Package standard

AppsXi lists the exact file you upload. It never rebuilds, repackages or re-signs it, so the signature always names you.

Formats

PlatformAcceptedNotes
macOS.dmg, .pkg, .zipA .zip or .dmg contains the .app. A .pkg must be signed with a Developer ID Installer certificate.
Windows.msix, .msi, .exe, .zip.msix is preferred: it installs cleanly and updates through App Installer.

Files are 1 byte to 4 GB.

Which file to upload

Upload one file per platform: the same installer you would put on your website. Buyers download exactly that file, so it must contain everything they paid for.

  • A Mac app: the .dmg or .zip with the .app inside.
  • Audio plugins (AU, VST3, CLAP), drivers, or anything installed outside Applications: a .pkg.
  • An app and plugins you ship as two downloads: combine them into one .pkg that installs both (or a .dmg holding that .pkg). Uploading only the plugins .pkg means buyers get only the plugins.
  • Windows: your signed installer, .msix, .msi or .exe, or a .zip of the signed app.

macOS

  • Every executable is signed with a Developer ID Application certificate, with Hardened Runtime on.
  • The app (and the .dmg or .pkg) is notarized and the ticket is stapled: xcrun notarytool submit --wait, then xcrun stapler staple.
  • No blocked entitlements: com.apple.security.cs.disable-executable-page-protection, com.apple.security.get-task-allow.
  • Entitlements that allow code injection (allow-dyld-environment-variables, disable-library-validation) are reviewed by a person.
  • Library paths must not point to folders anyone can write to.

Windows

  • The installer and the programs inside it carry a valid Authenticode signature from a trusted certificate (a cloud HSM such as Azure Trusted Signing is fine).
  • Bundled programs are built with ASLR and DEP.
  • Silent install is expected for .msix and .msi; for .exe, say in appxi.json how to install silently.

Signer pinning

The first approved build records who signs your app. A later build signed by someone else is blocked until you add that identity to your account (Developer → Profile → Signing identities). This protects your users if your build machine or account is ever compromised.

Inside the app

  • No hardcoded secrets. Live API keys (Stripe, AWS, OpenAI, Anthropic, GitHub, Square and others) in the app are a denial: anyone can extract them. Call the service from your own server.
  • Sell through AppsXi. The AppsXi build of a paid app must not send buyers to an outside checkout. Link to your AppsXi listing or use the AppsXi helper.
  • Updates come from AppsXi. A self-updating app must point its updater at its AppsXi feed, or turn the updater off. See Updates.

appxi.json

Commit an appxi.json next to your project to declare what the app needs (network, permissions, background items). The pipeline compares it with what it finds.