zsign

zsign — Fast Cross-Platform iOS Code Signing Tool

Languages: English | 简体中文

zsign is a fast, open-source, cross-platform codesign alternative for iOS 12+. It re-signs .ipa packages, Mach-O binaries, and .app bundles with custom certificates and provisioning profiles — without Xcode, without macOS. Ideal for iOS app re-signing, dylib injection, CI/CD pipelines, and IPA distribution workflows on Linux and Windows servers.

Keywords: iOS code signing · codesign alternative · re-sign IPA · Mach-O signing · dylib injection · iOS CI/CD · Linux iOS signing · Windows iOS signing · p12 signing · provisioning profile · OCSP check · ad-hoc signature

If this tool helps you, please give it a ⭐ star — zhlynn

Table of Contents

• Features
• Supported Platforms
• Build
• Usage
• Examples
• Certificate Check (-C)
• Fast Re-signing
• License

Features

• Fast IPA re-signing with persistent .zsign_cache — subsequent signs skip unchanged Mach-Os
• Cross-platform — runs on macOS, Linux, Windows, Android, and FreeBSD (no Xcode required)
• Dylib injection / removal — LC_LOAD_DYLIB and LC_LOAD_WEAK_DYLIB support
• Multi-profile signing — per-extension provisioning profiles for apps with extensions
• Bundle editing — change bundle ID, display name, version, minimum OS version, entitlements
• Ad-hoc signing — sign without a developer certificate
• Certificate / OCSP check — inspect certificates in .ipa, .p12, .mobileprovision, .cer, .pem, or Mach-O
• Metadata extraction — pull Info.plist fields and app icon to metadata.json + PNG
• Bundle cleanup — remove app extensions, watch apps, UISupportedDevices
• Files app integration — toggle UISupportsDocumentBrowser and UIFileSharingEnabled

Supported Platforms

macOS · Linux · Windows · Android · FreeBSD

Build

macOS

brew install pkg-config openssl
git clone https://github.com/zhlynn/zsign.git
cd zsign/build/macos
make clean && make

Linux

Ubuntu / Debian

sudo apt-get install -y git g++ pkg-config libssl-dev
git clone https://github.com/zhlynn/zsign.git
cd zsign/build/linux
make clean && make

RHEL / CentOS / Alma / Rocky

Install epel-release first:

sudo yum -y install epel-release

Then build:

sudo yum install -y git gcc-c++ pkg-config openssl-devel
git clone https://github.com/zhlynn/zsign.git
cd zsign/build/linux
make clean && make

Linking system minizip/zlib

By default the vendored zlib + minizip sources in src/third-party/ are compiled in, so no extra packages are needed. Package managers that require unbundled libraries (e.g. Homebrew) can link the system copies instead:

make clean && make SYSTEM_MINIZIP=1    # links minizip (requires pkg-config minizip)
make clean && make SYSTEM_MINIZIP=ng   # links minizip-ng via its minizip compat layer

Windows

Open build/windows/vs2022/zsign.sln in Visual Studio 2022 and build.

Usage

…

Examples

Show Mach-O and codesignature info:

zsign demo.app/demo

Sign an IPA:

zsign -k privkey.pem -m dev.prov -o output.ipa -z 9 demo.ipa

Sign with p12 (cached):

zsign -k dev.p12 -p 123 -m dev.prov -o output.ipa demo.app

Sign with p12 (force, no cache):

zsign -f -k dev.p12 -p 123 -m dev.prov -o output.ipa demo.app

Ad-hoc sign:

zsign -a -o output.ipa demo.ipa

Inject dylib and re-sign:

zsign -k dev.p12 -p 123 -m dev.prov -l demo.dylib -o output.ipa demo.ipa

Inject dylib into the app and its extensions:

# App extensions (PlugIns/*.appex) run as separate processes and don't inherit
# the main app's injected dylibs, so -P injects into them too. The dylib is kept
# as a single copy at the app root and referenced from each extension by a
# relative path (@executable_path/../../demo.dylib).
zsign -k dev.p12 -p 123 -m dev.prov -P -l demo.dylib -o output.ipa demo.ipa

Change bundle id and name:

zsign -k dev.p12 -p 123 -m dev.prov -b 'com.new.bundle.id' -n 'NewName' -o output.ipa demo.ipa

Change app icon:

zsign -k dev.p12 -p 123 -m dev.prov -I newicon.png -o output.ipa demo.ipa
# replaces the primary icon PNGs referenced by Info.plist and removes
# CFBundleIconName so the new icon takes effect (a square PNG is recommended)

Inject dylib (LC_LOAD_DYLIB) into Mach-O:

zsign -a -l "@executable_path/demo1.dylib" -l "@executable_path/demo2.dylib" demo.app/execute

Inject weak dylib (LC_LOAD_WEAK_DYLIB):

zsign -w -l "@executable_path/demo.dylib" demo.app/execute

Extract metadata and icon:

zsign -k dev.p12 -p 123 -m dev.prov -x ./metadata -o output.ipa demo.ipa
# outputs ./metadata/metadata.json and ./metadata/<hash>.png
# Apple-optimized (CgBI) icons are converted to standard PNG automatically

Enable Files app integration:

zsign -k dev.p12 -p 123 -m dev.prov -S -o output.ipa demo.ipa

Set minimum OS version:

zsign -k dev.p12 -p 123 -m dev.prov -M 14.0 -o output.ipa demo.ipa

Remove app extensions:

zsign -k dev.p12 -p 123 -m dev.prov -E -o output.ipa demo.ipa

Remove watch app:

zsign -k dev.p12 -p 123 -m dev.prov -W -o output.ipa demo.ipa

Remove UISupportedDevices:

zsign -k dev.p12 -p 123 -m dev.prov -U -o output.ipa demo.ipa

Certificate Check (-C)

Check the signing certificate of any supported file and perform an OCSP revocation check against Apple's servers. Reads binaries directly from inside IPA files without extracting to disk.

Supported file types: .ipa, .mobileprovision, .p12/.pfx, .cer/.pem, Mach-O binaries

# Check an IPA
zsign -C demo.ipa

# Check a provisioning profile
zsign -C dev.mobileprovision

# Check a P12/PFX certificate
zsign -C dev.p12 -p 123

# Check a Mach-O binary
zsign -C demo.app/demo

# Sign and verify certificate before archiving
zsign -C -k dev.p12 -p 123 -m dev.prov -o output.ipa demo.ipa

Example output:

>>> Check:      demo.ipa (IPA)
>>> Signed:     Yes
>>> Name:       Apple Distribution: Company Name (TEAMID)
>>> Type:       Apple Distribution
>>> Org:        Company Name
>>> Team:       TEAMID
>>> Serial:     XX:XX:XX:XX:XX:XX:XX:XX
>>> Issued:     2025-01-01T00:00:00Z
>>> Expires:    2026-01-01T00:00:00Z (365 days remaining)
>>> Algorithm:  RSA 2048-bit
>>> Issuer:     Apple Worldwide Developer Relations Certification Authority
>>> OCSP:       Valid (ocsp.apple.com)

Fast Re-signing

Unzip the IPA first, then sign the extracted folder. On the first sign, zsign caches signature data in .zsign_cache. Subsequent re-signs with different assets reuse the cache, making the process significantly faster — a key advantage over running codesign from scratch on every build.

FAQ

Q: Does zsign require macOS or Xcode? No. zsign runs natively on Linux, Windows, macOS, Android, and FreeBSD without Xcode or Apple's codesign binary.

Q: Can I use zsign in CI/CD pipelines? Yes. zsign is a single static-linkable binary designed for automation — Linux runners, Docker images, and Windows build agents all work.

Q: Does zsign support SHA256-only code directories? Yes, via -2 / --sha256_only.

Q: How does zsign compare to Apple's codesign? zsign is cross-platform, scriptable on non-Apple hosts, supports dylib injection out of the box, and uses a signature cache for fast re-signing.

License

zsign is licensed under the MIT License. See the LICENSE file.