That's it! I was missing that intermediate certificate. Thanks much, Stephane! Regards, Howard On Aug 17, 2012, at 12:32 AM, Stephane Sudre wrote:

Signing would even work on Mac OS X 10.5.8 if productsign was compatible with it (codesign works on 10.5.8 and Gatekeeper compatible binaries can be built).

From your description, it looks like an intermediate certificate is missing.

You should have the "Developer ID Certification Authority" certificate installed on your signing system.

On Thu, Aug 16, 2012 at 7:11 PM, Howard Moon <howard@antarestech.com> wrote:

...

I suspect signing my installer WOULD have worked on my Snow Leopard machine, IF that certificate didn't say it was signed by an unknown authority. What I don't know is why it says that.

On Aug 16, 2012, at 9:54 AM, Rustam Muginov wrote:

Signing on 10.6.8 does work for me, I just need to use command-line invocation of signing utilities (codesign for binaries, productsign for installer packages).

-- Sincerely, Rustam Muginov

On Aug 16, 2012, at 9:43 AM, George Taylor wrote:

Hi Howard,

I had a very similar issue and this is what Apple DTS instructed me to do:

Developer ID signing is only supported on OS X 10.7.3 and later with Xcode 4.3 and later. You may need to sign your app by hand on a 10.7.3 or later system.

If you do that (instead of using Xcode 4.3+), create a small test project and have Xcode sign it. Then pass the same designated requirement to codesign, changing the identifier to match your app's bundle ID.

So apparently signing in SL is a no-go.

George

On Aug 16, 2012, at 11:56 AM, Howard Moon wrote:

Well, if I do the actual signing on my Mountain Lion machine, everything works perfectly. Not sure why my certificate says it's signed by an unknown authority on my Snow Leopard machine, but that appears to be the cause for the signing itself to fail. For now, I'll just take it to my other box to sign and move on from there.

Thanks, Howard

On Aug 15, 2012, at 6:44 PM, Rustam Muginov wrote:

That would be very easy to test. Create a small simple installer, sign it, put on web server and post link here. Someone would try and report. -- Sincerely, Rustam Muginov

On Aug 14, 2012, at 2:04 PM, Howard Moon wrote:

Well, that didn't solve the problem. His machine still pops up that dialog.

I looked in my Keychain Access app on my development machine, and I see that the Developer ID Installer certificate says "This certificate was signed by an unknown authority." I removed that, rebooted, and re-imported it from my Mountain Lion machine, but it still says that. Could this be the problem? Do I need to sign the installers from my Mountain Lion machine, instead of my development Snow Leopard machine? Or is this a problem on HIS end???

-Howard

On Aug 14, 2012, at 11:25 AM, Howard Moon wrote:

I *think* I know the answer. Since I do my development on a Snow Leopard machine using Xcode 3.2.x, I had exported my Developer and Installer certificates and imported them on my Snow Leopard machine. I think I need the "intermediate" certificate mentioned in the online docs in order to have productsign properly embed it so that users' machines don't have to already have that on their machines. That should allow the installers to run on machines that haven't installed that certificate already, right?

Can I just export that certificate and import it on my Snow Leopard machine, or do I have to actually do the signing on my Mountain Lion machine?

Thanks,

-Howard

On Aug 14, 2012, at 11:10 AM, Howard Moon wrote:

The installer works fine on that same co-worker's Mountain Lion OS, so it looks like an OS issue.

He's going to test in Snow Leopard and Leopard, but so far it's only failing on Lion (and he can choose to Continue, anyway, but we don't want *users* to have to make that decision!).

Thanks,

Howard

On Aug 14, 2012, at 10:49 AM, Howard Moon wrote:

Hi all,

I made a signed installer that checks out fine for me, using a "clean" Mountain Lion OS. But a co-worker who has downloaded the installer to test it is getting a "signed with an invalid certificate" error when running the installer in Lion. What could be the problem?

Could the server he's taking it from have caused a problem somehow? The .pkg file is in a .zip file (so that I can label it by date and version, for internal testing, and also to prevent the Windows server at our main facility from messing with the file in any way). I don't see how the server could affect the .pkg file when it's contained in a .zip file, though.

I'm downloading that zip file from my own local server, unzipping it, and then running the resulting .pkg file with no problem on my machines, but could using a zip file have anything to do with why he's getting this error? I wouldn't think so, but I'm grasping at straws here.

Thanks,

Howard

_______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/rmuginov%40gmail.com

This email sent to rmuginov@gmail.com

_______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/gmt%40synthogy.com

This email sent to gmt@synthogy.com

_______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/rmuginov%40gmail.com

This email sent to rmuginov@gmail.com

_______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/dev.iceberg%40gmail.co...

This email sent to dev.iceberg@gmail.com

-- Packaging Resources - http://s.sudre.free.fr/Packaging.html _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/howard%40antarestech.c...

This email sent to howard@antarestech.com

_______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists.... This email sent to site_archiver@lists.apple.com