Code signing your app lets users trust that your app has been created by a source known to Apple and that it hasn’t been tampered with. All apps must be code signed and provisioned to launch on a device, to use certain services, to be distributed for testing, or to be uploaded to iTunes Connect. Code signing uses cryptographic technology to digitally sign your app and installer package. You create signing identities—stored in your keychain—and certificates—stored in your developer account—to sign and provision your app. These assets uniquely identify you or your team, so it’s important to keep them safe. This chapter covers common tasks that you perform to protect and maintain your signing identities and certificates over the lifetime of your project.
给你的App签名，可以让使用者信任是来自苹果公司，而且没有被篡改。所有的Apps必须被代码签过名的，而且能够在设备上启动，使用特定的设备，或者做分发测试，或者上传到iTunes Connect。代码签名使用加密技术自动地给你的App签名而且安装新包。你创建签名的身份-存储在钥匙串里面-还有证书-保存在你的开发者账号里面--去签名和启动你的App。这些资料用来独一无二的标识你或者你的团队，所以确保它的安全是很重要的。这一章节涵盖了常见的任务，你可以去保护和持有你的签名标识和证书在你的项目的周期内。
About Signing Identities and Certificates 关于签名身份和证书
Code signing your app allows the operating system to identify who signed your app and to verify that your app hasn’t been modified since you signed it. Your app’s executable code is protected by its signature because the signature becomes invalid if any of the executable code in the app bundle changes. Note that resources such as images and nib files aren’t signed; therefore, a change to these files doesn’t invalidate the signature.
代码签名你的app可以允许操作系统识别出谁对你的App签过名，识别出你的App有没有被更改自从你签完名以后。你的App可执行代码是被它的签名所保护的，这是因为在App bundle里面的可执行代码改变时，这个签名是独一无二的。特别指出：资源比如图片和nib文件是不会被签名的，因此，对这些文件进行更改，签名不会是唯一的。
Code signing is used in combination with your App ID, provisioning profile, and entitlements to ensure that:
-
Your app is built and signed by you or a trusted team member.
-
Apps signed by you or your team run only on designated development devices.
-
Apps run only on the test devices you specify.
-
Your app isn’t using app services you didn’t add to your app.
-
Only you can upload builds of your app to iTunes Connect.
-
If you choose to distribute outside of the store (Mac only), the app can’t be modified and distributed by someone else.
代码签名是和你的APPID、签名文件，有权利保证如下几条：
- 你的App由你或者你信任的团队成员编译和签名；
- 被你或者你的团队签过名的Apps只能运行在指定的开发设备上；
- Apps只能运行在测试设备上，像你上面说的；
- 你的App不能使用你没有添加在App上的服务；
- 只有你可以在iTunes Connect上传你的App的构建版本；
- 如果你选择在store意外的地方分发你的App，这个App不能由其他人员修改和分发。
Code signing also allows your app’s signature to be removed and re-signed by a trusted source. For example, you sign your app before uploading it to iTunes Connect, but Apple re-signs it before distributing it to customers. Also, you can re-sign and submit a fully tested development build of your app to the store.
代码签名同样允许你的App的签名被修改和被其他受信任的来源重新签名。比如：你在上传到iTunes Connect之前对App进行了签名，但是苹果公司在分发给其他顾客时，会对它进行重新签名。而且，你可以重新签名和提交一个全测试开发版本的App到商店。
Xcode uses your signing identity to sign your app during the build process. This signing identity consists of a public-private key pair that Apple issues. The public-private key pair is stored in your keychain, and used by cryptographic functions to generate the signature. The certificate stored in your developer account contains just the public key. An intermediate certificate is also required to be in your keychain to ensure that your certificate is issued by a certificate authority.
Xcode使用你的签名身份在编译阶段对你的App进行签名。这个签名身份包括公钥和私钥由苹果公司提供的。这一对公钥和私钥被保存在你的钥匙串里面，通过加密的方式生成签名。在你的开发整账号里面的证书，只包含公钥。一个中间的证书同样需要在你的钥匙串里面来保证你的证书是由证书机构颁发的。
Signing requires that you have both the signing identity and the intermediate certificate installed in your keychain. When you install Xcode, Apple’s intermediate certificates are added to your keychain for you. You use Xcode to create your signing identity and sign your app. Your signing identity is added to your keychain, and the corresponding certificate is added to your developer account.
签名需要你有签名身份和你的钥匙串里面的中间证书。当你安装Xcode时，苹果公司的中间证书也会安装到你的钥匙串里面。你可以使用Xcode去生成你的签名身份并且 对你的App进行签名。你的签名身份是被添加到钥匙串里面的，而且相对应的证书会添加到你的开发者账号。
Signing identities are used to sign your app or installer package. A development certificate identifies you, as a team member, in a development provisioning profile that allows apps signed by you to launch on devices. A distribution certificate identifies your team or organization in a distribution provisioning profile and allows you to submit your app to the store. Only a team agent or an admin can create a distribution certificate. You use the same development and distribution certificates for iOS, tvOS, and watchOS apps. You use different development and distribution certificates for Mac apps. For a complete list of certificate types, refer to Your Signing Certificates in Depth.
签名身份用来对你的App进行签名或者安装包。一个开发证书辨认出你，作为一个团队成员，在一个开发配置文件里面允许你签名的Apps可以在设备上启动。一个分发证书标识你的团队或者机构在一个分发配置证书里面，可以允许你提交App到上吊。只有团队的代理人或者管理者可以生成分发证书。你可以使用相同的开发、分发证书开发iOS、tvOS、watchOS Apps。你需要使用不同的开发和发布证书对于你的Mac apps。
For an organization, other team members have their own signing identities installed on their Mac computers. The developer account contains a repository for all of the combined team assets but doesn’t store any of the private keys.
对于一个组织来说，其他团队成员有他们自己的签名证书安装在他们的电脑上。一个开发者账号包含了所有有关团队的资源仓库，但是没有存储他们任何的私钥。
Because the private key is stored locally on your Mac, protect it as you would an account password. Keep a secure backup of your public-private key pair. If the private key is lost, you’ll have to create an entirely new identity to sign code. Worse, if someone else has your private key, that person may be able to impersonate you. In the wrong hands, someone might attempt to distribute an app that contains malicious code. Not only could that cause the app to be rejected, it could also mean your developer credentials could be revoked by Apple. Private keys are stored only in the keychain and can’t be retrieved if lost。
这是因为私钥保存在电脑的本地，保护它像是保存账号密码。保持一个安全的公钥和私钥对。如果私钥找不到了，你需要产生一个完成新的标识去签名代码。更糟糕的，如果其他人有了你的私钥，那这个人就可以冒充你。更糟糕的，有人可能尝试去分发带有谣言的代码。这样不仅会引起你的App被拒绝，而且这也意味着你的开发资格会被苹果公司吊销。你的私钥只能保存在钥匙串里面，如果丢失了，将不能再被取回。
If you want to code sign your app using another Mac, you export your developer profile on the Mac you used to create your certificates and import it on the other Mac. You can also share distribution certificates among multiple team agents using this feature. (Team members should not share development certificates.)
如果你想使用另外一台Mac对你的App进行签名，你可以在你原来生产证书的Mac上导出你的开发文件，而且引入到你的另外一台Mac上。你可以共享分发证书在多个团队代理使用这个特点。（团队成员不能分享开发证书）（只能是管理员才能导出，刚试了不是管理员的账号，导不出来）