{"id":13433944,"url":"https://github.com/sindresorhus/create-dmg","last_synced_at":"2026-10-18T23:48:12.989Z","repository":{"id":19154813,"uuid":"86364042","full_name":"sindresorhus/create-dmg","owner":"sindresorhus","description":"Create a good-looking DMG for your macOS app in seconds","archived":false,"fork":false,"pushed_at":"2026-03-21T08:30:51.000Z","size":7102,"stargazers_count":5379,"open_issues_count":0,"forks_count":223,"subscribers_count":36,"default_branch":"main","last_synced_at":"2026-10-04T03:16:00.177Z","etag":null,"topics":["app","cli","cli-app","disk-image","dmg","javascript","macos","nodejs"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sindresorhus.png","metadata":{"files":{"readme":"readme.md","changelog":null,"contributing":null,"funding":null,"license":"license","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"claude":null,"gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null},"funding":{"github":"sindresorhus","open_collective":"sindresorhus","buy_me_a_coffee":"sindresorhus","custom":"https://sindresorhus.com/donate"}},"created_at":"2017-03-27T17:24:44.000Z","updated_at":"2026-10-03T03:47:04.000Z","dependencies_parsed_at":"2026-09-06T06:39:04.833Z","dependency_job_id":null,"html_url":"https://github.com/sindresorhus/create-dmg","commit_stats":{"total_commits":83,"total_committers":16,"mean_commits":5.1875,"dds":"0.22891566265060237","last_synced_commit":"c6f5453bcb0d24e73f570785c87d37f3cd6f9b17"},"previous_names":[],"tags_count":28,"template":false,"template_full_name":null,"purl":"pkg:github/sindresorhus/create-dmg","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sindresorhus%2Fcreate-dmg","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sindresorhus%2Fcreate-dmg/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sindresorhus%2Fcreate-dmg/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sindresorhus%2Fcreate-dmg/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sindresorhus","download_url":"https://codeload.github.com/sindresorhus/create-dmg/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sindresorhus%2Fcreate-dmg/sbom","scorecard":{"id":826184,"data":{"date":"2025-08-11","repo":{"name":"github.com/sindresorhus/create-dmg","commit":"c6f5453bcb0d24e73f570785c87d37f3cd6f9b17"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":3.3,"checks":[{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Code-Review","score":2,"reason":"Found 8/30 approved changesets -- score normalized to 2","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Binary-Artifacts","score":7,"reason":"binaries present in source code","details":["Warn: binary detected: fixtures/Fixture-no-icon.app/Contents/MacOS/fixture:1","Warn: binary detected: fixtures/Fixture-with-binary-plist.app/Contents/MacOS/fixture:1","Warn: binary detected: fixtures/Fixture.app/Contents/MacOS/fixture:1"],"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Maintained","score":0,"reason":"0 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/main.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/sindresorhus/create-dmg/main.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/sindresorhus/create-dmg/main.yml/main?enable=pin","Warn: npmCommand not pinned by hash: .github/workflows/main.yml:21","Info:   0 out of   2 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   1 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: license:0","Info: FSF or OSI recognized license: MIT License: license:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'main'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 8 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-23T16:41:12.197Z","repository_id":19154813,"created_at":"2025-08-23T16:41:12.197Z","updated_at":"2025-08-23T16:41:12.197Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":344872684,"owners_count":38343425,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-18T02:00:06.448Z","response_time":63,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["app","cli","cli-app","disk-image","dmg","javascript","macos","nodejs"],"created_at":"2024-07-31T02:01:40.992Z","updated_at":"2026-10-18T23:48:12.484Z","avatar_url":"https://github.com/sindresorhus.png","language":"JavaScript","funding_links":["https://github.com/sponsors/sindresorhus","https://opencollective.com/sindresorhus","https://buymeacoffee.com/sindresorhus","https://sindresorhus.com/donate"],"categories":["JavaScript","软件打包工具","nodejs","cli","Developer Tools","Utilities"],"sub_categories":["其他","Frameworks For Hybrid Applications","笔记","Command Line Tools","写作"],"readme":"# create-dmg\n\n\u003e Create a good-looking [DMG](https://en.wikipedia.org/wiki/Apple_Disk_Image) for your macOS app in seconds\n\nImagine you have finished a macOS app, exported it from Xcode, and now want to distribute it to users. The most common way of distributing an app outside the Mac App Store is by putting it in a `.dmg` file. These are hard to create, especially good-looking ones. You can either pay for a GUI app where you have to customize an existing design or you can run some homebrewed Bash script and you still have to design it. This tool does everything for you, so you can play with your 🐈 instead.\n\n\u003cimg src=\"screenshot-cli.gif\"\u003e\n\n*This tool is intentionally opinionated and simple. I'm not interested in adding lots of options.*\n\n## Install\n\nEnsure you have [Node.js](https://nodejs.org) 20 or later installed. Then run the following:\n\n```sh\nnpm install --global create-dmg\n```\n\n## Usage\n\n```\n$ create-dmg --help\n\n  Usage\n    $ create-dmg \u003capp\u003e [destination]\n\n  Options\n    --overwrite                  Overwrite existing DMG with the same name\n    --no-version-in-filename     Exclude version number from DMG filename\n    --identity=\u003cvalue\u003e           Manually set code signing identity (automatic by default)\n    --dmg-title=\u003cvalue\u003e          Manually set DMG title (must be \u003c=27 characters) [default: App name]\n    --no-code-sign               Skip code signing the DMG\n\n  Examples\n    $ create-dmg 'Lungo.app'\n    $ create-dmg 'Lungo.app' Build/Releases\n```\n\n## DMG\n\nThe DMG requires macOS 10.13 or later and has the filename `App Name 0.0.0.dmg`. For example, `Lungo 1.0.0.dmg`.\n\nIt will try to code sign the DMG, but the DMG is still created and fine even if the code signing fails, for example if you don't have a developer certificate. You can use the `--no-code-sign` flag to skip code signing entirely and prevent exit code failures in CI environments.\n\n**Important:** Don't forget to [notarize your DMG](https://stackoverflow.com/a/60800864/64949).\n\n\u003cimg src=\"screenshot-dmg.png\" width=\"772\"\u003e\n\n### Software license agreement\n\nIf either `license.txt` or `license.rtf` is present in the current working directory, it will be added as a software license agreement when opening the image. The image will not be mounted unless the user indicates agreement with the license.\n\n#### Icon example\n\nOriginal icon → DMG icon\n\n\u003cimg src=\"icon-example-app.png\" width=\"300\"\u003e\u003cimg src=\"icon-example.png\" width=\"300\"\u003e\n\n## Related\n\n- [Defaults](https://github.com/sindresorhus/Defaults) - Swifty and modern UserDefaults\n- [LaunchAtLogin](https://github.com/sindresorhus/LaunchAtLogin) - Add “Launch at Login” functionality to your macOS\n- [My apps](https://sindresorhus.com/apps)\n- [More…](https://github.com/search?q=user%3Asindresorhus+language%3Aswift+archived%3Afalse\u0026type=repositories)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsindresorhus%2Fcreate-dmg","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsindresorhus%2Fcreate-dmg","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsindresorhus%2Fcreate-dmg/lists"}