Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I'm working on getting a Mac app signed. It won't be available in the app store. I've executed the codesign executable properly, I believe, but I still get the Gatekeeper warning. Simple question:

When I verify the signing, I get the following output:

$ codesign --verify --verbose /Applications/My\ App.app
Applications/My App.app/: valid on disk
Applications/My App.app/: satisfies its Designated Requirement  

Nothing in there leads me to believe that there's a problem, but I guess I don't really know what I should see. Does this response indicate that the app is signed or something else?

share|improve this question
    
Mine looks the same, but we don't sell it through the app store (but our signing does qualify to run downloads on computers that have strict checking on). Are you using an apple developer certificate to sign (we had problems trying this with a non-apple cert in the past)? But you'll probably have more success with this question on stackoverflow.com) –  Grezgory May 30 '13 at 20:39
    
Like you, my app won't be distributed through the app store (at least not yet). I'm not entirely sure about the Apple blessing of the cert. This was sent to us by the client. It was used before with an AIR app that had no similar issue if that's any indicator. –  Rob Wilkerson May 30 '13 at 22:40
add comment

2 Answers

Based on the comments I think I have a something close to an answer:

I think it will be the fact that it is Thawte. We have a Thawte cert for Windows, and we could successfully sign Mac software with it, but Apple/MacOS treated it as if it was self signed or signed with not enough authority.

For Mac-signing we signed up to the Mac developer program ($100/year) and got an Apple created cert. With that for example MacOS did let people start the signed app when it was downloaded from the internet.

share|improve this answer
    
I believe you're going to be right. I have a meeting with the client to talk about their cert. I expect them to confirm that it's not an Apple recognized developer cert. Will follow up once I follow through with all of that. –  Rob Wilkerson May 31 '13 at 13:39
add comment

You are correct - codesign --verify --verbose is the terminal manner to verify that an application bundle is properly signed. I also like to pass the app through a display:

codesign --display --verbose=4 /path/to/App.app/

By inspecting the details, I ensure the proper code signing certificate was selected.

You can also test things by changing your settings (or AirDropping the file to a Mac that hasn't run that app) to only run apps that are signed - and double clicking it in the Finder.

share|improve this answer
    
Thanks, @bmike. That actually helps a lot. I don't know the exact format, but the cert looks about right. The authority sections (3 of them) include the common name I gave the client cert as well as Thawte with the right Identifier value. Any reason you can think of that Gatekeeper would still throw the warning? This is not an app store app (at least not yet). –  Rob Wilkerson May 30 '13 at 22:39
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.