Changelog
What shipped, and when
Every meaningful change to HexSign, newest first. Each entry links to the documentation for the thing it describes, so this doubles as a way in if you missed something.
Seventeen more signing error pages
The signing error reference went from 3 pages to 20. The new ones cover what turns up most in support threads: 'Command CodeSign failed with a nonzero exit code', 'errSecInternalComponent', 'The executable was signed with invalid entitlements', 'resource fork, Finder information, or similar detritus not allowed', and the fastlane 'Your session has expired. Please log in.' Every page keeps the same shape, the verbatim message first, then the fix for a local Mac and the fix for CI. Ten glossary terms now link into them inline, so a definition hands you the error page at the point the error would actually bite.
The homepage leads with the relationship graph
The hero no longer opens on a terminal mock. It renders the live relationship graph instead, the same view that ties certificates, profiles, devices, and bundle IDs together in the dashboard. Below it, and on the security page, a compliance strip states only what is true today: keys generated inside the vault and held in AWS KMS, infrastructure on AWS, personal data handled under the GDPR and the Australian Privacy Principles, and no SOC 2 Type II report yet. Saying that last part in a sentence is better than a badge implying an audit nobody has run.
Appcircle and Expo EAS pages, and three comparisons reframed
New pages for Appcircle and Expo EAS, both of which fold signing material into their own build service. The Codemagic, Bitrise, and Xcode Cloud pages stopped presenting a choice that was never real: HexSign is not a CI, so those are now 'works with' pages about keeping the certificates your existing pipeline signs with from quietly expiring. The fastlane match alternatives guide was rewritten as a straight comparison of eight options, Capawesome Cloud included, covering what each one stores, whether it renews and alerts, which CI it ties you to, and how to migrate off match one pipeline at a time.
Bylines, longer help intros, and this changelog
Guides, error pages, and comparisons now show who wrote them and when they were last reviewed, which the structured data on those pages had been claiming without the page ever saying it. Help category and hub intros grew from one line into something that says who the category is for and which article to read first. This changelog launched alongside them, dated from the content itself rather than from memory. PostHog is gone from both the marketing site and the dashboard; the marketing site runs Google Analytics only, and the privacy policy no longer lists PostHog as a processor.
Signing error reference, and a guide to building iOS apps on Windows
A new section covering the exact Apple toolchain errors that stop a build, each page leading with the verbatim message and then the fix for both a local Mac and CI. Alongside it, a guide for teams shipping iOS without owning a Mac: what genuinely works from Windows, what needs macOS and why, and four routes to a signed .ipa.
Auto-renewal for certificates and provisioning profiles
Distribution certificates and provisioning profiles now reissue themselves 30 days before they expire. The replacement certificate keeps your existing private key, and every profile built against the old one rebuilds in the same run. The old certificate is left alone rather than revoked, so nothing already in flight breaks.
Upload a private key for a certificate created outside HexSign
If a certificate was issued before you started using HexSign, you can now upload its private key and bring it fully under management, including auto-renewal, instead of starting over with a fresh certificate.
CircleCI orb
An official orb that fetches signing material into a CircleCI macOS job, so a signed build is a couple of lines of config rather than a hand-written keychain script.
GitLab CI/CD component
A reusable component for GitLab pipelines. It installs the CLI, authenticates with machine credentials, and puts certificates and profiles where xcodebuild expects them.
Bitrise Step: Fetch Signing Material
A first-party Bitrise Step that pulls signing assets from the vault into the workflow, replacing Bitrise's own code signing file storage.
fastlane plugin
fastlane-plugin-hexsign fetches certificates and profiles inside a lane, with a keychain option that saves you calling import_certificate yourself. The migration path off fastlane match without leaving fastlane.
GitHub Action: setup-hexsign-cli
Installs and authenticates the CLI on a GitHub Actions runner in one step, with a pinnable CLI version so a release workflow cannot drift underneath you.
The HexSign CLI
A single binary that pulls certificates and profiles straight from the vault into any pipeline or shell. OAuth login on a developer machine, machine credentials in CI, JSON output for scripting, and full coverage of certificates, profiles, and devices.
Provisioning profile wizard
A guided flow that picks the right identifier, certificate, and devices, then creates the profile through Apple's API. It is the part of the Developer Portal that most often goes wrong by hand.