ConnectedDeviceService, ASCClient, CertificateRevocationChecker — included in both the app and CLI targets.

See RELEASE_NOTES.md for full details.

Signaro 5.5 Build 1.7.2

Downloads

File	Description
Signaro-5.5-1.7.2.dmg	Drag-and-drop installer — includes embedded SignaroCLI
Signaro-5.5-1.7.2-Installer.pkg	Full installer — installs Signaro.app → /Applications/ and signarocli → /usr/local/bin/
SignaroCLI-5.5-1.7.2.pkg	CLI-only installer — installs signarocli to /usr/local/bin/ for terminal and CI use

All artifacts are signed with a Developer ID, notarized by Apple, and staple-ticketed.

---

What's New in Build 1.7.2

Fixed

• Ad Hoc profile misclassification when device list is empty. Provisioning profiles that carry a ProvisionedDevices key but list zero devices were incorrectly classified as App Store. The type waterfall now checks whether the key exists in the plist (not whether the array is non-empty), so zero-device Ad Hoc profiles resolve to the correct distribution type.
• Empty-device Ad Hoc/Development warning. When an Ad Hoc or Development profile has no registered devices, the analysis card now shows an explicit warning that the re-signed IPA cannot be installed on any device. Previously codesign --verify still reported success, producing a silently uninstallable IPA with no user-visible explanation.
• Debugger attachment fixed (Hardened Runtime + Manual signing). Added Signaro-Debug.entitlements with com.apple.security.get-task-allow = true for the Debug build configuration. With Hardened Runtime enabled and Manual signing active, Xcode does not auto-inject this entitlement; the missing entitlement caused every debug session to be killed immediately (os/kern failure 0x5, exit code 9). The Release configuration retains Signaro.entitlements (without get-task-allow) to keep notarization clean.
• Malformed ProvisionedDevices type-mismatch fixed. A profile where the ProvisionedDevices key holds a non-[String] value now falls through to App Store classification rather than silently becoming Ad Hoc with an empty device list.

---

Requirements

• macOS 14 Sonoma or later
• Developer ID Application certificate (for re-signing)
• Provisioning profiles downloaded via Xcode → Settings → Accounts → Download Manual Profiles

For full history see RELEASE_NOTES.md.

Signaro 5.5 Build 1.7.1

Downloads

File	Description
Signaro-5.5-1.7.1.dmg	Drag-and-drop installer — includes embedded SignaroCLI
Signaro-5.5-1.7.1-Installer.pkg	Full installer — installs Signaro.app → /Applications/ and signarocli → /usr/local/bin/
SignaroCLI-5.5-1.7.1.pkg	CLI-only installer — installs signarocli to /usr/local/bin/ for terminal and CI use

All artifacts are signed with a Developer ID, notarized by Apple, and staple-ticketed.

---

What's New in Build 1.7.1

New

• OTA manifest generation (GUI). After a successful re-sign, the analysis card shows an OTA Manifest… button for Ad Hoc, Development, and Enterprise profiles. Enter the HTTPS URL where the IPA will be hosted; Signaro writes manifest.plist and install.html alongside the output file and displays the itms-services:// install link in-app.
• CLI --ota-url flag (ios resign). signarocli ios resign app.ipa --ota-url https://example.com/app.ipa generates manifest.plist and install.html next to the output IPA and prints the install link to stdout. Requires HTTPS; single IPA per invocation.

Fixed

• IPA routing race eliminated. Drag-dropping or opening .ipa files via File ▸ Open… previously dropped files silently when IPAResignView hadn't yet subscribed to the notification. Pending URLs are now held in @State above the TabView and consumed via @Binding on appear/change — no timing window to miss files.

---

What's New in Build 1.7.0 — iOS Re-signing Overhaul

New Features

• Distribution type selector — Development / Ad Hoc / Enterprise / App Store segmented picker filters profile and certificate matching automatically.
• Apple Distribution cert support — Both Apple Development and Apple Distribution certificates appear in the signing identity picker, covering Ad Hoc workflows correctly.
• Per-nested-bundle profile overrides — App extensions and embedded Watch apps each show their own profile status row. Drop a .mobileprovision onto any row to override that bundle independently.
• Post-resign codesign verification — After each re-sign, codesign --verify --deep --strict runs and the result appears as a green/red shield badge on the card.
• Entitlement diff with delta values — Changed/dropped/added entitlement keys show the actual value change (e.g. false → true) as a secondary italic line.
• Wildcard profile warning — Warns when a wildcard profile is selected that capabilities like Push Notifications, Associated Domains, and HealthKit may not be active at runtime.
• Expired profile surface — The "no profile" guide reports how many matching profiles were found but are expired, with a prompt to re-download via Xcode → Settings → Accounts.
• App Store profile detection — Explains when App Store profiles are installed but unusable for local re-signing, and directs users to install a Development or Ad Hoc profile.
• Ad Hoc + Development UDID coverage checker — Enter device UDIDs in the analysis card to see which are and aren't covered by the selected profile's provisioned device list.
• Entitlement write verification — After re-signing, reads back the embedded entitlements and flags any declared in the profile that didn't survive the codesign step.
• Refresh Profiles button — Forces a re-scan of ~/Library/…/Provisioning Profiles and re-runs analysis on all queued IPAs without an app restart.
• FairPlay encrypted binary detection — Blocks analysis immediately with an actionable message when LC_ENCRYPTION_INFO shows cryptid != 0.
• Apple TSA timestamp — All codesign calls use Apple's RFC 3161 timestamp server so signed apps remain installable after the signing cert expires.
• Parallel analysis — reanalyzeAll() runs all queued IPAs concurrently via withTaskGroup.
• Batch resign summary — Shows total Valid / Degraded / Failed counts after a batch completes or is cancelled.
• Cancel button during batch resign — Stops a running batch cleanly after the current IPA finishes.
• Per-IPA resign progress indicator — Spinner on the actively-signing card; per-target status text (e.g. "Signing MyExtension.appex…").
• Output collision handling — Appends -2, -3, … suffixes instead of silently overwriting existing output files.
• Work dir on failure — Failed resign cards show a "Show work dir in Finder" button for direct access to the retained working directory.
• Codesign retry — Retries once with 500 ms backoff on transient amfid/security-framework failures.
• get-task-allow Degraded explanation — Contextual callout when the only degraded reason is get-task-allow false → true (re-signing a distribution build with a Development profile).
• CLI --distribution flag — signarocli ios analyze and signarocli ios resign accept --distribution development|adhoc|enterprise|appstore to constrain profile and cert selection.

Fixed

• "Publishing changes from within view updates" runtime warnings eliminated — Migrated IPAResignViewModel from ObservableObject/@Published to the @Observable macro (macOS 14+).

---

Requirements

• macOS 14 Sonoma or later
• Developer ID Application certificate (for re-signing)
• Provisioning profiles downloaded via Xcode → Settings → Accounts → Download Manual Profiles

For full history see RELEASE_NOTES.md.