Timeline for Why does productsign use SHA1 instead of SHA256 to sign the pkg?
Current License: CC BY-SA 4.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 25, 2020 at 13:56 | answer | added | Bemipefe | timeline score: 1 | |
| Feb 25, 2020 at 9:54 | history | edited | Bemipefe | CC BY-SA 4.0 |
added 151 characters in body
|
| Feb 25, 2020 at 9:49 | comment | added | Bemipefe | @PeterHarmann there is no mention to sha1 or md5 in the link that you posted. I downloaded another pkg which is signed with SHA2 (the pkgutil tool shows the SHA2 signature). However I don't know what tool is used to produce that package. | |
| Feb 25, 2020 at 2:26 | comment | added | dave_thompson_085 | The SignatureAlgorithm field in an X.509 certificate describes the signature on the cert by the CA and has nothing at all to do with any signatures done using the key in the cert (or rather its matching private half). | |
| Feb 25, 2020 at 1:04 | comment | added | Peter Harmann | productsign seems to only support sha1 and md5 according to this unix.com/man-page/osx/1/productsign | |
| Feb 24, 2020 at 22:24 | history | asked | Bemipefe | CC BY-SA 4.0 |