Skip to main content
Information Security

Return to Question

added 151 characters in body
Source Link
Bemipefe
Bemipefe
  • 121
  • 4

I have an application which is packed into a pkg file using productbuild and then is signed using productsign. However when I run pkgutil --check-signature only the SHA1 signature is shown. I also tried to create a self-signed certificate using the instructions reported here but the problem is still the same. The only difference is that when the Apple certificate is used (Developer ID Installer: ...) all the chain is dumped to the screen but also for the other certificates only the SHA1 signature is shown.

NOTE: Both certificates reports:

Signature Algorithm: sha256WithRSAEncryption

So it seems like the certificates are SHA256 capable. Is theI downloaded another pkg which is signed with SHA2 pkgutil capable of dumping a SHA256(the pkgutil tool shows the SHA2 signature ? If). However I don't know what tool is used to produce that package.

If the pkgutil is right and the there are no SHA256 signature in the package, how can I force productsign to use both signatures or only the SHA256 one ?

Are there alternatives to productsign ?

I have an application which is packed into a pkg file using productbuild and then is signed using productsign. However when I run pkgutil --check-signature only the SHA1 signature is shown. I also tried to create a self-signed certificate using the instructions reported here but the problem is still the same. The only difference is that when the Apple certificate is used (Developer ID Installer: ...) all the chain is dumped to the screen but also for the other certificates only the SHA1 signature is shown.

NOTE: Both certificates reports:

Signature Algorithm: sha256WithRSAEncryption

So it seems like the certificates are SHA256 capable. Is the pkgutil capable of dumping a SHA256 signature ? If the pkgutil is right and the there are no SHA256 signature in the package, how can I force productsign to use both signatures or only the SHA256 one ?

I have an application which is packed into a pkg file using productbuild and then is signed using productsign. However when I run pkgutil --check-signature only the SHA1 signature is shown. I also tried to create a self-signed certificate using the instructions reported here but the problem is still the same. The only difference is that when the Apple certificate is used (Developer ID Installer: ...) all the chain is dumped to the screen but also for the other certificates only the SHA1 signature is shown.

NOTE: Both certificates reports:

Signature Algorithm: sha256WithRSAEncryption

So it seems like the certificates are SHA256 capable. I downloaded another pkg which is signed with SHA2 (the pkgutil tool shows the SHA2 signature). However I don't know what tool is used to produce that package.

If the pkgutil is right and the there are no SHA256 signature in the package, how can I force productsign to use both signatures or only the SHA256 one ?

Are there alternatives to productsign ?

Source Link
Bemipefe
Bemipefe
  • 121
  • 4

Why does productsign use SHA1 instead of SHA256 to sign the pkg?

I have an application which is packed into a pkg file using productbuild and then is signed using productsign. However when I run pkgutil --check-signature only the SHA1 signature is shown. I also tried to create a self-signed certificate using the instructions reported here but the problem is still the same. The only difference is that when the Apple certificate is used (Developer ID Installer: ...) all the chain is dumped to the screen but also for the other certificates only the SHA1 signature is shown.

NOTE: Both certificates reports:

Signature Algorithm: sha256WithRSAEncryption

So it seems like the certificates are SHA256 capable. Is the pkgutil capable of dumping a SHA256 signature ? If the pkgutil is right and the there are no SHA256 signature in the package, how can I force productsign to use both signatures or only the SHA256 one ?