October 2012 - Installer-dev

Packagemaker installer is allowing downgrade of packages.
by Vikram Singh 31 Oct '12

31 Oct '12

_______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

RE: Verify productsign on flat packages
by Khushneet Inder Singh 29 Oct '12

29 Oct '12

Hi Stephane, The --extract-certs option somehow doesn't work. xar said unrecognized option `--extract-certs` and the manual of xar doesn't have any extract-certs option :( ... NOTE: xar version is 1.6dev But --dump-toc works well :), I just want to know that the following info is about the "MY Apple Developer ID Installer certificates" ? "<X509Data> <X509Certificate>CERT1<\X509Certificate> <X509Certificate>CERT2<\X509Certificate> <\X509Data>" And is this info is different for different Apple Developer ID certificates ? I signed two different payload with same developer ID, then I check the diff of both xml header info. There is no diff between the signature info part of header file. That's why I am assuming the above xml info has one-to-one relation with certificate used to sign the package. I don't have any other certificate to counter check this which makes it sure. Thanks, Khushneet -----Original Message----- From: installer-dev-bounces+ksingh=quark.com(a)lists.apple.com [mailto:installer-dev-bounces+ksingh=quark.com@lists.apple.com] On Behalf Of Stephane Sudre Sent: Friday, October 26, 2012 12:52 PM To: installer-dev(a)lists.apple.com Subject: Re: Verify productsign on flat packages On Fri, Oct 26, 2012 at 7:15 AM, Khushneet Inder Singh <ksingh(a)quark.com> wrote: > Hi, > > Thanks for reply, but the "--check-signature" option in pkgutil was > introduced later in 10.7(Lion). So for me the problem remains the same > , I am still unable to verify signature on snow leopard and leopard. Considering that a flat package/distribution is a xar archive, a solution could be to: 1. extract the certificates from the archive either using --dump-toc and some XML parsing or using a fork of the xar project: http://mackyle.github.com/xar/howtosign.html 2. use 'openssl x509' to retrieve the information you need. _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/ksingh%40quark.com This email sent to ksingh(a)quark.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Distribution file and http URL as package location
by Stephane Sudre 26 Oct '12

26 Oct '12

On Fri, Oct 26, 2012 at 10:00 AM, Natalia Antonova <natalya.a.antonova(a)gmail.com> wrote: > Thanks for you response, Stephane. > [...] > If Distribution file has pkg-ref pointing to local files: > file:./Packages/1.pkg - it works fine. > If I repackage it to contain other Distribution with pkg-ref > http://myserver.com/1.pkg - it also works fine. > > But I think it would be very useful to have a way to combine two these > options into a single one. So that to make Distribution to decide > dynamically where to take pkgs from. > I am now thinking about trying to double all choices - create 1 set to point > to local pkgs, another to remote and initialize "selected" attribute with > the result of script checking presence of pkg in local Packages folder. I > will give it a try and then report back. If the packages are outside the distribution (file or bundle), then your approach (one choice for local, one choice for remote, state based on the existence of the local file) would probably work. Just keep in mind that the state of the choice won't probably change as you expect it to if you add/remove the packages locally when the installation is already running (as the states of choices are not always re-evaluated). _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Distribution file and http URL as package location
by Natalia Antonova 26 Oct '12

26 Oct '12

_______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Verify productsign on flat packages
by Stephane Sudre 26 Oct '12

26 Oct '12

On Fri, Oct 26, 2012 at 7:15 AM, Khushneet Inder Singh <ksingh(a)quark.com> wrote: > Hi, > > Thanks for reply, but the "--check-signature" option in pkgutil was > introduced later in 10.7(Lion). So for me the problem remains the same , > I am still unable to verify signature on snow leopard and leopard. Considering that a flat package/distribution is a xar archive, a solution could be to: 1. extract the certificates from the archive either using --dump-toc and some XML parsing or using a fork of the xar project: http://mackyle.github.com/xar/howtosign.html 2. use 'openssl x509' to retrieve the information you need. _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

RE: Verify productsign on flat packages
by Khushneet Inder Singh 26 Oct '12

26 Oct '12

Hi, Thanks for reply, but the "--check-signature" option in pkgutil was introduced later in 10.7(Lion). So for me the problem remains the same , I am still unable to verify signature on snow leopard and leopard. Thanks, Khushneet -----Original Message----- From: Prema Kumar [mailto:Prema.Kumar@efi.com] Sent: Thursday, October 25, 2012 7:41 PM To: Khushneet Inder Singh; Installer-Dev mailing-list Subject: Re: Verify productsign on flat packages Hi, Please go through the following link http://s.sudre.free.fr/Stuff/Installer/Unreleased_Notes/10.8_Gatekeeper. htm l Try the following command /usr/sbin/pkgutil --check-signature your_signed_package_or_distribution.pkg Regards Prema On 10/25/12 6:47 PM, "Khushneet Inder Singh" <ksingh(a)quark.com> wrote: >Hi all, > >I am stuck with an issue that I didn't find any way to verify the >productsigned package is whether signed with Apple's Developer ID or >not, as I am pushing the flat package silently (Without UI). >"productsign" didn't seems to offer me any way to do this or I didn't >explored its power yet. I tried using "spctl" that works fine on Lion >and Mountain lion, but not on Snow Leopard and Leopard. I want to cover >all OSx from leopard to Mountain Lion. > >Thanks, >Khushneet > > _______________________________________________ >Do not post admin requests to the list. They will be ignored. >Installer-dev mailing list (Installer-dev(a)lists.apple.com) >Help/Unsubscribe/Update your Subscription: >https://lists.apple.com/mailman/options/installer-dev/prema.kumar%40efi >.co >m > >This email sent to prema.kumar(a)efi.com Confidentiality notice: This message may contain confidential information. It is intended only for the person to whom it is addressed. If you are not that person, you should not use this message. We request that you notify us by replying to this message, and then delete all copies including any contained in your reply. Thank you. _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Distribution file and http URL as package location
by Stephane Sudre 25 Oct '12

25 Oct '12

On Thu, Oct 25, 2012 at 8:29 AM, Natalia Antonova <natalya.a.antonova(a)gmail.com> wrote: > Hello, > > Please help me with the below questions. > > I have a flat meta-package and Distribution file inside. > I am wondering if it's possible to configure pkg-locations dynamically in > the Distribution-file. > For example, check if the pkg can be found locally in the Packages folder, > if it is - take the local file; otherwise - take pkg from http-server. > Is there any way to accomplish this? It's somehow a chicken and egg question. Since you would need to build a specific flat distribution for each case, there's no real reason to check for the presence of a local file as you already know it when you build the flat distribution. And modifying a built flat distribution is like rebuilding one. _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Distribution file and http URL as package location
by Natalia Antonova 25 Oct '12

25 Oct '12

_______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Verify productsign on flat packages
by Prema Kumar 25 Oct '12

25 Oct '12

Hi, Please go through the following link http://s.sudre.free.fr/Stuff/Installer/Unreleased_Notes/10.8_Gatekeeper.htm l Try the following command /usr/sbin/pkgutil --check-signature your_signed_package_or_distribution.pkg Regards Prema On 10/25/12 6:47 PM, "Khushneet Inder Singh" <ksingh(a)quark.com> wrote: >Hi all, > >I am stuck with an issue that I didn't find any way to verify the >productsigned package is whether signed with Apple's Developer ID or >not, as I am pushing the flat package silently (Without UI). >"productsign" didn't seems to offer me any way to do this or I didn't >explored its power yet. I tried using "spctl" that works fine on Lion >and Mountain lion, but not on Snow Leopard and Leopard. I want to cover >all OSx from leopard to Mountain Lion. > >Thanks, >Khushneet > > _______________________________________________ >Do not post admin requests to the list. They will be ignored. >Installer-dev mailing list (Installer-dev(a)lists.apple.com) >Help/Unsubscribe/Update your Subscription: >https://lists.apple.com/mailman/options/installer-dev/prema.kumar%40efi.co >m > >This email sent to prema.kumar(a)efi.com Confidentiality notice: This message may contain confidential information. It is intended only for the person to whom it is addressed. If you are not that person, you should not use this message. We request that you notify us by replying to this message, and then delete all copies including any contained in your reply. Thank you. _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Verify productsign on flat packages
by Khushneet Inder Singh 25 Oct '12

25 Oct '12

Hi all, I am stuck with an issue that I didn't find any way to verify the productsigned package is whether signed with Apple's Developer ID or not, as I am pushing the flat package silently (Without UI). "productsign" didn't seems to offer me any way to do this or I didn't explored its power yet. I tried using "spctl" that works fine on Lion and Mountain lion, but not on Snow Leopard and Leopard. I want to cover all OSx from leopard to Mountain Lion. Thanks, Khushneet _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0