Signing

peko keys list
peko keys verify

verify reports what each platform requires and whether the material is present and valid. Apple and Android must be signed to ship. Windows signing is optional for direct distribution and not needed at all for the Store, which re-signs. Linux has no signing model.

Key files live in .peko/keys/<platform>/ and passwords go to the OS keychain, keyed by the project's bundle id. One keychain prompt per run.

Registering material you have

peko keys add --platform android --keystore upload.keystore --alias upload --password secret
peko keys add --platform ios --cert dist.p12 --profile app.mobileprovision --password secret
peko keys add --platform macos --cert devid.p12 --password secret
peko keys add --platform windows --pfx codesign.pfx --password secret

--password-file reads the password from a file, which keeps it out of your shell history and out of the process arguments.

macOS notarization needs an App Store Connect API key, registered together: --notary-issuer, --notary-key-id, --notary-p8.

Generating material

Both flows work from any host, so Apple material can be produced without a Mac.

Android. Creates a PKCS#12 upload keystore with the bundled JDK and registers it:

peko keys generate --platform android --password-file pw.txt

Back this file up. Play ties the app listing to the upload key, and updates cannot be signed with a different one.

Apple. Two steps with a visit to the developer portal between them:

peko keys generate --platform apple --email you@example.com
# upload the .certSigningRequest at developer.apple.com, download the .cer
peko keys p12 --platform ios --cer downloaded.cer --password-file pw.txt

--installer on the second step builds the Mac Installer Distribution certificate that signs the macOS App Store .pkg.

The p12 step checks that the certificate actually matches the key it kept, and refuses a mismatched pair rather than producing a .p12 that fails later.

In CI

peko build --release takes signing material directly, bypassing the keychain:

peko build --release --platform macos \
  --p12 dist.p12 --p12-password-file p12.pw \
  --installer-p12 installer.p12 --installer-password-file installer.pw

When --p12 is given it wins over any registered key, and it is all-or-nothing: the provisioning profile and entitlements then come only from flags. An iOS build this way needs --provisioning-profile.

Android and Windows have no headless flags and always use the registry.

What happens when a key is missing

At --release, iOS and Android fail the build. macOS warns and produces an unsigned bundle. Windows warns, but a Windows release always emits an .msix and needs the [windows] identity keys regardless.