How do I re-sign a .pkg installer file?

Question

Created Jan ’22

Replies 2

Boosts 0

Views 3.2k

Participants 2

My Developer ID Installer is expiring soon, according to this page I must re-sign all my existing installers or else no one can use them anymore. How do I do this? Can I strip away or replace the signature somehow?

What I've tried so far:

I have removed the old certificate from my keychain and added a new one. It has the same ID and everything as the old certificate, but a new expiry date.

I've tried running productsign which looks like it's replacing the signature alright but when I inspect the new installer it still has the old certificate expiry date.

Command used:

productsign --sign MYSIGNID oldSignedInstaller.pkg newSignedInstaller.pkg

Boost

Answer 1

DTS Engineer OP

Apple

Feb ’22

Accepted Answer

productsign is capable of replacing an installer package’s signature entirely. Consider the transcript below. I started with a package that’s signed with my Developer ID. I replaced that with a Mac App Store signature. I then replaced it again with a Developer ID one.

I’m not sure what’s going on with your setup. It’s possible that productsign is getting mixed up about what identity to use. If so, you can pass the SHA-1 hash for the identity instead. To see a list of identities and their hashes, run the following command:

% security find-identity -v

If that doesn’t fix, try running my test, that is, replace the signature with something obviously different and then again with your new Developer ID, dumping the signature at each step. Does that behave correctly?

This is on macOS 12.2 btw.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

% pkgutil --check-signature PrivilegedTool.pkg 
Package "PrivilegedTool.pkg":
   …
   Certificate Chain:
    1. Developer ID Installer: Quinn Quinn (SKMME9E2Y8)
       Expires: 2022-08-01 16:32:52 +0000
       …
       ------------------------------------------------------------------------
    2. Developer ID Certification Authority
       Expires: 2027-02-01 22:12:15 +0000
       …
       ------------------------------------------------------------------------
    3. Apple Root CA
       Expires: 2035-02-09 21:40:36 +0000
       …
% productsign --sign "3rd Party Mac Developer Installer: Quinn Quinn (SKMME9E2Y8)" PrivilegedTool.pkg PrivilegedTool-re-signed.pkg
…
% pkgutil --check-signature PrivilegedTool-re-signed.pkg 
Package "PrivilegedTool-re-signed.pkg":
   …
   Certificate Chain:
    1. 3rd Party Mac Developer Installer: Quinn Quinn (SKMME9E2Y8)
       Expires: 2022-04-16 14:02:16 +0000
       …
       ------------------------------------------------------------------------
    2. Apple Worldwide Developer Relations Certification Authority
       Expires: 2030-02-20 00:00:00 +0000
       …
       ------------------------------------------------------------------------
    3. Apple Root CA
       Expires: 2035-02-09 21:40:36 +0000
       …
% productsign --sign "Developer ID Installer: Quinn Quinn (SKMME9E2Y8)" PrivilegedTool-re-signed.pkg PrivilegedTool-re-signed-2.pkg
…
% pkgutil --check-signature PrivilegedTool-re-signed-2.pkg 
Package "PrivilegedTool-re-signed-2.pkg":
   …
   Certificate Chain:
    1. Developer ID Installer: Quinn Quinn (SKMME9E2Y8)
       Expires: 2022-08-01 16:32:52 +0000
       …
       ------------------------------------------------------------------------
    2. Developer ID Certification Authority
       Expires: 2027-02-01 22:12:15 +0000
       …
       ------------------------------------------------------------------------
    3. Apple Root CA
       Expires: 2035-02-09 21:40:36 +0000
       …

1

Answer 2

sweetpotatofish OP

Feb ’22

Thank you for your help! Although I had deleted the old certificate on my keychain there was a duplicate of it that only showed up if I selected to see "All Items" instead of "Certificates". Your command "security find-identity -v" helped me see that this certificate was still around somewhere and that it was the default. My new signed installer is showing the correct expiry date now, thanks again!

0