# Re-sign a retained build

Create a derived build without uploading signing credentials to AppBarn.

## Prerequisites

- current App Manager authority for the source App;
- source Build is ready;
- platform signer tools installed locally;
- local keystore/profile/identity/P12 as required.

## Steps

1. Export signing passwords through the documented environment variables when required.
2. Run [`appbarn resign`](/cli/resign) with local credential paths.
3. The CLI downloads the source, signs and verifies locally.
4. The verified derivative is uploaded to the same App and Environment with immutable source lineage.

## Expected result

A new ready Build references the source Build; the source remains unchanged.

## Common failures

Signer verification failure, mismatched credentials/profile, source lifecycle changes or lost authority abort without producing a ready derivative.

## Related

- [Re-sign CLI](/cli/resign)
- [Signing troubleshooting](/troubleshooting/signing)