I'm not sure whether self-signed Package Installer are supported by Mac OS X 10.8+

Using informations in How to create an Apple Installer Package Signing Certificate I could create a Package Installer self-signed certificate.

But all (flat) pkg files I've tried to sign with this certificate are rejected by spctl --assess --type install.

I've tried with packages produced by PackageMaker and pkgbuild, and signing them with productsign -s, pkgbuild --sign and productbuild --sign.

Using pkgutil --check-signature, the resulting pkg files seems actually signed: Package "test.pkg": Status: signed by a certificate trusted for current user Certificate Chain: 1. com.xxx.yyy SHA1 fingerprint: FE 39 1E 69 C1 DC E8 F8 64 2A B1 C3 09 B7 27 94 2B 01 99 28

But is rejected by spctl --assess --type install: test.pkg: rejected <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>assessment:authority</key> <dict/> <key>assessment:remote</key> <true/> <key>assessment:verdict</key> <false/> </dict> </plist> which means (AFAIK) that any GateKeeper enabled system will refuse to install the it.

I'm probably missing an obvious requirement, but I can't figure it out.

Or, simply said, 10.8+ (I'm testing on 10.9) does not support self-signed installers anymore ?

I would appreciate any clue or pointer (I've red the Code Signing documentation, but I may misunderstand it).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.