Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

User profile for user: stevefromcupertino
stevefromcupertino Author
User level: Level 1
8 points

spctl says rejected for signed flat package

I have a flat package, signed by a Apple supplied Developer Id, and spctl rejects it


The TOC in the xar file is proper looking and has a valid XML signature in it (best I can tell). Certificate chain is elided here, but matches the output from pkgutil.


xar --dump-toc=- -f foo.pkg


<?xml version="1.0" encoding="UTF-8"?>

<xar>

<toc>

<checksum style="sha1">

<size>20</size>

<offset>0</offset>

</checksum>

<creation-time>2013-10-29T18:23:23</creation-time>

<signature style="RSA">

<offset>20</offset>

<size>256</size>

<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">

<X509Data>

<X509Certificate>...</X509Certificate>

</X509Data>

</KeyInfo>

</signature>

<x-signature style="CMS">

<offset>276</offset>

<size>6144</size>

<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">

<X509Data>

<X509Certificate>...</X509Certificate>

</X509Data>

</KeyInfo>

</x-signature>

<file id="1">

<name>Bom</name>

<type>file</type>

<inode>39991802</inode>

<deviceno>16777218</deviceno>

<mode>0644</mode>

<uid>0</uid>

<user>root</user>

<gid>0</gid>

<group>wheel</group>

<atime>2013-10-29T18:01:47Z</atime>

<mtime>2013-10-29T18:01:47Z</mtime>

<ctime>2013-10-29T18:01:48Z</ctime>

<FinderCreateTime>

<time>1970-01-01T00:00:00</time>

<nanoseconds>0</nanoseconds>

</FinderCreateTime>

<data>

<extracted-checksum style="sha1">afb0b9dc0fe87477290b8551c1cf038c6bf7d3eb</extracted-checksum>

<archived-checksum style="sha1">2aa56353d6d0e2c4eed9bc45f2541b19b17532e3</archived-checksum>

<encoding style="application/x-gzip"/>

<size>37717</size>

<offset>6420</offset>

<length>1907</length>

</data>

</file>

<file id="2">

<name>PackageInfo</name>

<type>file</type>

<inode>39991816</inode>

<deviceno>16777218</deviceno>

<mode>0644</mode>

<uid>0</uid>

<user>root</user>

<gid>0</gid>

<group>wheel</group>

<atime>2013-10-29T18:01:48Z</atime>

<mtime>2013-10-29T18:01:48Z</mtime>

<ctime>2013-10-29T18:01:48Z</ctime>

<FinderCreateTime>

<time>1970-01-01T00:00:00</time>

<nanoseconds>0</nanoseconds>

</FinderCreateTime>

<ea id="0">

<name>com.apple.TextEncoding</name>

<extracted-checksum style="sha1">34bb265cb6732969f269ccc90fea5d662e9e0ea5</extracted-checksum>

<archived-checksum style="sha1">d433dacc26ca2c81f30c25e807dc170e6680aad9</archived-checksum>

<encoding style="application/x-gzip"/>

<size>15</size>

<offset>8625</offset>

<length>23</length>

</ea>

<data>

<extracted-checksum style="sha1">8ddffdeaf0c9d56f1ac7a545f9065b8c0a0c253b</extracted-checksum>

<archived-checksum style="sha1">a0e202b915ac2b741e8b4eb4b6c34ad2025e576e</archived-checksum>

<encoding style="application/x-gzip"/>

<size>549</size>

<offset>8327</offset>

<length>298</length>

</data>

</file>

<file id="3">

<name>Payload</name>

<type>file</type>

<inode>39991803</inode>

<deviceno>16777218</deviceno>

<mode>0644</mode>

<uid>0</uid>

<user>root</user>

<gid>0</gid>

<group>wheel</group>

<atime>2013-10-29T18:01:47Z</atime>

<mtime>2013-10-29T18:01:48Z</mtime>

<ctime>2013-10-29T18:01:48Z</ctime>

<FinderCreateTime>

<time>1970-01-01T00:00:00</time>

<nanoseconds>0</nanoseconds>

</FinderCreateTime>

<data>

<extracted-checksum style="sha1">8c82d6335d52c388475c710b3da67dfc037aeb57</extracted-checksum>

<archived-checksum style="sha1">8c82d6335d52c388475c710b3da67dfc037aeb57</archived-checksum>

<size>6074987</size>

<offset>8648</offset>

<encoding style="application/octet-stream"/>

<length>6074987</length>

</data>

</file>

<file id="4">

<name>Scripts</name>

<type>file</type>

<inode>39991814</inode>

<deviceno>16777218</deviceno>

<mode>0644</mode>

<uid>0</uid>

<user>root</user>

<gid>0</gid>

<group>wheel</group>

<atime>2013-10-29T18:01:48Z</atime>

<mtime>2013-10-29T18:01:48Z</mtime>

<ctime>2013-10-29T18:01:48Z</ctime>

<FinderCreateTime>

<time>1970-01-01T00:00:00</time>

<nanoseconds>0</nanoseconds>

</FinderCreateTime>

<data>

<extracted-checksum style="sha1">b2e862d97d79b2a78433f07b29685e0293e0239b</extracted-checksum>

<archived-checksum style="sha1">b2e862d97d79b2a78433f07b29685e0293e0239b</archived-checksum>

<size>180</size>

<offset>6083635</offset>

<encoding style="application/octet-stream"/>

<length>180</length>

</data>

</file>

</toc>

</xar>


Looking at the contents, very simple flat package:


$ xar -t -f foo.pkg

Bom

PackageInfo

Payload

Scripts


And lastly, pkgutil is happy, spctl (and the Installer of course) are not:


$ sudo spctl --assess --type install -v foo.pkg

foo.pkg: rejected


$ /usr/sbin/pkgutil --check-signature foo.pkg

Package "foo.pkg":

Status: signed by a developer certificate issued by Apple

Certificate Chain:

1. 3rd Party Mac Developer Installer: TiVo, Inc (4BLW75E6S3)

SHA1 fingerprint: 1C 22 36 8E 43 E6 6D 42 CE 9F 63 B2 74 C7 23 C6 16 CF AC 10

-----------------------------------------------------------------------------

2. Apple Worldwide Developer Relations Certification Authority

SHA1 fingerprint: 09 50 B6 CD 3D 2F 37 EA 24 6A 1A AA 20 DF AA DB D6 FE 1F 75

-----------------------------------------------------------------------------

3. Apple Root CA

SHA1 fingerprint: 61 1E 5B 66 2C 59 3A 08 FF 58 D1 4A E2 24 52 D1 98 DF 6C 60


Nothing inside the package is signed.


Any ideas where I look next?

OS X Mountain Lion (10.8.5)

Posted on Oct 29, 2013 12:00 PM

Reply
5 replies
User profile for user: gatpy
gatpy
User level: Level 1
0 points

Feb 18, 2014 6:46 AM in response to stevefromcupertino

Hello, I have the same problem: I build, sign executables and installer with both Application and Installer certificates delivered by Apple, but my install is still rejected by Gatekeeper on other computers. I was first building and signing on Snow Leopard with Xcode 4.2, then updated to Mavericks with Xcode 4.6.3 and still have this problem.


This guy seems to have the same problem too: http://www.copyquery.com/productsigned-mac-app-not-installing-in-computers-that- are-not-mine/


Do you have any solution?

Reply
User profile for user: BananaSlug
BananaSlug
User level: Level 1
0 points

Feb 21, 2014 8:33 AM in response to gatpy

I'm also having this problem. I signed a flat .pkg using my 3rd Party Mac Developer Installer certificate and the payload app with 3rd Party Mac Developer Application certificates apparently with success as confirmed by

pkgutil --check-signature test (similar to output displayed by Gatby's comment, above)


Moreover, when I attempt to install my payload on my computer after logging into to another user account for testing it works with no warnings from Gatekeeper. Nevertheless assessing the package installer using:


"spctl --assess --verbose=4"


returns this message:


"Install Packages Test.pkg: rejected source=no usable signature"


I am hoping there is something wrong with the spctl assessment. Can anyone confirm this?

Reply
User profile for user: gatpy
gatpy
User level: Level 1
0 points

Feb 21, 2014 8:59 AM in response to BananaSlug

I finally found what was the problem: I'm still testing my app, so it's not on the AppStore yet. Therefore the "3rd Party XXX certificates" don't work because they are production/distribution certificates, not development. I had to get the "Developer ID XXX certificates" instead. However I couldn't manage to get them from the developer.apple.com portal, they're (currently? maybe a bug...) not listed. The only way to get them is to use Xcode 5, go to Preferences > Accounts.


There is a confusion about Mac certificates, dixit here: http://lists.apple.com/archives/xcode-users/2012/Oct/msg00286.html


It's well documented: https://developer.apple.com/library/mac/documentation/IDEs/Conceptual/AppDistrib utionGuide/DistributingApplicationsOutside/DistributingApplicationsOutside.html


I admit it is, BUT it's overcomplicated and confusing: Why "Developer ID", what does that mean? Why is there a "Mac Developer" certificate generated with the "Developer ID" ones but doesn't seem to be used for anything? Why can't we get these "Developer ID" certificates from the web portal?


Well nevermind, I hope this will help you.

Reply
User profile for user: BananaSlug
BananaSlug
User level: Level 1
0 points

Feb 21, 2014 10:14 AM in response to gatpy

Thanks gatby for quick feedback, although I am more confused then ever. If I understand correctly, my "third-party" certificates are only for production/testing purposes (whatever that means) and will not provide the Gatekeeper security clearance for apps—both those intended to be distributed through the App Store and those to be distributed outside the store (which is my scenario). Therefore I cannot use the command line to get Gatekeeper clearance on my application nor its delivery package until I attain those specific certificates ("Developer ID Installer", and "Developer ID Application"). Apparently Xcode 5 has access to these since it did sign my application archive successfully. Nevertheless, I may wish to use the command line to code sign my apps in the future, moreover, it's imperative that I attain the "Developer ID Installer" certificate and install it in my keychain so I can secure my delivery package.


You helpfully state that there is no way to download those certificates from the Mac Developer portal, so that I have to access them from the X code 5 developer application. I can see when I go into my account and select 'view details' button, the five desired certificates listed. By selecting one of these (you can only select one) I can export, say the "Developer ID Installer" certificate to my desktop and then try to import this to my keychain. Unfortunately, I find that this fails without an error panel. Moreover, when I try to open certificate file from my desktop, it prompts me for my developer password and thereafter simply fails to open—as if exporting the certificate from X code creates a bogus certificate file. Perhaps you can help me on how to get those certificates into my keychain? I can't tell you how angry I am at Apple for their apparent neglect of clear process when it comes to distribution outside the App Store context (for which I have no choice).

Reply
User profile for user: BananaSlug
BananaSlug
User level: Level 1
0 points

Feb 21, 2014 3:27 PM in response to BananaSlug

OK. I was able to download the correct certificates from the Mac Development portal unlike gatby. Although I still was confused in how to import these into keychain. It turns out I probably already have them in there (although it's impossible to know by the outword appearance of the downloaded certificate files on my desktop). That's most likely why nothing showed or transpired when I tried to import them. There's nothing worse than trying to look for something you already got, but don't know it's there. Arghhh!

Reply

spctl says rejected for signed flat package

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.
Learn more Sign up