Skip to main content

Re-signing iOS apps without Apple tools

Project description

A tool and library to re-sign iOS applications, without proprietary Apple software.

For example, an iOS app in development would probably only run on the developer’s iPhone. isign can alter the app so that it can run on another developer’s iPhone.

Apple tools already exist to do this. But with isign, now you can do this on operating systems like Linux.

Table of contents



The latest version of isign can be installed via PyPi:

$ pip install isign

Mac OS X

On Mac OS X, there are a lot of prerequisites, so the pip method probably won’t work. The easiest method is to use git to clone the source code repository and run the install script:

$ git clone
$ cd isign
$ sudo ./

How to get started

All the libraries and tools that isign needs to run will work on both Linux and Mac OS X. However, you will need a Mac to export your Apple developer credentials.

If you’re like most iOS developers, credentials are confusing – if so check out the documentation on credentials on Github.

You should have a key and certificate in Keychain Access, and a provisioning profile associated with that certificate, that you can use to sign iOS apps for one or more of your own iOS devices.

In Keychain Access, open the Certificates. Find the certificate you use to sign apps. Right click on it and export the key as a .p12 file, let’s say Certificates.p12. If Keychain asks you for a password to protect this file, just leave it blank.

Next, let’s extract the key and certificate you need, into a standard PEM format.

$ ~/Certificates.p12

If you get prompted for a password, just press Return.

By default, will put these files into ~/.isign, which is the standard place to put isign configuration files.

Finally, you need a provisioning profile from the Apple Developer Portal that uses the same certificate. If you’ve never dealt with this, the provisioning profile is what tells the phone that you Apple has okayed you installing apps onto this particular phone.

If you develop with XCode, you might have a provisioning profile already. On the Mac where you develop with XCode, try running the script. If you typically have only a few provisioning profiles and install on one phone, it might find it.

Anyway, once you have a .mobileprovision file, move it to ~/.isign/isign.mobileprovision.

The end result should look like this:

$ ls -l ~/.isign
-r--r--r--    1 alice  staff  2377 Sep  4 14:17 certificate.pem
-r--r--r--    1 alice  staff  9770 Nov 23 13:30 isign.mobileprovision
-r--------    1 alice  staff  1846 Sep  4 14:17 key.pem

And now you’re ready to start re-signing apps!

How to use isign

If you’ve installed all the files in the proper locations above, then isign can be now invoked on any iOS .app directory, or .ipa archive, or zipped directory. For example:

$ isign -o resigned.ipa my.ipa
archived Ipa to /home/alice/resigned.ipa

You can also call it from Python:

from isign import isign

isign.resign("my.ipa", output_path="resigned.ipa")

isign command line arguments


isign [-h] [-a <path to applecerts.pem>]
           [-c <path to your cert in .pem form>]
           [-k <path to your key in .pem form>]
           [-p <your.mobileprovision>]
           [-o <output path>]
           <path to app to resign>

-a <path>, –apple-cert <path>

Path to Apple certificate in PEM format. This is already included in the library, so you will likely never need it. In the event that the certificates need to be changed, See the Apple Certificate documentation.

-c <path>, –certificate <path>

Path to your certificate in PEM format. Defaults to $HOME/.isign/certificate.pem.

-h, –help

Show a help message and exit.

-k <path>, –key <path>

Path to your private key in PEM format. Defaults to $HOME/.isign/key.pwm.

-o <path>, –output <path>

Path to write the re-signed application. Defaults to out in your current working directory.

-p <path>, –provisioning-profile <path>

Path to your provisioning profile. This should be associated with your certificate. Defaults to $HOME/.isign/isign.mobileprovision.


Development happens on our Github repository. File an issue, or fork the code!

You’ll probably want to create some kind of python virtualenv, so you don’t have to touch your system python or its libraries. virtualenvwrapper is a good tool for this.

Then, just do the following:

$ git clone
$ cd isign
$ dev/
$ ./

If the tests don’t pass please file an issue. Please keep the tests up to date as you develop.

Note: some tests require Apple’s codesign to run, so they are skipped unless you run them on a Macintosh computer with developer tools.

Okay, if all the tests passed, you now have an ‘editable’ install of isign. Any edits to this repo will affect (for instance) how the isign command line tool works.

Sauce Labs supports ongoing public isign development. isign is a part of our infrastructure for the iOS Real Device Cloud, which allows customers to test apps and websites on real iOS devices. isign has been successfully re-signing submitted customer apps in production since June 2015.

This project not have an official code of conduct, yet, but one is forthcoming. Please contribute to discussion here.

More documentation

See the docs directory of this repository for random stuff that didn’t fit here.


Neil Kandalgaonkar is the main developer and maintainer.

Proof of concept by Steven Hazel and Neil Kandalgaonkar.

Reference scripts using Apple tools by Michael Han.

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

ak-isign-0.9.1.tar.gz (31.3 kB view hashes)

Uploaded source

Supported by

AWS AWS Cloud computing Datadog Datadog Monitoring Facebook / Instagram Facebook / Instagram PSF Sponsor Fastly Fastly CDN Google Google Object Storage and Download Analytics Huawei Huawei PSF Sponsor Microsoft Microsoft PSF Sponsor NVIDIA NVIDIA PSF Sponsor Pingdom Pingdom Monitoring Salesforce Salesforce PSF Sponsor Sentry Sentry Error logging StatusPage StatusPage Status page