Stado

CLI reference / product / signing

stado product signing

Invocation

stado product signing [OPTIONS] <COMMAND>

Purpose

Inspect and preserve stable Apple native code identity

Required inputs and options

Input or optionContract
--catalog <catalog>Independent authoritative catalog path
--workspace <workspace>The workspace of canonical checkouts this operation reads and builds from; default WISENT_WORKSPACE, else ~/Documents/CodingProjects/Wisent

Output and state effect

This command group selects one of the subcommands listed below; use its exact child invocation to perform an operation.

Refusals

  • Before dispatch, Stado refuses a missing required token shown in the invocation, an unknown option, or a value outside a listed value set; argument-usage failures exit with code 2.

Subcommands

  • inspect — Inspect actual signatures on files or bundles
  • sign — Sign staged code and atomically replace only verified targets
  • report — Read signatures of a product's recorded installation
  • reconcile — Repair unstable signatures on recorded installed paths
  • residue — Report obsolete signed installer staging paths
  • stage — Sign only the native files declared in a release manifest
  • notarize — Notarize a signed .app with Apple's notary (AC_API_KEY_ID, AC_API_ISSUER_ID, AC_API_KEY_P8), staple it and check Gatekeeper; the notary's answer goes to --evidence, default $WISENT_OUTPUT_DIR/notary.json