Hello,
we have a product package which is structured like this:
/ Installer.pkg
/ Distribution
/ Main Component.pkg
/ Scripts
/ preinstall
/ postinstall
/ helper [ Mach-O executable ]
/ Payload
/ Application Bundle.app
/ Another Component.pkg
...
The helper is our custom CLI helper tool which we build and sign and plan to use it in pre/post install scripts.
I'd like to ask if we need to independently notarize and staple the helper executable or just the top level pkg notarization is sufficient in this case?
We already independently notarize and staple the Application Bundle.app so it has ticket attached. But that's because of customers who often rip-open the package and pick only the bundle. We don't plan to have helper executable used outside of installation process.
Thank you,
o/
1
0
327