I would like to sign my OS X installer using company certificate. I have .cer and .p12 files. I wonder if there is some way to do that without creating keychain. E.g. in 'productsign' tool flag --cert looks promising, but I can't find too much info about how to use it.
Apple's signing tools require a keychain containing your organisation's signing identity.
cert flag on
productsign is used to embed an intermediate certificate. It is not used to specify the signing certificate.
It is possible to create a keychain containing your organisation's signing identity. This can then be used to sign your installer using the
keychain flag. The separate keychain file can be managed with source code control or other file management tools; it remains separate from the user's login keychain.