Signing a package is a multi-step process.

  1. Generate a signing request.
  2. Generate Developer ID Installer certificate.
  3. Sign the macOS PKG file.

Steps to Generate a Signing Request

For generating a certificate, first of all you require a Certificate Signing Request (CSR) file.

  1. Open “Keychain Access” program within your macOS device.
  2. Click on Keychain Access appearing on the top menu bar.
  3. Go to Certificate Assistant > Request a Certificate From a Certificate Authority.
  4. Add your email address in the User Email Address field, and name in the Common Name field. Leave the CA Email Address field blank.
  5. Under the Request is option, click Saved to Disc.
  6. Click Continue.
  7. Specify the location on the device where the .csr file is to be saved and click Save.

The signing request will be saved to your machine in the specified location. This file is required to generate the “Developer ID Installer” certificate.

Steps to Generate Developer ID Installer Certificate

To generate the certificate:

  1. Go to Apple Developer Portal. Click on Accounts.
  2. Either create a new account or sign in using an existing account.
  3. Click on Certificates > IDs > Profiles.
  4. Click on Certificates + and select Developer ID Installer.
  5. Upload the Certificate Signing Request which was downloaded in the above step.
  6. The Developer ID Installer certificate will be generated. Download the certificate and install it on your macOS device to sign the packages.

Steps to Build and Sign a macOS PKG file

To build and sign a macOS PKG file for a third-party app,

  1. Install the app on the device.
  2. Open “Terminal”.
  3. Build the .pkg file using the pkgbuild command.
pkgbuild --component /path_to_installed_app/macapp.app      --install-location /Applications   --sign "Developer ID Installer: *******"       /path_to_saved_package/packagename.pkg

Here, the quoted text refers to the name of your certificate. The two arguments specify the location of the already installed .app file (/path_to_installed_app/macapp.app) and the location of the newly generated .pkg file (/path_to_saved_package/packagename.pkg), respectively.

  1. Sign the .pkg file using the productbuild command.
productbuild --package /path_to_saved_package/packagename.pkg       --content /path_to_app/         --sign "Developer ID Installer: *******"       /path_to_signed_pkg/signed.pkg

Here, the quoted text refers to the name of the certificate. The two arguments specify the location of the newly generated .pkg file (/path_to_saved_package/packagename.pkg) and the location of the signed .pkg file (/path_to_signed_pkg/signed.pkg), respectively.

Steps to sign macOS PKG files

To sign a macOS PKG file,

  1. Open “Keychain Access” within the Mac and locate the certificate. The name of the certificate should be of the format: Developer ID Installer: Apple account name (serial number).
  2. Open “Terminal”. The command to sign the package should look something like this:
productsign -sign “Developer ID Installer: Your Apple Account Name (**********)” ~/Desktop/example.pkg ~/Desktop/signed-example.pkg

Here, the quoted text following the –sign tag refers to the name of your certificate. The two arguments, following the name of the certificate, refer to the current location of the unsigned package (/Desktop/example.pkg) and the location of the signed package (/Desktop/signed-example.pkg), respectively.

The signed certificate gets stored in the destination path specified in the command. Now you can upload it to the app inventory.

References

  1. https://www.hexnode.com/mobile-device-management/help/how-to-sign-macos-pkg-files-for-deployment-with-hexnode-mdm/