Export and sign your UPM package

Export and sign your Unity Package Manager (UPM) package so you can share it with others.

Starting with Unity 6.3, publishers can sign their package directly from the Package Manager window or by using command line arguments.

When you sign a package, you must associate it with one of your organizations, so package consumers can quickly determine who created and owns it.

The only packages you can sign are packages that have the Custom or Local label in the Package Manager window:

• A Custom label appears on packages you’re developing or customizing in the Packages folder of your project.
• A Local label appears on packages you installed with the Package Manager’s Install package from disk method, or package folders you reference as dependencies in your project manifest file.

Use the following procedures to export and sign your UPM packageA Package managed by the Unity Package Manager. Refer to Packages.
See in Glossary with the Package Manager window or command line arguments.

Sign a package from the Package Manager window

To sign a package from the Package Manager window:

1. Make sure you’re signed in to the Unity Hub.

2. Open the Package Manager Window.

3. Select the package you want to sign.

4. Select Export.

   

   Note: Another way to access the export dialog is with the menus. Go to the Project window and select the base folder for your package in the Packages folder. Open the Assets menu (or right-click your package folder) and select Export as UPM Package.

5. In the Export Package dialog that appears, open the Authoring Org menu and select the organization you want to associate this package with.

6. Select a location to store the signed package and select Select Folder (Windows) or Choose (macOS).

   Note: If the package already exists in that location, a warning message prompts you to confirm overwriting the file.

7. When the export process completes, your file management application opens at the location you specified, showing you the newly created file. A confirmation message also displays in the Console window.

The export operation creates a tarball file (.tgz), which is a compressed archive file. This tarball file contains an encrypted file (.attestation.p7m), which contains the package signature.

Refer to Share your package for information about distributing this tarball file to others.

Sign a package using command line arguments

If you publish packages using continuous integration (CI), you can sign your package from the command line.

To gather your organization’s Organization ID and sign your package from the command line:

1. If the project that uses the package you want to sign is open, close the Unity Editor.

2. Go to the Unity Cloud Dashboard (https://cloud.unity.com/account/my-organizations) and select the organization you want to use to sign your package.

   Note: You can also select the link for your account in the top right corner of the dashboard and select Switch organization for the intended organization, then open the menu again and select Manage organization.

3. From the My organizations page (or the Organization Settings page), locate the Organization ID field.

4. Copy the Organization ID value.

5. Open a command prompt window.

6. Change directories to the location of your Unity Editor. For more information, refer to Unity Editor command line arguments and Locate the Editor program file.

7. Input the following command, replacing the placeholder values represented by angled brackets:

Windows

Unity.exe -batchmode -username <your_username> -password <your_password> \
    -upmPack <path_to_package_folder> <path_to_tarball> \
    -cloudOrganization <your_organization_id>

macOS

Unity.app/Contents/MacOS/Unity -batchmode -username <your_username> -password <your_password> \
    -upmPack <path_to_package_folder> <path_to_tarball> \
    -cloudOrganization <your_organization_id>

The output tarball file contains an encrypted file (.attestation.p7m), which contains the package signature.

Refer to Share your package for information about distributing this tarball file to others.

Additional information

• Package signatures
• Share your package
• Create and export asset packages