I have a program that I ported from the Windows environment to macOS. I would like to sign the flat installer .pkg with the same certificate I used on Windows, which is valid and granted by DigiCert.
I created a keychain in Keychain Access, imported the certificate and saved it locally as
company.keychain. I looked in the informations and saw that the Common Name of the Subject is, say, 'Company & Co'. When I try to sign with:
productsign --sign "Company & Co" --keychain company.keychain --timestamp=none unsigned.pkg signed.pkg
The following error occurs:
productsign: error: Could not find appropriate signing identity for "Company & Co" in keychain at company.keychain. An installer signing identity (not an application signing identity) is required for signing flat-style products.
I looked it up and, even if the
productsign man page does not suggest it, it seems that in order to sign a flat package the certificate should be an
Apple Developer ID Installer: Company name certificate issued by Apple itself. Since every post about the subject on StackExchange is pretty old I ask it again: is it so? If not, how do I understand if the certificate I have available can sign the flat package?
- If I open the keychain, the "Company & Co" entry has the extension triangle which shows the relevant private key, so it is actually a "complete" certificate.
- I do not need to distribute the app on the Apple App Store, my goal is just to prevent Gatekeeper from complaining about the app not being trusted.
- The package was created with
- If I manage to sign the package, do I also need to sign the application and the dynamic libraries shipped within?
Thank you for your attention.