Code signing tells the operating system who built your Electron app, and on macOS the built in auto updater will not work without it. Notarization adds an Apple scan on top. Your update channel is a software delivery path, so protect the signing keys and the server as carefully as the app.
What signing does
According to the Electron docs, Windows and macOS block unsigned apps by default. Users can still run them after several manual steps, which most customers will not do and security teams should not tell them to do.
On macOS, the process has two parts: sign the app, then submit it to Apple for notarization, where automated checks look for things that could harm users. On Windows, the docs describe cloud signing services and certificate options, and note that Extended Validation certificates have been required since June 2023 for the warning free experience. Certificate rules change, so check the current page before buying anything.
Updates depend on signing
The docs say Squirrel.Mac requires a signed app for the autoUpdater to work. They also say several Electron APIs behave inconsistently in unsigned or ad hoc builds, including safeStorage.
Choosing an update source
The updates guide lists four routes.
- A static file location on cloud storage, with release metadata beside each build.
- The free hosted update service maintained by the Electron team, for apps with public GitHub repositories and published releases.
- A third party update server.
- A custom Squirrel compatible server, for rollouts, channels or authentication.
Each puts a different party in your delivery path. Ask who can write to that location. Anyone who can replace a release file can ship code to every install, subject to the signature checks the platform applies.
Safe operating habits
- Only run update logic in packaged builds. The docs suggest checking
app.isPackaged. - Serve update metadata over HTTPS. The docs show only HTTPS URLs in examples, though they do not state a rule.
- Listen for the updater error event and log it.
- Keep signing keys in a hardware backed or cloud signing service, not on a laptop.
- Separate who can publish releases from who writes code, and require review for release changes.
The docs do not describe verification of update payloads beyond platform signing, or rollback protection, so decide for yourself whether your channel needs more.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how a gate can stop a risky change from merging, then think about adding the same kind of check to changes in your release workflow.
Quick check
Can I skip signing if my app is internal only?
You can run it, but users will meet warnings or blocks, and macOS auto update will not work. Signing is cheap compared with training people to bypass warnings.
Sources
Last reviewed: 19 October 2026.
