2

I am signing my package during distribution using

SIGN_IDENTITY_INSTALLER="Developer ID Installer: Pxxxxxxx, LLC (AXXXXXXXXX)"

productbuild --distribution final-distribution.xml --package-path /tmp/installer-temp/package.pkg --resources resources --sign "$SIGN_IDENTITY_INSTALLER" "Package.pkg"

And this outputs what it's supposed to

productbuild: Signing product with identity "Developer ID Installer: Pxxxxxxx, LLC (AXXXXXXXXX)" from keychain /Users/michael/Library/Keychains/login.keychain
productbuild: Adding certificate "Developer ID Certification Authority"
productbuild: Adding certificate "Apple Root CA"
productbuild: Wrote product to Product.pkg

But when I go to verify the signature nothing is there.

codesign -dv --verbose=4 Product.pkg 
Product.pkg: code object is not signed at all <----WHAT?

Am I supposed to be signing with the Developer ID Application and not the Developer ID Installer?

All certificates exist in keychain and work just fine.

Edit 1 See the certificates in the Apple Developer Portal. enter image description here

2

Use spctl, not codesign

The codesign tool does not work with package files, .pkg.

Use the spctl tool instead:

/usr/sbin/spctl --assess --ignore-cache --verbose --type install <pkg-path>

Alternatively, Installer.app

You can also check the package certificate using Installer.app:

  1. Open the package in macOS's Installer.app;
  2. Click the padlock in the top-right of the installer window.

Installer certificate in macOS

0

To sign macOS packages, you will require access to an Apple Developer account. Signing certificates can be generated via the Apple Developer account.

Two basic requirements should be met to deploy macOS PKGs:

  1. The .pkg file is built as a product archive.
  2. To distribute as an enterprise app, the .pkg file should be signed with a Developer ID obtained from an Apple Developer Enterprise account. For all other apps to be distributed via the Mac App Store, the .pkg file is signed using the “Developer ID Installer” certificate, obtained from an Apple Developer account.

I am using pkgbuild and productbuild for it and following is my script:

Steps to build and sign a macOS PKG file

  • Build the .pkg file using the pkgbuild command.

    sudo pkgbuild --component /path_to_installed_app/macapp.app --install-location /Applications --sign "Developer ID Installer: *******" /path_to_saved_package/packagename.pkg
    

Here, the quoted text refers to the name of your certificate. The two arguments specify the location of the already installed .app file (/path_to_installed_app/macapp.app) and the location of the newly generated .pkg file (/path_to_saved_package/packagename.pkg), respectively.

  • Sign the .pkg file using the productbuild command.

    sudo productbuild --package /path_to_saved_package/packagename.pkg --content /path_to_app/ --sign "Developer ID Installer: *******" /path_to_signed_pkg/signed.pkg
    

Here, the quoted text refers to the name of the certificate. The two arguments specify the location of the newly generated .pkg file (/path_to_saved_package/packagename.pkg) and the location of the signed .pkg file (/path_to_signed_pkg/signed.pkg), respectively.

Steps to sign macOS PKG files

  • Open Keychain Access within the Mac and locate the certificate. The name of the certificate should be of the format: Developer ID Installer: Apple account name (serial number).

  • Open terminal. The command to sign the package should look something like this:

    productsign -sign “Developer ID Installer: Your Apple Account Name (**********)” ~/Desktop/example.pkg ~/Desktop/signed-example.pkg
    

Here, the quoted text following the –sign tag refers to the name of your certificate. The two arguments, following the name of the certificate, refer to the current location of the unsigned package (/Desktop/example.pkg) and the location of the signed package (/Desktop/signed-example.pkg), respectively.

The signed certificate gets stored in the destination path specified in the command.

Hope this clarify your open queries and may guide you to have a proper solution.

3
  • Thank you for your answer. Please see my edit with the screenshot. Are these not the certificates that I need? The ones I'm signing with I created in the developer portal. Dec 10 '19 at 17:39
  • Indeed. But note my point 2: To distribute as an enterprise app, the .pkg file should be signed with a Developer ID obtained from an Apple Developer Enterprise account. For all other apps to be distributed via the Mac App Store, the .pkg file is signed using the “Developer ID Installer” certificate, obtained from an Apple Developer account. Are you trying to push it on App store or as an enterprise app ? Use the ID accoridngly ?
    – Udhy
    Dec 10 '19 at 17:41
  • So in order to develop applications outside of the App Store to users for consumption, I need an Apple Developer Enterprise account and not just an Apple Developer account? I am not trying to push to the App Store. Just to distribute it for download. Dec 10 '19 at 17:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .