My Developer ID Installer is expiring soon, according to this page I must re-sign all my existing installers or else no one can use them anymore. How do I do this? Can I strip away or replace the signature somehow?
What I've tried so far:
I have removed the old certificate from my keychain and added a new one. It has the same ID and everything as the old certificate, but a new expiry date.
I've tried running productsign which looks like it's replacing the signature alright but when I inspect the new installer it still has the old certificate expiry date.
Command used:
productsign --sign MYSIGNID oldSignedInstaller.pkg newSignedInstaller.pkg
productsign is capable of replacing an installer package’s signature entirely. Consider the transcript below. I started with a package that’s signed with my Developer ID. I replaced that with a Mac App Store signature. I then replaced it again with a Developer ID one.
I’m not sure what’s going on with your setup. It’s possible that productsign is getting mixed up about what identity to use. If so, you can pass the SHA-1 hash for the identity instead. To see a list of identities and their hashes, run the following command:
% security find-identity -v
If that doesn’t fix, try running my test, that is, replace the signature with something obviously different and then again with your new Developer ID, dumping the signature at each step. Does that behave correctly?
This is on macOS 12.2 btw.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
% pkgutil --check-signature PrivilegedTool.pkg
Package "PrivilegedTool.pkg":
…
Certificate Chain:
1. Developer ID Installer: Quinn Quinn (SKMME9E2Y8)
Expires: 2022-08-01 16:32:52 +0000
…
------------------------------------------------------------------------
2. Developer ID Certification Authority
Expires: 2027-02-01 22:12:15 +0000
…
------------------------------------------------------------------------
3. Apple Root CA
Expires: 2035-02-09 21:40:36 +0000
…
% productsign --sign "3rd Party Mac Developer Installer: Quinn Quinn (SKMME9E2Y8)" PrivilegedTool.pkg PrivilegedTool-re-signed.pkg
…
% pkgutil --check-signature PrivilegedTool-re-signed.pkg
Package "PrivilegedTool-re-signed.pkg":
…
Certificate Chain:
1. 3rd Party Mac Developer Installer: Quinn Quinn (SKMME9E2Y8)
Expires: 2022-04-16 14:02:16 +0000
…
------------------------------------------------------------------------
2. Apple Worldwide Developer Relations Certification Authority
Expires: 2030-02-20 00:00:00 +0000
…
------------------------------------------------------------------------
3. Apple Root CA
Expires: 2035-02-09 21:40:36 +0000
…
% productsign --sign "Developer ID Installer: Quinn Quinn (SKMME9E2Y8)" PrivilegedTool-re-signed.pkg PrivilegedTool-re-signed-2.pkg
…
% pkgutil --check-signature PrivilegedTool-re-signed-2.pkg
Package "PrivilegedTool-re-signed-2.pkg":
…
Certificate Chain:
1. Developer ID Installer: Quinn Quinn (SKMME9E2Y8)
Expires: 2022-08-01 16:32:52 +0000
…
------------------------------------------------------------------------
2. Developer ID Certification Authority
Expires: 2027-02-01 22:12:15 +0000
…
------------------------------------------------------------------------
3. Apple Root CA
Expires: 2035-02-09 21:40:36 +0000
…