productsign fails with valid certificate with private key

Hello all, I am having really weird trouble with productsign process using Developer ID Installer certificate.

I started cooperation with another company and got both Developer ID Application and Developer ID Installer certificates (including private keys) from them and I am also a part of their apple developer team. Now, I am able to use the first one to codesign binaries, but when trying to sign pkg using the second one, I always get this response:

productsign: error: Could not find appropriate signing identity for “Developer ID Installer: The company (XXYYZZ..)“

I've already tried to sign the pkg with certificate of another company and this one works as expected. I've also tried the process on another macOS, the same result. The company is using this certificate on their mac machine without problems.

I am calling productsign phase using standard shell script:

sudo productsign --sign "Developer ID Installer: The company (XXYYZZ..)" "test.pkg" "signedTest.pkg"

We've already tried to use newly generated certificate based on my certificate request, still the same. Also tried using only the team ID code instead of the whole name as advised on some forums, still the same.

Do you have any idea or hint how to fix this? I've already lost more than a day with thing that should work without a trouble. Tested on macOS 12.7.1 and Catalina.

Vladimír

Hello, I have finally found the solution with a little help from my friend. It was all caused by calling it with sudo. Removing sudo from productsign call, it started working.

I have absolutely no idea why this worked correctly for one certificate and not for the second one with the sudo.

It was all caused by calling it with sudo.

Yeah, don’t do that. I mentioned this in passing in Resolving errSecInternalComponent errors during code signing but I really should add it to my main code signing posts [1]. I’ve made a note to do that at some point.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] Namely:

productsign fails with valid certificate with private key
 
 
Q