1

I have a program that I ported from the Windows environment to macOS. I would like to sign the flat installer .pkg with the same certificate I used on Windows, which is valid and granted by DigiCert.

I created a keychain in Keychain Access, imported the certificate and saved it locally as company.keychain. I looked in the informations and saw that the Common Name of the Subject is, say, 'Company & Co'. When I try to sign with:

productsign --sign "Company & Co" --keychain company.keychain --timestamp=none unsigned.pkg signed.pkg

The following error occurs:

productsign: error: Could not find appropriate signing identity for "Company & Co" in keychain at company.keychain.
An installer signing identity (not an application signing identity) is required for signing flat-style products.

I looked it up and, even if the productsign man page does not suggest it, it seems that in order to sign a flat package the certificate should be an Apple Developer ID Installer: Company name certificate issued by Apple itself. Since every post about the subject on StackExchange is pretty old I ask it again: is it so? If not, how do I understand if the certificate I have available can sign the flat package?

Notes:

  1. If I open the keychain, the "Company & Co" entry has the extension triangle which shows the relevant private key, so it is actually a "complete" certificate.
  2. I do not need to distribute the app on the Apple App Store, my goal is just to prevent Gatekeeper from complaining about the app not being trusted.
  3. The package was created with packagebuild and productbuild.
  4. If I manage to sign the package, do I also need to sign the application and the dynamic libraries shipped within?

Thank you for your attention.

0

Yes, it is so. The certificate must be a Developer ID Installer certificate from Apple. You cannot use the same code signing certificate you have been using for your Windows application previously.

You can read the instructions on how to properly sign flat installer packages here:

https://developer.apple.com/library/content/documentation/IDEs/Conceptual/AppDistributionGuide/DistributingApplicationsOutside/DistributingApplicationsOutside.html

  • More specifically: it's technically possible to sign with any certificate, but Gatekeeper will not recognize any signature other than an Apple Developer ID certificate. So, it's possible, but useless. BTW, my understanding is that the basic reason for this is that Apple wants to be able to revoke any certificate that's used to sign malware, and they can only reliably do that if they own the certificate authority. – Gordon Davisson Mar 17 '17 at 19:42
  • @GordonDavisson The original question specified that the goal was to prevent GateKeeper from complaining - the only way to do that is to use a certificate from Apple. So yes, technically it is ofcourse possible to use anything, but it won't solve the problem. – jksoegaard Mar 19 '17 at 6:48
  • Actually I also wanted to understand why productsign could not find the "installer signing identity' - the only explanation being that productsign recognized that the pkg was an installer and demanded a particular subchain of trust to sign the file. – phagio Mar 20 '17 at 14:32
  • productsign is only used with installers, so it "knows" that it is an installer per definition. – jksoegaard Mar 21 '17 at 12:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .