Changelog
What shipped, and when
Every meaningful change to HexSign, newest first. Each entry links to the documentation for the thing it describes, so this doubles as a way in if you missed something.
Signing error reference, and a guide to building iOS apps on Windows
A new section covering the exact Apple toolchain errors that stop a build, each page leading with the verbatim message and then the fix for both a local Mac and CI. Alongside it, a guide for teams shipping iOS without owning a Mac: what genuinely works from Windows, what needs macOS and why, and four routes to a signed .ipa.
Auto-renewal for certificates and provisioning profiles
Distribution certificates and provisioning profiles now reissue themselves 30 days before they expire. The replacement certificate keeps your existing private key, and every profile built against the old one rebuilds in the same run. The old certificate is left alone rather than revoked, so nothing already in flight breaks.
Upload a private key for a certificate created outside HexSign
If a certificate was issued before you started using HexSign, you can now upload its private key and bring it fully under management, including auto-renewal, instead of starting over with a fresh certificate.
CircleCI orb
An official orb that fetches signing material into a CircleCI macOS job, so a signed build is a couple of lines of config rather than a hand-written keychain script.
GitLab CI/CD component
A reusable component for GitLab pipelines. It installs the CLI, authenticates with machine credentials, and puts certificates and profiles where xcodebuild expects them.
Bitrise Step: Fetch Signing Material
A first-party Bitrise Step that pulls signing assets from the vault into the workflow, replacing Bitrise's own code signing file storage.
fastlane plugin
fastlane-plugin-hexsign fetches certificates and profiles inside a lane, with a keychain option that saves you calling import_certificate yourself. The migration path off fastlane match without leaving fastlane.
GitHub Action: setup-hexsign-cli
Installs and authenticates the CLI on a GitHub Actions runner in one step, with a pinnable CLI version so a release workflow cannot drift underneath you.
The HexSign CLI
A single binary that pulls certificates and profiles straight from the vault into any pipeline or shell. OAuth login on a developer machine, machine credentials in CI, JSON output for scripting, and full coverage of certificates, profiles, and devices.
Provisioning profile wizard
A guided flow that picks the right identifier, certificate, and devices, then creates the profile through Apple's API. It is the part of the Developer Portal that most often goes wrong by hand.