1

I have an application which is packed into a pkg file using productbuild and then is signed using productsign. However when I run pkgutil --check-signature only the SHA1 signature is shown. I also tried to create a self-signed certificate using the instructions reported here but the problem is still the same. The only difference is that when the Apple certificate is used (Developer ID Installer: ...) all the chain is dumped to the screen but also for the other certificates only the SHA1 signature is shown.

NOTE: Both certificates reports:

Signature Algorithm: sha256WithRSAEncryption

So it seems like the certificates are SHA256 capable. I downloaded another pkg which is signed with SHA2 (the pkgutil tool shows the SHA2 signature). However I don't know what tool is used to produce that package.

If the pkgutil is right and the there are no SHA256 signature in the package, how can I force productsign to use both signatures or only the SHA256 one ?

Are there alternatives to productsign ?

Improve this question
3
  • 1
    productsign seems to only support sha1 and md5 according to this unix.com/man-page/osx/1/productsign
    – Peter Harmann
    Commented Feb 25, 2020 at 1:04
  • 4
    The SignatureAlgorithm field in an X.509 certificate describes the signature on the cert by the CA and has nothing at all to do with any signatures done using the key in the cert (or rather its matching private half).
    – dave_thompson_085
    Commented Feb 25, 2020 at 2:26
  • 1
    @PeterHarmann there is no mention to sha1 or md5 in the link that you posted. I downloaded another pkg which is signed with SHA2 (the pkgutil tool shows the SHA2 signature). However I don't know what tool is used to produce that package.
    – Bemipefe
    Commented Feb 25, 2020 at 9:49

1 Answer 1

Reset to default
1

The problem is not how to sign the package but to you check for the signature. It turned out to be a kind of bug of the pkgutil tool which only shows the SHA256 signature on macOS 10.15 (Catalina) while on macOS 10.14 (Mojave) the same tool for the same package only shows the SHA1 signature.

So even if the signature was present it wasn't shown by pkgutil. Furthermore in this blog the author suggest to use spctl -a -vv -t install package.pkg to validate a package because spctl can also check for notarization.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .