macoscode-signingcodesigncode-signing-certificatepkg-file

Why is my package categorized as dangerous package

OSX 10.12.3, i have a package which is code signed using EV code sign. 

$ codesign --force --sign "3rd Party Mac Developer Application: myname (code...)" mypackage.pkg

But when anyone download and try to install it in OSX, they all getting as following:

enter image description here

in English its same dialog box: “App can’t be opened because it is from an unidentified developer”

enter image description here

When i do checking for the code sign, i can see its working:

$ pkgutil --check-signature mypackage.pkg
Package "mypackage.pkg":
   Status: no signature

$ codesign -dv --verbose=4 mypackage.pkg
Executable=/Users/xxx/xxxxxx
Identifier=xxxx
Format=generic
CodeDirectory v=20200 size=177 flags=0x0(none) hashes=1+2 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha1=xx
CandidateCDHash sha256=xx
Hash choices=sha1,sha256
CDHash=xxxxx
Signature size=4715
Authority=3rd Party Mac Developer Application: xxxxx
Authority=Apple Worldwide Developer Relations Certification Authority
Authority=Apple Root CA
Signed Time=1xxx
Info.plist=not bound
TeamIdentifier=xxxxx
Sealed Resources=none
Internal requirements count=1 size=196

How to i make sure its correctly done? so that it does not scare the OSX user, what is am i missing here?

Solution

  • The code-signing identity "3rd Party Mac Developer Application: <Team Name>" is used to sign an app before submitting it to the app store. It is not useful for distribution outside of the app store.

    To sign an app bundle for distribution outside of the app store, use the "Developer ID Application: <Team Name>" identity.

    However, you said you're signing a "package" and showed a file with .pkg file extension. To sign an installer package, use the "Developer ID Installer: <Team Name>" identity. Furthermore, you should use productsign or the appropriate options to pkgbuild or productbuild, not codesign, to sign installer packages.