static framework and code signing

Hello.

I am developing our company's SDK for iOS as a third-party library. This SDK consists of a static library and header files wrapped within a framework (and wrapping the target-specific frameworks in xcframework).

  1. I understand that codesign is required even for static frameworks, is it correct?
  2. Should I update the distributed files when the certificate expires? Does this depend on whether it is static or dynamic?
  3. When is the signature verified?
static framework and code signing
 
 
Q