Sign macOS pkg files

nylle

Sign MacOS *.pkg files

This guide will show how to get a certificate that will be used to sign and notarize pkg file.

Prerequisites

  • Mac computer 
  • You’ll need an Apple developer account with a paid subscription.
    Create a Apple Developer Account https://developer.apple.com/

Create CSR

Two get a certificate we need to create a csr (certificate signing request) and that we can do in keychain access.

  1. Open Keychain Access  under launchpad/Other or in Finder /Applications/Utilities.

    Image description

  2. In Keychain Access app click menu Keychain Access and point to Certificate Assistant and click on “Request a Certificate From a Certificate Authority”

    Image description

  3. Dialog Certificate Assistant will appear 

    • User Email Address: type you email
    • Common name: a name that identify your certificate
    • CA Email address: leave empty
    • Let me specify key pair information: uncheck for “normal” use
    • Choose Save to disk and click Continue
      Image description

  4. Save the “CertificateSigningRequest.certSigningRequest”

    Image description

  5. Conclusion Click Show in Finder or click Done

    Image description

  6. In Finder your “CertificateSigningRequest.certSigningRequest” should be located

    Image description
      6b. In you want to see the what is in the CSR use a decoder

    • open the CSR in TextEdit and it should look something like this
Image description
- Copy everything in the TextEdit, cmd+a and cmd+c
- Go to https://certlogik.com/decoder/ and paste the content and press decode
Image description
- Check that CSR Check are OK and emailAddress and emailAddress Name is what you wrote in the CSR in Certificate Assistant 
Image description
7. Check Private/Public Key for newly created CSR - In KeyChain Access press login on the left sidebar - In Keychain Access press Item Keys  - There you should se the Common name of your Private/Public key 
Image description

Request your certificate

Go to Apple webpage and generate certificate to be used to sign the pkg. 

  1. Go to: https://developer.apple.com/account/resources and sign in

    Image description

  2. Click Certificates in the sidebar.

    Image description

  3. Click the blue + button 

  4. Under Software, select one and click Continue

    • Developer ID Installer: A certificate used to sign a Mac Installer Package, containing your signed app.
    • Developer ID Application: A certificate used to sign a Mac app. (notarize)

Image description
5. Click Choose File. 6. In the dialog that appears, select the certificate request file (a file with a .certSigningRequest file extension), then click Choose. 7. Click Continue.
Image description
8. Click Download. 9. Repeat from point 4 for the other certificate, use the same csr. 10. In Developer portal their should now be two certificates.
Image description
11. The certificate file (a file with a .cer file extension) appears in your Downloads folder. 12. To install the certificate in your keychain, double-click the downloaded certificate file. The certificate appears in the My Certificates category in Keychain Access. 13. In Keychain Access the certificate should be shown with the name: Developer ID Installer: Name of Common name (TeamID) 14. Use Terminal to check the that you have the certificate installed

security find-identity -p basic -v

------ RESULT: ------
1) XXXXX[REDACTED] "Developer ID Installer: Name of Common name (TeamID)" 
2) XXXXX[REDACTED] "Developer ID Application: Name of Common name (TeamID)” 
3) [REDACTED] "[REDACTED]" 3 valid identities found

Sign pkg file

  1. Open Terminal and run the code below to sign the pkg and get a new signed version
    • --sign: Common Name of the certificate
    • /Download/package.pkg is the existing package
    • /Download/signed-package.pkg is the signed package

 

productsign --sign "Developer ID Installer: Name of Common name (TeamID)" /Download/package.pkg /Download/signed-package.pkg

------ RESULT: ------
productsign: using timestamp authority for signature
productsign: signing product with identity "Developer ID Installer: Name of Common name (TeamID)" from keychain /Users/username/Library/Keychains/login.keychain-db
productsign: adding certificate "Developer ID Certification Authority"
productsign: adding certificate "Apple Root CA"
productsign: Wrote signed product archive to /Download/signed-package.pkg

TIP!

Third-party tools for signing pkg

Hancock is a GUI tool for signing packages

https://github.com/JeremyAgost/Hancock 

In Terminal

pkgutil --check-signature /Download/signed-package.pkg

------ RESULT: ------
Package "signed-package.pkg":
   Status: signed by a developer certificate issued by Apple for distribution
   Signed with a trusted timestamp on: 2023-04-24 20:00:30 +0000
   Certificate Chain:
    1. Developer ID Installer: Name of Comman name (TeamID)
       Expires: 2028-09-04 17:12:15 +0000
       SHA256 Fingerprint:
           23 5B E7 06 DD 8F 3D D8 4B 4D 45 ED 2A 7B 66 E2 30 BD D7 30 4B 3F 
           F6 D7 16 98 EE C1 82 89 78 A4
       ------------------------------------------------------------------------
    2. Developer ID Certification Authority
       Expires: 2029-02-01 22:12:15 +0000
       SHA256 Fingerprint:
           2A FC 9D 01 A6 1E 03 A2 DE 96 37 93 6D 4A FE 68 09 0D 2D E1 8D 03 
           C2 9C 58 CF F0 B1 FF 93 58 7F
       ------------------------------------------------------------------------
    3. Apple Root CA
       Expires: 2035-02-09 21:40:36 +0000
       SHA256 Fingerprint:
           A0 B1 13 0E CB C7 FF 45 05 A0 2C 49 F1 29 5E 6E DA 6A CA 9D 7E 2C 
           98 B5 BE 91 B5 A1 10 34 F0 12

Notarization

Create an app password

https://support.apple.com/en-us/HT204397

  1. How to generate an app-specific password

  2. Sign in to appleid.apple.com.

    Image description

  3. In the Sign-In and Security section, select App-Specific Passwords.

    Image description

  4. Select Generate an app-specific password or select the Add button Blue plus sign icon., then follow the steps on your screen.

    Image description

  5. The app-specific password is created.

    Image description

Add the app-specific password to keychain

From Terminal run: 

xcrun notarytool store-credentials --apple-id "email@domain.com" --team-id "K7UYGV72CA"

Here two questions need to be answered 

  • Type a profile name
  • Type the app specific password

 

This will store the app-specific credentials securely in the Keychain. 

------ RESULT: ------
Profile name: notarize-YOUR_APP
App-specific password for "email@domain.com"
Validating your credentials...
Success. Credentials validated.
Credentials saved to Keychain.
To use them, specify `--keychain-profile "notarize-YOUR_APP"

Let’s notarize the PKG file by using this command:

xcrun notarytool submit /Download/signed-package.pkg --keychain-profile "notarize-YOUR_APP"

------ RESULT: ------
xcrun notarytool submit /Download/signed-package.pkg  --keychain-profile "notarize-YOUR_APP"
Conducting pre-submission checks for applicationpkg and initiating connection to the Apple notary service...
Submission ID received
id: 914c123d-c7ca-6789-a6f0-79f416f76632
Upload progress: 100,00% (38,3 MB of 38,3 MB)
Successfully uploaded file
id: 914c123d-c7ca-6789-a6f0-79f416f76632
path: /Download/signed-package.pkg

Information about submission

xcrun notarytool info --keychain-profile "notarize-YOUR_APP" 914c123d-c7ca-6789-a6f0-79f416f76632

This process takes about 15 minutes and status should say In Progress

------ RESULT: ------
Successfully received submission info
  createdDate: 2023-04-24T11:18:28.350Z
  id: 914c123d-c7ca-6789-a6f0-79f416f76632
  name: signed-package.pkg
  status: In Progress

After about 15 minutes if everything goes ok, status should be Accepted

------ RESULT: ------
Successfully received submission info
  createdDate: 2023-04-24T11:18:28.350Z
  id: 914c123d-c7ca-6789-a6f0-79f416f76632
  name: signed-package.pkg
  status: Accepted

Stapling a PKG File:

xcrun stapler staple /Download/signed-package.pkg

------ RESULT: ------
Processing: /Download/signed-package.pkg
Processing: /Download/signed-package.pkg
The staple and validate action worked!

Verify the Package file:

pkgutil --check-signature /Download/signed-package.pkg

 ------ RESULT: ------
Status: signed by a developer certificate issued by Apple for distribution
 Notarization: trusted by the Apple notary service
 Signed with a trusted timestamp on: 2023-04-24 20:00:30 +0000
   Certificate Chain:
    1. Developer ID Installer: Name of Comman name (TeamID)
       Expires: 2028-09-04 17:12:15 +0000
       SHA256 Fingerprint:
           23 5B E7 06 DD 8F 3D D8 4B 4D 45 ED 2A 7B 66 E2 30 BD D7 30 4B 3F 
           F6 D7 16 98 EE C1 82 89 78 A4
       ------------------------------------------------------------------------
    2. Developer ID Certification Authority
       Expires: 2029-02-01 22:12:15 +0000
       SHA256 Fingerprint:
           2A FC 9D 01 A6 1E 03 A2 DE 96 37 93 6D 4A FE 68 09 0D 2D E1 8D 03 
           C2 9C 58 CF F0 B1 FF 93 58 7F
       ------------------------------------------------------------------------
    3. Apple Root CA
       Expires: 2035-02-09 21:40:36 +0000
       SHA256 Fingerprint:
           A0 B1 13 0E CB C7 FF 45 05 A0 2C 49 F1 29 5E 6E DA 6A CA 9D 7E 2C 
           98 B5 BE 91 B5 A1 10 34 F0 12

If something goes wrong, fetch the logs

xcrun notarytool log --keychain-profile "notarize-YOUR_APP" 914c123d-c7ca-6789-a6f0-79f416f76632

Comments

You should also read:

nylle

macOS apps - How to find Bundle IDs

There are several common ways to find the Bundle ID / CFBundleIdentifier of a macOS app. We'll focus on utilizing the Apple onboard macOS software tools Terminal and Finder. Terminal with osascript You can find the Bundle ID of an application on a macOS system using…

Continue reading...
nylle

Create a macOS package with Packages

In this guide we will go through two ways to use the application Packages to create a macOS packages from a pkg or dmg. Package can after its build be used to distribute with your favorite MDM. The Packages application used to create the pkg…

Continue reading...