A code signing module is needed to create signed binaries on various platforms. Rule injection also comes into play (QBS-5).

Summary of each relevant platform's code signing follows:

• Apple (macOS, iOS, tvOS, watchOS) - I'm not even going to bother explaining the details here, because it is massively complex. The basics are already implemented, and https://codereview.qt-project.org/#/c/127050/ (WIP) should finish it off before creation of a dedicated module is done.

• Android - see http://developer.android.com/tools/publishing/app-signing.html. Users would need to supply a keystore file (*.keystore, a binary file that contains a set of private keys), a key alias, and two passwords that qbs should by default retrieve from environment variables. jarsigner is then used to sign the APK prior to zipalign'ing it. APKs can be signed multiple times with different keys (useful?). The SDK tools provide a keystore with known passwords for debug purposes.

• WinRT - https://msdn.microsoft.com/en-us/library/windows/desktop/jj835835.aspx - uses SignTool, given a path to a personal certificate (*.pfx) and password, to sign .appx files (what about .xap?)

• Windows Desktop, .NET - same as WinRT?

• MSI files?

• Java JAR files?

Three things could conceivably be shared among platforms:

• keystorePath: path to *.pfx (Windows), *.keystore (Android), *.keychain (Apple)
• keystorePassword: typically not needed for Apple since keychains are more of a system-level concept that remains unlocked during a user session, but can still be locked and unlocked from the command line given a password
• keyPassword: makes sense for most platforms; irrelevant for Apple since only the keystore itself is password-protected

Apple platforms will have significant additional properties as code signing here is far more complex.

Strong Naming (.NET concept) is also somewhat related to code signing / code security; maybe factor this in as well.