Fast Cross-Platform iOS Code Signing Tool
Languages: English | 简体中文
zsign is a fast, open-source, cross-platform codesign alternative for iOS 12+. It re-signs .ipa packages, Mach-O binaries, and .app bundles with custom certificates and provisioning profiles — without Xcode, without macOS. Ideal for iOS app re-signing, dylib injection, CI/CD pipelines, and IPA distribution workflows on Linux and Windows servers.
Keywords: iOS code signing · codesign alternative · re-sign IPA · Mach-O signing · dylib injection · iOS CI/CD · Linux iOS signing · Windows iOS signing · p12 signing · provisioning profile · OCSP check · ad-hoc signature
If this tool helps you, please give it a ⭐ star — zhlynn
.zsign_cache — subsequent signs skip unchanged Mach-OsLC_LOAD_DYLIB and LC_LOAD_WEAK_DYLIB support.ipa, .p12, .mobileprovision, .cer, .pem, or Mach-OInfo.plist fields and app icon to metadata.json + PNGUISupportedDevicesUISupportsDocumentBrowser and UIFileSharingEnabledmacOS · Linux · Windows · Android · FreeBSD
brew install pkg-config openssl
git clone https://github.com/zhlynn/zsign.git
cd zsign/build/macos
make clean && make
sudo apt-get install -y git g++ pkg-config libssl-dev
git clone https://github.com/zhlynn/zsign.git
cd zsign/build/linux
make clean && make
Install epel-release first:
sudo yum -y install epel-release
Then build:
sudo yum install -y git gcc-c++ pkg-config openssl-devel
git clone https://github.com/zhlynn/zsign.git
cd zsign/build/linux
make clean && make
By default the vendored zlib + minizip sources in src/third-party/ are compiled in, so no extra packages are needed. Package managers that require unbundled libraries (e.g. Homebrew) can link the system copies instead:
make clean && make SYSTEM_MINIZIP=1 # links minizip (requires pkg-config minizip)
make clean && make SYSTEM_MINIZIP=ng # links minizip-ng via its minizip compat layer
Open build/windows/vs2022/zsign.sln in Visual Studio 2022 and build.
…
Show Mach-O and codesignature info:
zsign demo.app/demo
Sign an IPA:
zsign -k privkey.pem -m dev.prov -o output.ipa -z 9 demo.ipa
Sign with p12 (cached):
zsign -k dev.p12 -p 123 -m dev.prov -o output.ipa demo.app
Sign with p12 (force, no cache):
zsign -f -k dev.p12 -p 123 -m dev.prov -o output.ipa demo.app
Ad-hoc sign:
zsign -a -o output.ipa demo.ipa
Inject dylib and re-sign:
zsign -k dev.p12 -p 123 -m dev.prov -l demo.dylib -o output.ipa demo.ipa
Inject dylib into the app and its extensions:
# App extensions (PlugIns/*.appex) run as separate processes and don't inherit
# the main app's injected dylibs, so -P injects into them too. The dylib is kept
# as a single copy at the app root and referenced from each extension by a
# relative path (@executable_path/../../demo.dylib).
zsign -k dev.p12 -p 123 -m dev.prov -P -l demo.dylib -o output.ipa demo.ipa
Change bundle id and name:
zsign -k dev.p12 -p 123 -m dev.prov -b 'com.new.bundle.id' -n 'NewName' -o output.ipa demo.ipa
Change app icon:
zsign -k dev.p12 -p 123 -m dev.prov -I newicon.png -o output.ipa demo.ipa
# replaces the primary icon PNGs referenced by Info.plist and removes
# CFBundleIconName so the new icon takes effect (a square PNG is recommended)
Inject dylib (LC_LOAD_DYLIB) into Mach-O:
zsign -a -l "@executable_path/demo1.dylib" -l "@executable_path/demo2.dylib" demo.app/execute
Inject weak dylib (LC_LOAD_WEAK_DYLIB):
zsign -w -l "@executable_path/demo.dylib" demo.app/execute
Extract metadata and icon:
zsign -k dev.p12 -p 123 -m dev.prov -x ./metadata -o output.ipa demo.ipa
# outputs ./metadata/metadata.json and ./metadata/<hash>.png
# Apple-optimized (CgBI) icons are converted to standard PNG automatically
Enable Files app integration:
zsign -k dev.p12 -p 123 -m dev.prov -S -o output.ipa demo.ipa
Set minimum OS version:
zsign -k dev.p12 -p 123 -m dev.prov -M 14.0 -o output.ipa demo.ipa
Remove app extensions:
zsign -k dev.p12 -p 123 -m dev.prov -E -o output.ipa demo.ipa
Remove watch app:
zsign -k dev.p12 -p 123 -m dev.prov -W -o output.ipa demo.ipa
Remove UISupportedDevices:
zsign -k dev.p12 -p 123 -m dev.prov -U -o output.ipa demo.ipa
Check the signing certificate of any supported file and perform an OCSP revocation check against Apple's servers. Reads binaries directly from inside IPA files without extracting to disk.
Supported file types: .ipa, .mobileprovision, .p12/.pfx, .cer/.pem, Mach-O binaries
# Check an IPA
zsign -C demo.ipa
# Check a provisioning profile
zsign -C dev.mobileprovision
# Check a P12/PFX certificate
zsign -C dev.p12 -p 123
# Check a Mach-O binary
zsign -C demo.app/demo
# Sign and verify certificate before archiving
zsign -C -k dev.p12 -p 123 -m dev.prov -o output.ipa demo.ipa
Example output:
>>> Check: demo.ipa (IPA)
>>> Signed: Yes
>>> Name: Apple Distribution: Company Name (TEAMID)
>>> Type: Apple Distribution
>>> Org: Company Name
>>> Team: TEAMID
>>> Serial: XX:XX:XX:XX:XX:XX:XX:XX
>>> Issued: 2025-01-01T00:00:00Z
>>> Expires: 2026-01-01T00:00:00Z (365 days remaining)
>>> Algorithm: RSA 2048-bit
>>> Issuer: Apple Worldwide Developer Relations Certification Authority
>>> OCSP: Valid (ocsp.apple.com)
Unzip the IPA first, then sign the extracted folder. On the first sign, zsign caches signature data in .zsign_cache. Subsequent re-signs with different assets reuse the cache, making the process significantly faster — a key advantage over running codesign from scratch on every build.
Q: Does zsign require macOS or Xcode?
No. zsign runs natively on Linux, Windows, macOS, Android, and FreeBSD without Xcode or Apple's codesign binary.
Q: Can I use zsign in CI/CD pipelines? Yes. zsign is a single static-linkable binary designed for automation — Linux runners, Docker images, and Windows build agents all work.
Q: Does zsign support SHA256-only code directories?
Yes, via -2 / --sha256_only.
Q: How does zsign compare to Apple's codesign?
zsign is cross-platform, scriptable on non-Apple hosts, supports dylib injection out of the box, and uses a signature cache for fast re-signing.
zsign is licensed under the MIT License. See the LICENSE file.
No open issues yet, or sync has not completed.