diff --git a/.idea/dictionaries/develar.xml b/.idea/dictionaries/develar.xml
index c38047cd6c0..34f3cf876a2 100644
--- a/.idea/dictionaries/develar.xml
+++ b/.idea/dictionaries/develar.xml
@@ -32,6 +32,7 @@
       <w>ebusy</w>
       <w>electronuserland</w>
       <w>enoent</w>
+      <w>eperm</w>
       <w>github</w>
       <w>globaldots</w>
       <w>globby</w>
diff --git a/src/packager/mac.ts b/src/packager/mac.ts
index de7ca61c319..525e132a20c 100644
--- a/src/packager/mac.ts
+++ b/src/packager/mac.ts
@@ -1,5 +1,5 @@
 import { ElectronPackagerOptions } from "./dirPackager"
-import { rename, readFile, writeFile, copy } from "fs-extra-p"
+import { rename, readFile, writeFile, copy, unlink } from "fs-extra-p"
 import * as path from "path"
 import { parse as parsePlist, build as buildPlist } from "plist"
 import { Promise as BluebirdPromise } from "bluebird"
@@ -58,6 +58,13 @@ export async function createApp(opts: ElectronPackagerOptions, appOutDir: string
   const appBundleIdentifier = filterCFBundleIdentifier(appInfo.id)
   const helperBundleIdentifier = filterCFBundleIdentifier(opts["helper-bundle-id"] || `${appBundleIdentifier}.helper`)
 
+  const packager = opts.platformPackager
+  const icon = await packager.getIconPath()
+  const oldIcon = appPlist.CFBundleIconFile
+  if (icon != null) {
+    appPlist.CFBundleIconFile = `${appInfo.productFilename}.icns`
+  }
+
   appPlist.CFBundleDisplayName = appInfo.productName
   appPlist.CFBundleIdentifier = appBundleIdentifier
   appPlist.CFBundleName = appInfo.productName
@@ -81,7 +88,6 @@ export async function createApp(opts: ElectronPackagerOptions, appOutDir: string
   })
   use(appInfo.buildVersion, it => appPlist.CFBundleVersion = it)
 
-  const packager = opts.platformPackager
   const protocols = asArray(packager.devMetadata.build.protocols).concat(asArray(packager.platformSpecificBuildOptions.protocols))
   if (protocols.length > 0) {
     appPlist.CFBundleURLTypes = protocols.map(protocol => {
@@ -102,7 +108,7 @@ export async function createApp(opts: ElectronPackagerOptions, appOutDir: string
         CFBundleTypeExtensions: extensions,
         CFBundleTypeName: fileAssociation.name,
         CFBundleTypeRole: fileAssociation.role || "Editor",
-        CFBundleTypeIconFile: customIcon || "electron.icns"
+        CFBundleTypeIconFile: customIcon || appPlist.CFBundleIconFile
       }
     })
   }
@@ -118,8 +124,8 @@ export async function createApp(opts: ElectronPackagerOptions, appOutDir: string
     doRename(path.join(contentsPath, "MacOS"), "Electron", appPlist.CFBundleExecutable)
   ]
 
-  const icon = await packager.getIconPath()
   if (icon != null) {
+    promises.push(unlink(path.join(contentsPath, "Resources", oldIcon)))
     promises.push(copy(icon, path.join(contentsPath, "Resources", appPlist.CFBundleIconFile)))
   }
 
diff --git a/src/util/tmp.ts b/src/util/tmp.ts
index ca2ed2aafbe..567a1398a8a 100644
--- a/src/util/tmp.ts
+++ b/src/util/tmp.ts
@@ -40,7 +40,9 @@ export class TmpDir {
               removeSync(dir)
             }
             catch (e) {
-              warn(`Cannot delete temporary dir "${dir}": ${(e.stack || e).toString()}`)
+              if (e.code !== "EPERM") {
+                warn(`Cannot delete temporary dir "${dir}": ${(e.stack || e).toString()}`)
+              }
             }
           })
           return dir
@@ -48,7 +50,7 @@ export class TmpDir {
     }
 
     return this.tempDirectoryPromise
-      .then(it => path.join(it, `${(this.tmpFileCounter++).toString(16)}${suffix.startsWith(".") ? suffix : `-${suffix}`}`))
+      .then(it => path.join(it, `temp-${(this.tmpFileCounter++).toString(16)}${suffix.startsWith(".") ? suffix : `-${suffix}`}`))
   }
 
   cleanup(): Promise<any> {
@@ -61,7 +63,9 @@ export class TmpDir {
         this.dir = null
       })
       .catch(e => {
-        warn(`Cannot delete temporary dir "${this.dir}": ${(e.stack || e).toString()}`)
+        if (e.code !== "EPERM") {
+          warn(`Cannot delete temporary dir "${this.dir}": ${(e.stack || e).toString()}`)
+        }
       })
   }
 }
diff --git a/src/windowsCodeSign.ts b/src/windowsCodeSign.ts
index bba38c2408d..d78e304c9bb 100644
--- a/src/windowsCodeSign.ts
+++ b/src/windowsCodeSign.ts
@@ -6,10 +6,10 @@ import { getBinFromBintray } from "./util/binDownload"
 //noinspection JSUnusedLocalSymbols
 const __awaiter = require("./util/awaiter")
 
-const TOOLS_VERSION = "1.4.1"
+const TOOLS_VERSION = "1.4.2"
 
 export function getSignVendorPath() {
-  return getBinFromBintray("winCodeSign", TOOLS_VERSION, "bcafcb1aa9be7544ca9bdffda277e4dcf840f14964e51ed270f83fb850cf2e9e")
+  return getBinFromBintray("winCodeSign", TOOLS_VERSION, "ca94097071ce6433a2e18a14518b905ac162afaef82ed88713a8a91c32a55b21")
 }
 
 export interface SignOptions {
@@ -147,6 +147,9 @@ async function getToolPath() {
   if (process.platform === "win32") {
     return path.join(vendorPath, `windows-${(release().startsWith("6.") ? "6" : "10")}`, "signtool.exe")
   }
+  else if (process.platform === "darwin" && process.env.CI) {
+    return path.join(vendorPath, process.platform, "ci", "osslsigncode")
+  }
   else {
     return path.join(vendorPath, process.platform, "osslsigncode")
   }