Pipeline checks and fixes
Every build goes through the same checks, usually in under an hour. Run them yourself first with npx appxi check <file>.
Outcomes
| Status | Meaning |
|---|---|
approved | Live for buyers, and in the update feed within five minutes. |
limited | Passed the automatic checks but needs a person to confirm one finding. |
denied | Not listed. Each finding says how to fix it; upload a new build. |
frozen | A listed file changed or a new detection matched. Downloads stop until a person reviews it. |
withdrawn | You rolled it back; the previous build is served again. |
Checks
- Format and size. The file type matches its contents and is under 4 GB.
- Hash. AppsXi records the SHA-256 and SHA-512 of the exact file and shows it on the listing.
- Malware scan. ClamAV on the file and everything inside it, signatures updated daily. Approved builds are rescanned as signatures change.
- Signature and notarization. Developer ID and notarization on Mac, Authenticode on Windows.
- Signer pinning. The signer must be on your account.
- Code integrity. Hardened Runtime, entitlements, library paths, Electron fuses on Mac; signed bundled programs, ASLR and DEP on Windows.
- Secrets. Hardcoded live keys and private keys.
- Purchase integrity. Links to outside checkouts in a paid app.
- Updates. The updater points at the AppsXi feed, and Sparkle updates carry a valid EdDSA signature.
Fixes
| Finding | Fix |
|---|---|
| Not notarized | xcrun notarytool submit --wait, then xcrun stapler staple the .app (and .dmg), and upload again. |
| Not signed | Sign every executable with your Developer ID (Mac) or code signing certificate (Windows) before packaging. |
| Signed by an identity not on your account | Sign with the identity on your account, or add this one under Profile → Signing identities. |
| Entitlement | Remove the named entitlement (Xcode: Signing & Capabilities) and rebuild. |
| Malware detection | If you believe it is a false positive, reply to the decision email; a person reviews it. |
| Updater points outside AppsXi | Point the updater at your AppsXi feed, or turn it off, and upload again. |
| Sparkle signature | Run sign_update on exactly the file you upload (after notarizing and stapling) and send its signature with the build (--ed-signature or --sparkle-sign). |
| Hardcoded key | Remove it from the app and rotate it now; anyone can extract it. Call the service from your own server. |
| Outside checkout | Link to your AppsXi listing or use the AppsXi helper's checkout, or remove the link from the AppsXi build. |
| EdDSA key changed | Follow Sparkle's key rotation: sign the new version with the old key as well. A person reviews it. |
Secret findings are shown only to you, never on the public listing.