3

Adding files to a dmg and redistribute it

Purpose :

Adding some settings files to firefox.dmg (mozilla.cfg and policies.json) in the objective of redistributing the modified dmg

How the dmg is modified :

  • Decompressing the dmg with tools like (hdiutils/ultraiso/transmac/dropdmg/disk-utilities)
  • Mounting and adding files to the decompressed dmg
  • Optional (recompress the dmg with same utils used to decompress)

Issue :

Opening the new dmg in a different machine give the result "firefox" is damaged and can't be opened, you should move it to trash

What was tested :

  • Removing com.apple.quarantine attribute with the command xattr -c works but its not a reliable solution
  • Tried to remove _CodeSignature directories from the dmg without success
  • Creating a new dmg containing files of the previous one without success
  • Tried to edit Info.plist without success

Question :

How to make the new dmg package usable in other machines ? (How to avoid the error from gatekeeper without using xattr -c)

  • Wouldn't it be easier to create a script that installs firefox then copies over the modified files? – Allan Nov 26 '18 at 21:41
  • Does inserting the modified files into a fully brand new DMG work? You can make a DMG out of any folder with Disk Utility. – Wowfunhappy Nov 26 '18 at 21:47
  • @Allan yes but its basically circling the problem because the script would need a signature... but it could be a solution – intika Nov 26 '18 at 23:05
  • @Wowfunhappy its doable too but still the dmg check fail too – intika Nov 26 '18 at 23:05
3

Apple DMG Code Signing :

Signing apple application require paying apple's developer program (99$), it can be done freely but for a limited purpose.

Signing dmg can be done in two ways :

  • Signing the dmg file itself

  • Signing the Application.app directory inside the dmg image

Editing signed DMG files :

Here is 3 possibles ways to edit signed applications :

  1. Resign the application after edition

  2. Remove the signature completely and edit the application (the application will still be installable the user will be warned)

  3. Removing com.apple.quarantine attribute with the command xattr -c after editing the application

Signature verification :

Depending on the situation one or both commands are required

codesign -v Application.app
codesign -v Application.dmg

Removing application signature

After extracting the dmg etc. Depending on the situation one or both commands are required

codesign --remove-signature Application.app
codesign --remove-signature Application.dmg

Explaining the failure :

The Application is damaged and can't be opened, you should move it to trash is the result of a partial signature removal, because removing _CodeSignature directories is not enough to get rid of the signature; codesign --remove-signature needs to also be run against the package/application/binary

Related lecture :

Create dmg - Create dmg from directory - Add signature to dmg - Remove signature - Damaged application - How to code sign - Free developer - Free signature

2

You cannot modify the DMG and have it still pass trough GateKeeper without re-signing it. This is basically the entire reason for having the code signature!

Basically you have three options:

1) Remove the old code signature and re-sign the DMG with your own signature. This requires you to be enrolled in Apple's Developer Program.

2) Distribute the original, unmodified DMG - and accompany it with your own modifications. This could be done as instructions for the user on what to copy over, or it could be in the form of an automatic script.

3) Remove the signatures completely (both from the DMG and the app). The user then needs to have GateKeeper set to allow opening unsigned applications (i.e. the user will be prompted on the first open).

  • Unsigned DMG's aren't allowed on systems with Gatekeeper enabled anymore? I thought it was just apps themselves that needed to be signed. – Wowfunhappy Nov 26 '18 at 23:49
  • If the developer signs the DMG, then the app can use files from that DMG. If the developer does not sign the DMG, then the app will be prevented from accessing the contents of the DMG by the way of relative file names. So if the program is designed to be installed from such a signed DMG where it uses files in the DMG, it won't work if you place it in a non-signed DMG. – jksoegaard Nov 27 '18 at 0:14
  • As installing unsigned application is still possible when accepting the dialog 'unidentified developer...' how can i remove the signature from firefox other than removing _CodeSignature directory or rebuilding ? (i don't want to publish it in the appstore but just make it usable while copying it to other machines) – intika Nov 27 '18 at 0:23
  • You've just described the only two ways of removing the signature, and then you say you do not want to do that. You have no other options. If you want to remove the code signature, you can do so by removing it. – jksoegaard Nov 27 '18 at 0:54
  • 1
    Thank you for answers it's appreciated, sorry i was not clear what i meant is after removing "_CodeSignature" gatekeeper still detect that firefox.dmg is damaged, how can i get it to pop up the 'unidentified developer...' dialog instead of the the damaged dialog ? – intika Nov 27 '18 at 1:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .