0

I just noticed I can double-clik, open and install a .pkg package installer that has an expired certificate without any popup like "This package is from an developer whose certificate has expired" or "This package has expired". Instead there is no alert at all.

If I click on the top right "Lock" symbol, in the details of the certificate, I see a green tick mark with "This certificate is valid".

enter image description here

Is it the normal behaviour?

Is it true on all recent Mac OS X version that I can install old installers from a few years ago (for which the developer certificate has expired), without having an alarming popup?

I have myself a few old .pkg installers (the program itself has not been updated), and I don't know if it's mandatory for me to rebuild the installer with my new certificate, or if everyone can still install the old installer (with expired certificate) without any alarm.

0

2 Answers 2

1

A quick search of the web shows that as long as the certificate was not expired when the installer was created, then macOS ignores the expiration date when installing. For example, you can read the statement: "While Developer ID certificates and provisioning profiles have an expiry date, the system is meant to ignore them."

0

While there seems to be "no problem" here, for anyone with problems trying to get old packages to install, I highly recommend Charlessoft's Pacifist, which is a third-party package installer.

You can browse the contents of packages, install individual files, read scripts; or just install the whole thing regardless of any certificates.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .