I'm not sure whether self-signed Package Installer are supported by Mac OS X 10.8+
Using informations in How to create an Apple Installer Package Signing Certificate I could create a Package Installer self-signed certificate.
But all (flat) pkg files I've tried to sign with this certificate are rejected by
spctl --assess --type install.
I've tried with packages produced by PackageMaker and
pkgbuild, and signing them with
pkgbuild --sign and
pkgutil --check-signature, the resulting pkg files seems actually signed:
Status: signed by a certificate trusted for current user
SHA1 fingerprint: FE 39 1E 69 C1 DC E8 F8 64 2A B1 C3 09 B7 27 94 2B 01 99 28
But is rejected by
spctl --assess --type install:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
which means (AFAIK) that any GateKeeper enabled system will refuse to install the it.
I'm probably missing an obvious requirement, but I can't figure it out.
Or, simply said, 10.8+ (I'm testing on 10.9) does not support self-signed installers anymore ?
I would appreciate any clue or pointer (I've red the Code Signing documentation, but I may misunderstand it).