Implementation:Cypress io Cypress After Sign Hook

Knowledge Sources	Cypress
Domains	Security, Release_Engineering
Last Updated	2026-02-12 00:00 GMT

Overview

Concrete tools for code signing Cypress binaries on macOS (notarization) and Windows (Authenticode) provided by the release hook scripts.

Description

Two scripts handle code signing:

• scripts/after-sign-hook.js (L8-62): macOS notarization via @electron/notarize, triggered as electron-builder's afterSign hook
• scripts/windows-sign.js (L20-61): Windows Authenticode signing via AzureSignTool CLI

Usage

The macOS hook runs automatically during electron-builder packaging. The Windows signing script is referenced in the electron-builder configuration.

Code Reference

Source Location

• Repository: cypress-io/cypress
• Files:
  • scripts/after-sign-hook.js:L8-62 (macOS notarization)
  • scripts/windows-sign.js:L20-61 (Windows signing)

Signature

// macOS (after-sign-hook.js)
module.exports = async function afterSignHook(context) {
  // context.appOutDir: path to packaged app
  // Uses: electron_notarize.notarize({
  //   appBundleId: 'com.electron.cypress',
  //   appPath: pathToApp,
  //   appleId: process.env.APPLE_ID,
  //   appleIdPassword: process.env.APPLE_APP_SPECIFIC_PASSWORD,
  //   teamId: process.env.APPLE_TEAM_ID,
  // })
}

// Windows (windows-sign.js)
function sign(configuration) {
  // configuration.path: path to executable
  // Uses: child_process.execSync('AzureSignTool sign ...')
  // Authenticates via WINDOWS_SIGN_USER_NAME, WINDOWS_SIGN_USER_PASSWORD, etc.
}

Import

// Referenced in electron-builder.json:
// "afterSign": "./scripts/after-sign-hook.js"
// "win.sign": "./scripts/windows-sign.js"

I/O Contract

Inputs

Name	Type	Required	Description
context.appOutDir	string	Yes (macOS)	Path to packaged application
APPLE_ID	env var	Yes (macOS)	Apple Developer ID
APPLE_APP_SPECIFIC_PASSWORD	env var	Yes (macOS)	App-specific password
APPLE_TEAM_ID	env var	Yes (macOS)	Apple Developer Team ID
WINDOWS_SIGN_USER_NAME	env var	Yes (Windows)	Azure eSigner username
WINDOWS_SIGN_USER_PASSWORD	env var	Yes (Windows)	Azure eSigner password
WINDOWS_SIGN_CREDENTIAL_ID	env var	Yes (Windows)	Signing credential ID
WINDOWS_SIGN_USER_TOTP	env var	Yes (Windows)	TOTP secret for 2FA

Outputs

Name	Type	Description
Signed binary (macOS)	Cypress.app	Notarized macOS application
Signed binary (Windows)	Cypress.exe	Authenticode-signed Windows executable

Usage Examples

CI Environment Setup

# CircleCI environment variables for signing
environment:
  APPLE_ID: $APPLE_ID
  APPLE_APP_SPECIFIC_PASSWORD: $APPLE_APP_SPECIFIC_PASSWORD
  APPLE_TEAM_ID: $APPLE_TEAM_ID

Related Pages

Implements Principle

• Principle:Cypress_io_Cypress_Code_Signing