NSUpdateSecurityPolicy AllowProcesses where and how to add Items

Hi, in the video wwdc2022-10096 at about 05:45 it is explained how to allow other software to update your software by adding team-idetifiers an signing-identifiers to an Info.plist. I would need a few more details.

  1. Which Info.plist file do I have to change?

I use pkgbuild to build the packages and productbuild to combine them. pkgbuild --analyse --root generates an .plist-file for every single package. Do I have to add the Information there? productbuild --sythesize generates an xml-file discribing the whole thing. This would refer better to the installer as a whole, but it is not an info.plist.

  1. How and where exactly to add the information?

I tried to use plutil, but it doesn't like array-names to start with numbers as team-identifiers often do. Also it crashes quite often. The .plist-files generated by pkgbuild either contain an empty array or several unnamed items.

[

]

Do I even need to add something threre? The other one contains several Items: [

  0 => {

    "BundleIsRelocatable" => 0

    "BundleIsVersionChecked" => 1

    "BundleOverwriteAction" => "upgrade"

    "NSUpdateSecurityPolicy" => {

      "AllowProcesses" => {

        "123ABC" => [

          0 => "com.example.pal.about"

        ]

      }

    }

    "RootRelativeBundlePath" => "Library/PreferencePanes/***.prefPane"

  }

  1 => {

    "BundleIsRelocatable" => 0

    "BundleIsVersionChecked" => 1

    "BundleOverwriteAction" => "upgrade"

    "NSUpdateSecurityPolicy" => {

      "AllowProcesses" => {

        "123ABC" => [

          0 => "com.example.pal.about"

        ]

      }

    }

    "RootRelativeBundlePath" => "Library/Frameworks/***.framework"

  }

  2 => {

    "BundleHasStrictIdentifier" => 1

    "BundleIsRelocatable" => 0

    "BundleIsVersionChecked" => 1

    "BundleOverwriteAction" => "upgrade"

    "NSUpdateSecurityPolicy" => {

      "AllowProcesses" => {

        "123ABC" => [

          0 => "com.example.pal.about"

        ]

      }

    }

    "RootRelativeBundlePath" => "Applications/***.app"

  }

]

Should it look like this? A more detailed example would be great. Thanks!

Replies

If no one knows, guessing would be appreciated as well. Or maybe a link to some useful documentation.