如何使用客户凭证为Electron应用完成代码签名及证书生成？

Hey there, I totally get how tricky this situation is—dealing with Apple's code signing hoops already isn't fun, let alone when you're working with a non-technical client and restricted permissions. Here are some practical alternatives to being on-site that should work:

1. 远程引导客户导出完整的分发证书（最直接） #

Since your client owns the account, they're the only one who can generate a Developer ID Application distribution certificate (the one you need for signing apps outside the Mac App Store) unless you get elevated permissions. But you can walk them through super simple, step-by-step actions remotely (via Zoom/TeamViewer screen share, or a detailed visual guide):

• Have them open Keychain Access on their Mac
• Go to Keychain Access > Certificate Assistant > Request a Certificate From a Certificate Authority
• Fill in their email, name, save to disk, then send you the generated .certSigningRequest file
• Then guide them to log into the Apple Developer Center, navigate to Certificates > Production > Developer ID Application, upload the CSR file, download the resulting .cer certificate
• Have them double-click to import the .cer into Keychain Access, then right-click the certificate (under "My Certificates") and select Export "Developer ID Application: [Client's Name]" to save as a .p12 file (make sure they set a password for it)
• Once you get the .p12 and password, you can configure electron-builder to use it directly in your package.json:

  "build": {
    "mac": {
      "certificateFile": "./path/to/client-cert.p12",
      "certificatePassword": "the-password-they-set",
      "hardenedRuntime": true,
      "gatekeeperAssess": false
    }
  }
  

2. 请求提升你的团队权限 #

If your client is open to it, ask them to update your role in the Apple Developer Team to Admin or Developer ID Manager. This role will let you generate distribution certificates on your own without needing to bug them for every step. Frame it as a time-saver for both of you—explain that this only gives you access to certificate/provisioning profile management, not other sensitive account settings.

3. 利用自动化工具简化流程（适合后续维护） #

If your client is willing to share a temporary 2FA code when needed, you can set up fastlane match to manage certificates and profiles securely. This tool stores encrypted certificates in a Git repo, so once it's set up, you won't need to bother the client for 2FA every time you need to sign a build. The setup does require a one-time 2FA verification from the client, but it's worth it for long-term projects.

4. 确认是否需要 provisioning profiles（Electron特例） #

For most Electron apps distributed outside the Mac App Store, you don't need a provisioning profile—only the Developer ID certificate. So don't waste time on that unless you're targeting the App Store, which simplifies things a bit.

The first option is probably your quickest win since it doesn't require changing permissions and works with your client's current setup. Just make sure your guide is so simple that even a non-technical person can follow it (think: "Click the blue button that says 'Continue'" level details).

内容的提问来源于stack exchange，提问作者spring