I have an application which is packed into a pkg file using
productbuild and then is signed using
productsign. However when I run
pkgutil --check-signature only the SHA1 signature is shown. I also tried to create a self-signed certificate using the instructions reported here but the problem is still the same. The only difference is that when the Apple certificate is used (Developer ID Installer: ...) all the chain is dumped to the screen but also for the other certificates only the SHA1 signature is shown.
NOTE: Both certificates reports:
Signature Algorithm: sha256WithRSAEncryption
So it seems like the certificates are SHA256 capable. I downloaded another pkg which is signed with SHA2 (the pkgutil tool shows the SHA2 signature). However I don't know what tool is used to produce that package.
pkgutil is right and the there are no SHA256 signature in the package, how can I force
productsign to use both signatures or only the SHA256 one ?
Are there alternatives to