August 2017 - Installer-dev

Re: Expiration of Developer ID Installer certificates
by Prema Kumar 14 Aug '17

14 Aug '17

site_archiver(a)lists.apple.com Delivered-To: Installer-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=efi.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=N3fKHCQWJkNgob6yERgMTnutHjLVeNruYk70hwOqlKA=; b=eOHB9eNxjMDMpcS+0d9EZrjAaoG/x2ZeIBpG2mBIdSimNvTj1ycoyENO64mzjpRznnFMUVN9wVsCPqbu8bmyCZaPyES1MsqtrCOGalPy9NCIDoa6xZ9Sj8i9jze9h91aiHuzyZE0I722Y3T12rXLVFmqlLaW7GHUphw+yK6L1eM= Spamdiagnosticmetadata: NSPM Spamdiagnosticoutput: 1:99 Thread-index: AQHTAVEYhoGj6c9uUUyb5Hrldg1KsaJzKaWAgAANEACAAPmqgIAJ9BCAgAGRfoCAAB4YAIABTn8AgAA9WwCAAnCYgA== Thread-topic: Expiration of Developer ID Installer certificates User-agent: Microsoft-MacOutlook/14.7.3.170325 Hi, >From my experience, Silent installation fails unless -allowUntrusted is specified. Regards Prema Kumar On 8/13/17, 2:53 AM, "Installer-dev on behalf of Stephane Sudre" <installer-dev-bounces+prema.kumar=efi.com(a)lists.apple.com on behalf of dev.iceberg(a)gmail.com> wrote: >On Sat, Aug 12, 2017 at 7:43 PM, Rob Prentiss <rob(a)prentiss.name> wrote: >> Yes, but Installer doesn¹t stop you from installing something with an >> expired signature. Gatekeeper does. > >This is not what I've been observing so far. Here's what I've observed so >far: > >- Gatekeeper does not prevent someone from installing a distribution >with an expired certificate. > >- Installer.app can present an alert sheet that states that the >certificate has expired when you open a distribution. > > >Evidence #1: > > >OS X 10.10.5 - Installer.app 6.1.0 (815) - A flat distribution with an >expired certificate and the com.apple.quarantine extended attribute >set. > >1. Open the disk image >2. Open the distribution. > >=> No Gatekeeper alert. > >The only way to notice that the certificate has expired is to click on >the Installer.app document window Lock button (the one with a visual >bug in OS X 10.10.5) > > >Evidence #2: > >Mac OS X 10.7.6 - Installer.app 5.0.1 (538) The same flat distribution >with the expired certificate and the com.apple.quarantine extended >attribute set. > >1. Open the disk image >2. Open the distribution. > >=> An alert sheet is displayed for the Installer.app document window >stating: > >"xxxxx was signed with a certificate that has expired. If you acquired >this package recently, it may not be authentic. Do you want to >continue with the installation anyway? > >[ Show Certificate ] [ Cancel ] [ Continue ]" > > >To remove any doubt, this is not related to Gatekeeper quarantine flag: > >1. __Remove__ the com.apple.quarantine extended attribute with xattr >on the disk image. >2. Open the disk image. >3. Open the distribution. > >=> The alert sheet is displayed for the Installer.app document window. > > >Depending on the version of Installer.appm, it does behave differently >when a distribution or package is signed with an expired certificate. > > >I don't have access to 10.5, 10.6, 10.8 and 10.9 OS partitions at this >time, so I can't check whether one of these OS X version exhibits a >different behavior that the ones already reported. > _______________________________________________ >Do not post admin requests to the list. They will be ignored. >Installer-dev mailing list (Installer-dev(a)lists.apple.com) >Help/Unsubscribe/Update your Subscription: >https://lists.apple.com/mailman/options/installer-dev/prema.kumar%40efi.co >m > >This email sent to prema.kumar(a)efi.com Confidentiality notice: This message may contain confidential information. It is intended only for the person to whom it is addressed. If you are not that person, you should not use this message. We request that you notify us by replying to this message, and then delete all copies including any contained in your reply. Thank you. _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Expiration of Developer ID Installer certificates
by Stephane Sudre 12 Aug '17

12 Aug '17

site_archiver(a)lists.apple.com Delivered-To: Installer-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=YysUkd9gDFxHE+H0LaIdAsR4GESRbv5Xdr9Bkt0J5ak=; b=G91E0+LFvMsG+WkM0kYeuYT8hrD0En3//8waE4nA4wQ80lVVfStmGJBxhVGkZKDaH3 3eJmsEK5W97b37Mhc8J7hSgZFC6KpB+sPwa5ME6SLvABTzfal9UsEghH/f3JvZfmU0GS H/RFRAi/I+uchweeAByS3LsvCJONRpsmOb57a4VQXbzkmstSgmVHrJaYqLDiHjFyUgm5 KLqwsvVQT9fGA1mSPjiJPRSizUaAFzT02r1SUUHij/8xUDgsJpfMHAmfQt2AyVcq2uJT jFUhEVvD0dB0hm+mlM8DcUsddXxTpNynGUd4xTc0gpibvQpMDUs1zLk4PQBErMa2UhgS fIGA== On Sat, Aug 12, 2017 at 7:43 PM, Rob Prentiss <rob(a)prentiss.name> wrote: > Yes, but Installer doesn’t stop you from installing something with an > expired signature. Gatekeeper does. This is not what I've been observing so far. Here's what I've observed so far: - Gatekeeper does not prevent someone from installing a distribution with an expired certificate. - Installer.app can present an alert sheet that states that the certificate has expired when you open a distribution. Evidence #1: OS X 10.10.5 - Installer.app 6.1.0 (815) - A flat distribution with an expired certificate and the com.apple.quarantine extended attribute set. 1. Open the disk image 2. Open the distribution. => No Gatekeeper alert. The only way to notice that the certificate has expired is to click on the Installer.app document window Lock button (the one with a visual bug in OS X 10.10.5) Evidence #2: Mac OS X 10.7.6 - Installer.app 5.0.1 (538) The same flat distribution with the expired certificate and the com.apple.quarantine extended attribute set. 1. Open the disk image 2. Open the distribution. => An alert sheet is displayed for the Installer.app document window stating: "xxxxx was signed with a certificate that has expired. If you acquired this package recently, it may not be authentic. Do you want to continue with the installation anyway? [ Show Certificate ] [ Cancel ] [ Continue ]" To remove any doubt, this is not related to Gatekeeper quarantine flag: 1. __Remove__ the com.apple.quarantine extended attribute with xattr on the disk image. 2. Open the disk image. 3. Open the distribution. => The alert sheet is displayed for the Installer.app document window. Depending on the version of Installer.appm, it does behave differently when a distribution or package is signed with an expired certificate. I don't have access to 10.5, 10.6, 10.8 and 10.9 OS partitions at this time, so I can't check whether one of these OS X version exhibits a different behavior that the ones already reported. _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Expiration of Developer ID Installer certificates
by Rob Prentiss 12 Aug '17

12 Aug '17

site_archiver(a)lists.apple.com Delivered-To: Installer-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=prentiss.name; s=prentiss; h=date:from:to:cc:message-id:in-reply-to:references:subject :mime-version; bh=QfqRLBJ6oPlDsgHBSO/Yl8SBNdUWN/el+gBC1fgweSM=; b=ZpS7vRrNFRSnBlF5XGeCieQWk5iog0Al18iczPY12keP5aPKmUu2/Yb/qPX+Nzw28W hyG1ZCK2HThVqtg8AkDL89hFia4nnESyinNgDfMFvmIAa5IAXP9U2BzlgMK+0T4kHwgJ AcwhCJ3XchUCxTAtWqacVWK4VcPcjbPBGdhYc= Yes, but Installer doesn’t stop you from installing something with an expired signature. Gatekeeper does. — -Rob On Aug 11, 2017, 2:46 PM -0700, Stephane Sudre <dev.iceberg(a)gmail.com>, wrote: > On Fri, Aug 11, 2017 at 9:59 PM, Rob Prentiss <rob(a)prentiss.name> wrote: > > Did you do a fresh download of the installer package? > > > > Gatekeeper will only prevent you from opening an installer or app when the > > file has just been downloaded, or otherwise has the `com.apple.quarantine` > > extended attribute set. After you've opened the package once, the attribute > > value is cleared, and gatekeeper don't check anymore. > > Regarding the original additional irritation, it's not Gatekeeper that > displays the certificate as expired or not depending on the OS version > in the UI of Installer.app. This is the SFCertificateView class which > is part of the SecurityInterface.framework APIs. _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Expiration of Developer ID Installer certificates
by Stephane Sudre 11 Aug '17

11 Aug '17

site_archiver(a)lists.apple.com Delivered-To: Installer-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=O8HvjP93e3RNDrA5PIei9esZtnXu6EwiPRl4Yf4dXHw=; b=d4ol+xp/uU6gjc+Fl0mT5HM9ckgW6DzHdHGpSHIFPVkESqAukxgF9Et7AzXxJzPiKW uFLUKskuSSf0TbWz3RmQNxHtyDVDm5ytoakO/wO5vvL49w+beHTJCjBzQ3NrQRX7K8LC L+4VBo4dEPLNoWVxa9UpGFlq0yRaOV3WmSUcHQnUn0JrGR6h9LJ8E8Jq2Yu9w+cjx/xD XZcj/IW1llELYW6+KN5h8G7g51IbZDfoiiuszxOtvIIDvhofJoE0JFhGKV4CRzEKqnJu Em9MVyKOqxpl5DYW31fLZtw/Pu5JqFEPoCd8OqpIc52WmyBHXk+DyhZdZljrXLXFO2y3 zmyw== On Fri, Aug 11, 2017 at 9:59 PM, Rob Prentiss <rob(a)prentiss.name> wrote: > Did you do a fresh download of the installer package? > > Gatekeeper will only prevent you from opening an installer or app when the > file has just been downloaded, or otherwise has the `com.apple.quarantine` > extended attribute set. After you've opened the package once, the attribute > value is cleared, and gatekeeper don't check anymore. Regarding the original additional irritation, it's not Gatekeeper that displays the certificate as expired or not depending on the OS version in the UI of Installer.app. This is the SFCertificateView class which is part of the SecurityInterface.framework APIs. _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Expiration of Developer ID Installer certificates
by Rob Prentiss 11 Aug '17

11 Aug '17

site_archiver(a)lists.apple.com Delivered-To: Installer-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=prentiss.name; s=prentiss; h=date:from:to:message-id:in-reply-to:references:subject:mime-version; bh=p30f2vj+v30iyKH6+fjJlbeaLhAzkMpjHhOj9jRL954=; b=A3YBM1BEAANrwQK7xCEBRk1swDQkeWI7HpsUgmIZOx6uzn1zkUW6aJmncbFB0K3aS7 V8ru6J/b9G9lud7KeGe0+5z9KHFStdhvTwIg+GFonmGRjJn9paitv1j/gNjLIX0pGKZL tg1QIfE1wBC4Isq/K5mwLdyO87PszzfO6a1VU= Did you do a fresh download of the installer package? Gatekeeper will only prevent you from opening an installer or app when the file has just been downloaded, or otherwise has the `com.apple.quarantine` extended attribute set. After you've opened the package once, the attribute value is cleared, and gatekeeper don't check anymore. Also, why the arguments on this? Why not just re-sign the packages with a valid (non-expired) certificate? Certificates expire for a reason. — Rob On Aug 10, 2017, 1:02 PM -0700, Brian Kendall <guygizmo(a)gmail.com>, wrote: > Prema et al, > > > On Aug 4, 2017, at 2:32 AM, Prema Kumar <Prema.Kumar(a)efi.com> wrote: > > > > Hi, > > According to the following link new installations will not work. > > > > https://developer.apple.com/support/certificates/ > > Read the section "Developer ID Installer Certificate (Mac applications)” > > I've read the text, and the reason for my earlier email to this list (and I > believe for Paul as well) is that even though this page reads: > > > • Developer ID Installer Certificate (Mac applications) > > If your certificate expires, users can no longer launch installer packages > > for your Mac applications that were signed with this certificate. > > Previously installed apps will continue to run however new installations > > will not be possible until you have re-signed your installer package with a > > valid Developer ID Installer certificate. If your certificate has been > > revoked, users will no longer be able to install applications that have > > been signed with this certificate. > > ... that doesn't actually appear to be true! As I said in my previous email, > I set the clock forward past my certificate's expiration date on both a macOS > 10.11 and 10.12 system and was still able to run my installer. In 10.11 it > even said the certificate was expired if I clicked the lock icon in > Installer.app but otherwise I could run the installer. > > So clearly we have a situation where my results do not line up with Apple's > documentation. So I'm wondering, what is the explanation for this? Do I > actually need to resign all of my old installers, or will users continue to > be able to use them? > > Regards, > - Brian > _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Distribution package has incorrect download percentage
by Ralph Alvy 11 Aug '17

11 Aug '17

site_archiver(a)lists.apple.com Delivered-To: installer-dev(a)lists.apple.com On 11 Aug 2017, at 12:15, Stephane Sudre wrote: On Fri, Aug 11, 2017 at 6:49 PM, James Pritchard <james(a)emnetsoftware.com> wrote: I don’t know if anyone can help me. [...] issues with our customers. It's a known bug in Installer.app that has been there for years and has been reported to Apple years ago. It has never been fixed. There's also a similar issue in the JavaScript APIs for distributions. Same thing, reported years ago. Never fixed. _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/ralph%40ralphalvy.com This email sent to ralph(a)ralphalvy.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com Given other bugs in Installer.app, has Apple said they are no longer developing this app? It works very nicely apart from the download percentage I get is very wrong. Each percentage figure I get is out by a factor of 100, so 1% was 100% and 99% was 9,900%. It was very confusing to me and could potentially cause I was wondering if anyone else had experienced this and whether there was a workaround? Is it a bug in packages or is it something I’m doing wrong?

1 0

Re: Distribution package has incorrect download percentage
by Stephane Sudre 11 Aug '17

11 Aug '17

site_archiver(a)lists.apple.com Delivered-To: installer-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=iGcq/s5FXWiwJSnwxmMN7njFRfPLsFbhO1LUKiMc8sc=; b=ujQIgaQrEbxa+U+lKwt35IMw4u2heUwzf81hjN+QD9e8etQ21DU9bhNyJs+HLpIWk5 Shw3UaiNLITkpwuppWGJVFlJS4n/b2eAjlGAXrhPeJSYh7w1SPNRMnry7ZmKC7BpGUfv N3jZX9/uegcMlDrN17nLJWqA5ueaQzNjaG2fAJz5oeQS+S4KDZOuxNdnHhEEdeT7+p1K gbrOreJrlP8nKeZPYPuijTCE8PuvApN60zFdatM/4zupDI9hT1vilonLnwWVaZ9LxVoN H1ZfBbzSsGA8DCe9PyDMZdge/xzEnucv9UkuNPWmuxxRWbsNNqf+RTcDJTN2bQfOfNGc Aasw== On Fri, Aug 11, 2017 at 6:49 PM, James Pritchard <james(a)emnetsoftware.com> wrote: > I don’t know if anyone can help me. > > > [...] > > It works very nicely apart from the download percentage I get is very wrong. > Each percentage figure I get is out by a factor of 100, so 1% was 100% and > 99% was 9,900%. It was very confusing to me and could potentially cause > issues with our customers. > > > > I was wondering if anyone else had experienced this and whether there was a > workaround? Is it a bug in packages or is it something I’m doing wrong? It's a known bug in Installer.app that has been there for years and has been reported to Apple years ago. It has never been fixed. There's also a similar issue in the JavaScript APIs for distributions. Same thing, reported years ago. Never fixed. _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Distribution package has incorrect download percentage
by Conor Schutzman 11 Aug '17

11 Aug '17

site_archiver(a)lists.apple.com Delivered-To: installer-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mac.com; s=04042017; t=1502470662; bh=XtIhPnqtTwdk9QdTbQGGVR9sziz6LZ26znYoc6SIsWw=; h=From:Message-id:Content-type:MIME-version:Subject:Date:To; b=MDd7xghcZ4PlvmrdM02yLjLwuqo4U211TIIcoYEHNz5gYG5mvlEyIBUiy7yoZM3sD g3ZdTdDdZvUu0CCyOG9FF4hthCtn4uRi7iOhcua6UxvtYWae1wIewx/IReW0XiqlV0 tBrFyPiH2/W1aqmjvyGdeEf31nBQnXencBFqsSEKKqQu0fJiacKhm5GU/AfpNXwzCE LicLF8jvyjadH5RlH9FAEv5wBHmGIFiIzcTvn1FelKVlRfDAWi9EK0hMZtHyfNWHJ9 /1Ok3yt59M/TSM7+QCiJI0kCqMjcr1Rq4+BTJpTDL7f0HJ1hpyRfO8NfZR2QC7WG8a QrVn0AdLI/p3w== If I may inquire? Why the hosted component packages instead of just build them all into one distribution package with local resources? > On Aug 11, 2017, at 9:49 AM, James Pritchard <james(a)emnetsoftware.com> wrote: > > I don’t know if anyone can help me. > > I’ve been asked to investigate providing a better download experience for our > customers. > > We’ve been happily using Packages for many years now and are currently using > version 1.1.3 on OSX El Capitan (version 10.11.6). > > Our current software is packaged into five or six packages that users have to > download individually and click through the UI for each one to install. > > I found that it’s possible to create raw packages from each of our > distribution packages (using an export function) and then add them all to one > distribution package with one UI. Each raw package I add as a referenced > package with a given URL to download the package from. > > It works very nicely apart from the download percentage I get is very wrong. > Each percentage figure I get is out by a factor of 100, so 1% was 100% and > 99% was 9,900%. It was very confusing to me and could potentially cause > issues with our customers. > > I was wondering if anyone else had experienced this and whether there was a > workaround? Is it a bug in packages or is it something I’m doing wrong? > > I’d really appreciate any help anyone can give me on this. > Thanks, > James > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Installer-dev mailing list (Installer-dev(a)lists.apple.com > <mailto:Installer-dev@lists.apple.com>) > Help/Unsubscribe/Update your Subscription: > https://lists.apple.com/mailman/options/installer-dev/conor%40mac.com > <https://lists.apple.com/mailman/options/installer-dev/conor%40mac.com> > > This email sent to conor(a)mac.com <mailto:conor@mac.com> _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Distribution package has incorrect download percentage
by James Pritchard 11 Aug '17

11 Aug '17

site_archiver(a)lists.apple.com Delivered-To: installer-dev(a)lists.apple.com Thread-index: AdMSvzSNk60cgM39TAupegC7bPCReA== I don't know if anyone can help me. I've been asked to investigate providing a better download experience for our customers. We've been happily using Packages for many years now and are currently using version 1.1.3 on OSX El Capitan (version 10.11.6). Our current software is packaged into five or six packages that users have to download individually and click through the UI for each one to install. I found that it's possible to create raw packages from each of our distribution packages (using an export function) and then add them all to one distribution package with one UI. Each raw package I add as a referenced package with a given URL to download the package from. It works very nicely apart from the download percentage I get is very wrong. Each percentage figure I get is out by a factor of 100, so 1% was 100% and 99% was 9,900%. It was very confusing to me and could potentially cause issues with our customers. I was wondering if anyone else had experienced this and whether there was a workaround? Is it a bug in packages or is it something I'm doing wrong? I'd really appreciate any help anyone can give me on this. Thanks, James _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Expiration of Developer ID Installer certificates
by Mike Solin 10 Aug '17

10 Aug '17

site_archiver(a)lists.apple.com Delivered-To: Installer-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mikesolin.com; s=google; h=from:mime-version:subject:date:references:to:in-reply-to:message-id; bh=CfAyI8kjWzyeGGelkMlRuHt0ebtxp/egVRSaOp/Ix4s=; b=bM1Xrvb0M1tLUR5okart+FMdfw7xOpTEZAyO60dmmE/NNfWWZWeInvNCbxrPBeZp4x UxJHKLIcLmWoTWjU2U7Zw21KGMZ3AJIpLv+CdcF+IxlQ/4vKcCcyKUmH3g7QhRMl0wLI lny8SJ6+c/eFIUHZLlkHpY0zCn+a6i+sDyWho= Try reaching out to Apple Developer Support to see if they can help. Mike -- mike(a)mikesolin.com / @flammable https://mikesolin.com > On Aug 10, 2017, at 4:02 PM, Brian Kendall <guygizmo(a)gmail.com> wrote: > > Prema et al, > >> On Aug 4, 2017, at 2:32 AM, Prema Kumar <Prema.Kumar(a)efi.com >> <mailto:Prema.Kumar@efi.com>> wrote: >> >> Hi, >> According to the following link new installations will not work. >> >> https://developer.apple.com/support/certificates >> <https://developer.apple.com/support/certificates>/ >> Read the section "Developer ID Installer Certificate (Mac applications)” > > I've read the text, and the reason for my earlier email to this list (and I > believe for Paul as well) is that even though this page reads: > > • Developer ID Installer Certificate (Mac applications) > If your certificate expires, users can no longer launch installer packages > for your Mac applications that were signed with this certificate. Previously > installed apps will continue to run however new installations will not be > possible until you have re-signed your installer package with a valid > Developer ID Installer certificate. If your certificate has been revoked, > users will no longer be able to install applications that have been signed > with this certificate. > > ... that doesn't actually appear to be true! As I said in my previous email, > I set the clock forward past my certificate's expiration date on both a macOS > 10.11 and 10.12 system and was still able to run my installer. In 10.11 it > even said the certificate was expired if I clicked the lock icon in > Installer.app but otherwise I could run the installer. > > So clearly we have a situation where my results do not line up with Apple's > documentation. So I'm wondering, what is the explanation for this? Do I > actually need to resign all of my old installers, or will users continue to > be able to use them? > > Regards, > - Brian > > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Installer-dev mailing list (Installer-dev(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > https://lists.apple.com/mailman/options/installer-dev/mike%40mikesolin.com > > This email sent to mike(a)mikesolin.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0