CLIKit User Guide

CLIKit is free.

What you need

• A Mac running macOS 14.6 or later
• An Apple Developer Program membership
• A Developer ID Application certificate installed in your keychain (signs your app and DMG)
• Optional: a Developer ID Installer certificate (only needed to notarize PKG files)
• Xcode or the Xcode Command Line Tools. If you don't have either, run:

xcode-select --install

Install

• From DMGKit: Launch DMGKit > Settings > CLIKit
• Direct download: https://dmgkit.app/CLIKit/CLIKit.dmg

Check that it worked:

clikit --version

You should see CLIKit 1.0.0.

Your settings are stored in ~/.config/clikit/.

First-time setup

Run:

clikit setup

CLIKit asks a few short questions. Press Return to accept the value shown in brackets.

1. DMGKit settings - if DMGKit is installed and set up on this Mac, CLIKit offers to reuse its signing identity, notarization profile and preferences. Answer y to copy them.
2. Developer ID Application - pick your certificate from the list.
3. Developer ID Installer - pick it if you plan to make PKG files, or choose None.
4. Notarization credentials - choose one:
   • An existing keychain profile - type its name.
   • Create a keychain profile now - enter your Apple ID email and Team ID. Apple's notarytool then asks for an app-specific password, which you create at account.apple.com under Sign-In and Security, App-Specific Passwords. CLIKit never sees or stores your password.
   • An App Store Connect API key - give the path to your AuthKey_XXXX.p8 file, the key ID and the issuer ID (leave the issuer empty for individual keys).
   • Don't notarize.
5. Default output - DMG or PKG.
6. DMG window size - compact (960 × 600), small, balanced, large or standard (1600 × 1000).
7. Deep signature verification and notarize the app bundle first - optional extras.

CLIKit checks your credentials with Apple before saving.

When it's done, check everything at any time with:

clikit doctor

Your first release

1. Prepare a folder

Create a folder named after your release, for example MyApp, and put inside it:

2. Preview what will happen

clikit start ~/Releases/MyApp --dry-run

Nothing is changed. CLIKit lists the app, template, license documents and output it found, and the steps it will run.

3. Build

clikit start ~/Releases/MyApp

CLIKit then:

1. Copies your app into a temporary workspace (your original app is never changed)
2. Signs the app
3. Builds the DMG (or PKG)
4. Signs, notarizes and staples it with Apple (this can take a few minutes)
5. Checks signing, notarization and stapling

The result is saved in the same folder as MyApp.dmg. If every check passes, you're ready to ship.

You can also run clikit start from inside the folder with no path at all.

Making a PKG instead of a DMG

clikit start ~/Releases/MyApp --format pkg

The PKG installs your app into /Applications by default, and users can choose another location. Notarizing a PKG requires a Developer ID Installer certificate.

Using your DMGKit design

1. In DMGKit, design your DMG background in the Designer and save it as a template (.dkt).
2. Put the .dkt file in your release folder.
3. Run clikit start. The DMG uses your background, pill colors and label styling.

Use a specific template with --template path/to/file.dkt, or ignore one in the folder with --no-template.

License agreements

Put your documents in the release folder. Most common formats work: RTF, RTFD, Word (.docx, .doc), OpenDocument (.odt), HTML, Markdown, plain text and PDF.

The file name decides which section a document becomes:

Examples: legal.rtf, MyApp License.pdf, privacy-policy.md, Terms and Conditions.docx.

Translations: add a language code at the end of the name, for example eula_fr-FR.pdf or privacy_de-DE.rtf. Files without a code are English. An English version is required; other languages are added when present.

Supported language codes: en-US, en-GB, ar, zh-Hans, zh-Hant, nl, fr-FR, de-DE, hi, id, it-IT, ja, ko, pl, pt-BR, ru, es-ES, th, tr, uk, vi.

To build without the agreement, add --no-license.

All commands

Commands and options never need capital letters.

Options for clikit start

Output

Signing and notarization

DMG layout

Output style (all commands)

Changing your settings later

Run the questions again. Every answer starts on your current choice, so you only change what you need:

clikit setup

Or change one setting directly:

clikit setup --format pkg
clikit setup --profile my-other-profile
clikit setup --identity "Developer ID Application: Your Name (TEAMID)"
clikit setup --key ~/Keys/AuthKey_ABC123.p8 --key-id ABC123 --issuer YOUR-ISSUER-ID
clikit setup --create-profile new-notary --apple-id you@example.com --team-id TEAMID
clikit setup --window balanced

To change something for one build only, add the option to clikit start, for example clikit start --format pkg.

Where settings come from

When the same setting is set in more than one place, CLIKit uses the first one found in this order:

1. Options on the command line
2. Environment variables
3. A clikit.json file in the release folder
4. Your saved setup (~/.config/clikit/config.json)
5. Built-in defaults

clikit doctor shows the value of every setting and where it came from.

Example clikit.json:

{
  "format": "pkg",
  "window": "balanced",
  "deepVerify": true
}

Available settings:

Your secrets stay safe: passwords live only in your keychain and API keys only in their .p8 file. CLIKit never writes them to its settings or shows them in its output.

Automation and CI

CLIKit works over SSH, in CI and in scripts:

• It never opens windows, uses Finder or asks questions when there's no interactive Terminal.
• Progress goes to stderr; only the path of the finished file goes to stdout:

DMG=$(clikit start ./release --yes)

• --json prints machine-readable events and a final summary.
• Credentials can come from environment variables. For example, with an API key:

export CLIKIT_IDENTITY="Developer ID Application: Your Name (TEAMID)"
export CLIKIT_API_KEY_PATH="$HOME/keys/AuthKey_ABC123.p8"
export CLIKIT_API_KEY_ID="ABC123"
export CLIKIT_API_ISSUER="your-issuer-id"
clikit start ./release --yes --json

• Press Ctrl-C at any time. CLIKit stops cleanly, removes its temporary files and leaves no disk images mounted.

Exit codes

Every result has its own exit code, so scripts know exactly what happened:

Checking any file

clikit verify MyApp.dmg
clikit verify MyApp.app --deep
clikit inspect MyApp.pkg

verify gives a quick pass or fail for signing, notarization and stapling. inspect gives the full report with a trust score, just like DMGKit's Reports screen.

Troubleshooting

"CLIKit is not set up yet"
Run clikit setup, or pass your certificate and credentials as options.

"The signing identity was not found in your keychain"
Open Keychain Access and check that your Developer ID Application certificate is installed under My Certificates. clikit doctor lists the certificates CLIKit can see.

"Apple did not accept these credentials"
Your keychain profile name or API key is wrong or expired. Run clikit setup and choose new credentials.

"No .app or .zip was found"
Put your exported app in the folder, or pass its path directly: clikit start ~/Desktop/MyApp.app.

"More than one app" or "more than one template"
Choose one with --app <name> or --template <file>.

"already exists"
Add --overwrite, or choose another --name or --output.

The license agreement doesn't appear
Check that the file name contains privacy, terms, eula, license, legal or agreement, and that there's an English version. clikit start shows which documents it found next to "License agreement:".

Notarization takes a long time
That's normal. Apple's service can take from a minute to over an hour. Add --verbose to see what's happening.

Still stuck?
Run the command again with --verbose and send the output to Fuse Labs Support.

Related guides

Code signing & notarization setupRead next →Design a macOS DMG installerRead next →DMGKit Inspector guideRead next →