My app is properly code signed...
codesign -vv MyApp.app
MyApp.app: valid on disk
MyApp.app: satisfies its Designated Requirement
spctl -vv --assess --type execute MyApp.app
MyApp.app: accepted
source=Developer ID
origin=Developer ID Application: Me / My Company
It contains a plugin at MyApp.app/Contents/Plugins/jre
.
If I create an installer...
productbuild --sign 'Developer ID Installer: Me' --root MyApp.app
/Applications/MyApp.app MyAppInstaller.pkg
... then install it, then the installed MyApp is no longer properly code signed.
codesign -vv /Applications/MyApp.app
/Applications/MyApp.app: code object is not signed at all
In subcomponent: /Applications/MyApp.app/Contents/PlugIns/jre/Contents/_CodeSignature/CodeResources
Other notes:
I tried usingpkgbuild
to build a separate package for both for MyApp.app and the plugin, then combine them using productbuild
, but I got the same result. I am unsure if the pkgbuild
step is even necessary.
What am I missing?
This appeared to work for me:
productbuild --component ./MyApp.app /Applications --sign 'Developer ID Installer: Me' MyAppInstaller.pkg
I guess it was necessary to use --component
instead of --root
.