Apple

On Feb 15, 2014, at 8:00 AM, Roland King <email@hidden> wrote:

I've built a package, each component of which is signed, the package itself is signed with productsign and running pkgutil on it gives this

$ pkgutil --check-signature RKNRFGO.pkg
Package "RKNRFGO.pkg":
   Status: signed by a developer certificate issued by Apple
   Certificate Chain:
1. 3rd Party Mac Developer Installer: Roland King (LD65ZXD7W6)
   SHA1 fingerprint: 62 6B 4F 35 E7 04 FA 16 67 29 93 0C 3F 08 FE 05 2A C1 76 BF
   -----------------------------------------------------------------------------
2. Apple Worldwide Developer Relations Certification Authority
   SHA1 fingerprint: 09 50 B6 CD 3D 2F 37 EA 24 6A 1A AA 20 DF AA DB D6 FE 1F 75
   -----------------------------------------------------------------------------
3. Apple Root CA
   SHA1 fingerprint: 61 1E 5B 66 2C 59 3A 08 FF 58 D1 4A E2 24 52 D1 98 DF 6C 60

However when I put this on a webserver and download it I get the "unknown developer" dialog and the package won't install. The application and both command-line tools inside are signed, the flat package installer is signed, pkgutil thinks it's signed and yet OSX won't deal with it. What else do I need to do? (and is this the right list?)

I believe the "3rd Party Mac Developer Installer" certificate is for the Mac App Store. If your intent is to create a package to be distributed by other means (not Mac App Store), then you want to sign with Developer ID certificates (Application/Installer).

As to list/forum, this list is probably as appropriate as any of the lists on lists.apple.com. There is also the Developer Forums on Apple's developer site (specifically, Mac Development > Deployment > Gatekeeper for this query), though I personally don't browse or avail myself of their content on a regular basis (perhaps that's just me).

References:
	>cannot get a package signed (From: Roland King <email@hidden>)