I'm not sure whether self-signed Package Installer are supported by Mac OS X 10.8+

Using informations in How to create an Apple Installer Package Signing Certificate I could create a Package Installer self-signed certificate.

But all (flat) pkg files I've tried to sign with this certificate are rejected by spctl --assess --type install.

I've tried with packages produced by PackageMaker and pkgbuild, and signing them with productsign -s, pkgbuild --sign and productbuild --sign.

Using pkgutil --check-signature, the resulting pkg files seems actually signed: Package "test.pkg": Status: signed by a certificate trusted for current user Certificate Chain: 1. com.xxx.yyy SHA1 fingerprint: FE 39 1E 69 C1 DC E8 F8 64 2A B1 C3 09 B7 27 94 2B 01 99 28

But is rejected by spctl --assess --type install: test.pkg: rejected <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>assessment:authority</key> <dict/> <key>assessment:remote</key> <true/> <key>assessment:verdict</key> <false/> </dict> </plist> which means (AFAIK) that any GateKeeper enabled system will refuse to install the it.

I'm probably missing an obvious requirement, but I can't figure it out.

Or, simply said, 10.8+ (I'm testing on 10.9) does not support self-signed installers anymore ?

I would appreciate any clue or pointer (I've red the Code Signing documentation, but I may misunderstand it).



You must log in to answer this question.

Browse other questions tagged .