Signing¶
On native macOS, the default signs nested Mach-O images first, then the enclosing
bundle, using codesign --force --sign -. LV2 signs its individual images. This
is development ad hoc signing; production distribution remains vendor-owned.
The AU builder also signs its staging dylib before loading it for metadata.
A product can replace final signing with a command argument array:
[signing]
command = ["/absolute/vendor-tools/sign-plugin", "--profile", "my-product"]
Or pass --sign-command '["/absolute/vendor-tools/sign-plugin","--profile","my-product"]'.
The CLI command overrides settings. RAVET appends the absolute bundle path and
sets RAVET_BUNDLE_FORMAT and RAVET_BUNDLE_PATH; it runs the command once per
final assembled bundle from the product directory, without a shell. The vendor
script owns nested signing, Developer ID identities, notarization, PACE wrapping
and any required credentials/configuration. Store secrets with that vendor tool,
not in RAVET or a command line. Hook failures stop the command. Hooks also run on
Windows/Linux when supplied; those platforms have no default signing command.
Validation follows signing on the final copied bundle. RAVET never configures
production credentials or infers shipping readiness from a successful hook.