It's possible to extract Code Signing Certificates (CSCs) from an .app or signed .dmg as ASN.1 (DER) with
codesign -d --extract-certificates prefix /path/to/file.dmg
After that you can do stuff with it using
My goal is to do the same for signed xip archives, which use Installer Package Signing Certificates (IPSCs). You can verify xip signatures with
pkgbuild --check-signature /path/to/archive.xip
But there doesn't seem to be an option to actually export the certificates the way codesign can do it with CSCs.
Is there a way to do it from the command line?
The eventual goal is to deal with xip archives that are signed with self-signed/self-issued IPSCs. It will be a script that first checks the signature with
pkgbuild, and then, if the user wants to, it should export the certificates, and then add them to the keychain as trusted. I know you could always just dequarantine the xip file with the self-signed certificate, and this will be an additional option, but this is always on a per-file basis, so there also has to be the ability to extract the certificates (root/leaf) and import them into keychain as trusted (or trusted root). How I'll do the latter I don't know yet, but first thing's first.
Thank you for your help. (This is my first post at AskDifferent.)