From e67ef803557ced3ef0a7fec583b481272608b6d8 Mon Sep 17 00:00:00 2001
From: pancake <pancake@nopcode.org>
Date: Mon, 30 Mar 2026 14:24:16 +0200
Subject: [PATCH] Document --run/-R flag

---
 README.md     | 15 +++++++++++++++
 lib/config.ts |  2 ++
 2 files changed, 17 insertions(+)

diff --git a/README.md b/README.md
index 6199fd7..f281205 100644
--- a/README.md
+++ b/README.md
@@ -78,6 +78,7 @@ Usage:
   -K, --add-access-group [NAME] Add $(TeamIdentifier).NAME to keychain-access-groups
   -L, --identities              List local codesign identities
   -m, --mobileprovision [FILE]  Specify the mobileprovision file to use
+  -R, --run [SCRIPT]            Run a hook script before signing starts
   -s, --single                  Sign a single file instead of an IPA
   -S, --self-sign-provision     Self-sign mobile provisioning (EXPERIMENTAL)
   -v, --verify                  Verify all the signed files at the end
@@ -164,6 +165,20 @@ creates a dependency list of all the bins and signs them in order. The parallel
 signing aims to run in parallel as much tasks as possible without breaking the
 dependency list.
 
+## Run hooks
+
+Use `-R, --run` to execute a script before signing starts.
+
+Shell scripts receive the following environment variables:
+
+- `APPLESIGN_DIRECTORY`
+- `APPLESIGN_MAINBIN`
+- `APPLESIGN_OUTFILE`
+- `APPLESIGN_TEMPDIR`
+- `APPLESIGN_FILE`
+
+`APPLESIGN_TEMPDIR` is the temporary working directory.
+
 ## Mangling
 
 It is possible with `--force-family` to remove the UISupportedDevices from the
diff --git a/lib/config.ts b/lib/config.ts
index 2b28ca0..6cb4865 100644
--- a/lib/config.ts
+++ b/lib/config.ts
@@ -20,6 +20,7 @@ const shortHelpMessage = `Usage:
   -m, --mobileprovision [FILE]  Specify the mobileprovision file to use
   -o, --output [APP.IPA]        Path to the output IPA filename
   -O, --osversion 9.0           Force specific OSVersion if any in Info.plist
+  -R, --run [SCRIPT]            Run a hook script before signing starts
   -T, --tempdir [DIR]           Path to the output directory for temporary files
   -p, --without-plugins         Remove plugins (excluding XCTests) from the resigned IPA
   -w, --without-watchapp        Remove the WatchApp from the IPA before resigning
@@ -64,6 +65,7 @@ const helpMessage = `Usage:
   -K, --add-access-group [NAME] Add $(TeamIdentifier).NAME to keychain-access-groups
   -L, --identities              List local codesign identities
   -m, --mobileprovision [FILE]  Specify the mobileprovision file to use
+  -R, --run [SCRIPT]            Run a hook script before signing starts
   -s, --single                  Sign a single file instead of an IPA
   -S, --self-sign-provision     Self-sign mobile provisioning (EXPERIMENTAL)
   -v, --verify                  Verify all the signed files at the end