Skip to main content

​
Fields

FieldTypeRequiredDescription
namestringrequiredPublisher display name shown in the trust prompt
signingobjectoptionalPackage signing configuration
signing.schemeenumrequired (if signing present)Must be ed25519
signing.signatureFilestringrequired (if signing present)Relative path to the detached signature file within the package
signing.publicKeyFilestringrequired (if signing present)Relative path to the publisher’s public key within the package

​
Example

publisher:
  name: Example Inc.
  signing:
    scheme: ed25519
    signatureFile: signatures/package.sig
    publicKeyFile: signatures/publisher.pub

​
Signing workflow

  1. Generate a keypair: vibe keygen -o my-signing
  2. Package the app: vibe package vibe.yaml -o myapp.vibeapp
  3. Sign the package: vibe sign myapp.vibeapp --key my-signing.key
  4. The signing tool adds signatures/package.sig and signatures/publisher.pub to the archive and updates the manifest’s publisher.signing fields

​
Trust store

The Vibe macOS host app maintains a user-level trust store of public keys. When a signed package is opened:
  • If the publisher’s public key is in the trust store → Signed + Trusted (green)
  • If valid but not in trust store → Signed + Untrusted (yellow, prompt to trust)
  • If signature is invalid or content is tampered → Tampered (red block)
Omitting publisher.signing is fine for development. Recipients will see an “Unsigned (Dev Mode)” warning. Always sign packages you distribute publicly.