Mac distribution certs

I have a question about the different types of certs used for distributing macOS apps.

On the "Create a New Certificate" page in developer.apple.com portal and in https://developer.apple.com/forums/thread/128166, it suggests that the Mac App Distribution cert and Mac Installer Distribution cert are for submission apps to the Mac App Store. For distribution outside of the Mac App Store, the Developer ID certs should be used.

However, I tried with a package signed with the Mac Installer Distribution cert. It seems to install without issue. Does that mean the Mac Distribution certs can be used to sign packages to be distributed outside of the Mac App Store as well? If so, what are the benefits / advantages of using the Developer ID certs?

Up vote post of siaremote Down vote post of siaremote
81 views
Posted by
siaremote
Reply
Add a Comment

Replies

I tried with a package signed with the Mac Installer Distribution cert. It seems to install without issue.

In general the Mac only does a proper signing check when the software is quarantined [1]. When testing software that you plan to distribute independently, I recommend that you follow the process described in Testing a Notarised Product.

what are the benefits / advantages of using the Developer ID certs?

They are the only way to sign products that you distribute outside of the Mac App Store without forcing the user to bypass Gatekeeper.

ps For a bunch of info about Mac signing and distribution, see the Code Signing Resources post and the various other posts it links to.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] Although this behaviour has changed in macOS 13 beta. See WWDC 2022 Session 10096 What’s new in privacy for the details (starting at 04:32).

Posted by
eskimo
Up vote reply of eskimo Down vote reply of eskimo
Add a Comment

Does it make any difference if the app will be published in the AppStore, but also need to be packaged for distribution outside of the store, for example for MDM systems that do not support AppStore macOS apps? Would the package signed with Mac Installer Distribution cert work? Or do we need to use the Mac Installer Distribution cert for store publishing, and Developer ID Installer cert for distribution outside of the store?

Posted by
siaremote
Up vote reply of siaremote Down vote reply of siaremote
Add a Comment