如何使用包含较小签名pkg文件的mpkg的productsign？

Question

我有一个父安装程序包,比如说,Parent.unsigned.mpkg我想用OS X签名productsign.

该文件Parent.unsigned.mpkg包含名为的子包A.pkg,B.pkg并且C.pkg反过来安装Clang编译的命令行二进制文件和bash包装脚本:

./Parent.unsigned.mpkg/Contents/Packages/A.pkg
./Parent.unsigned.mpkg/Contents/Packages/B.pkg
./Parent.unsigned.mpkg/Contents/Packages/C.pkg

我注册了一个Mac Developer帐户,该帐户设置(以及其他证书)具有ID的开发者ID安装程序证书ABCD1234(此ID实际上与我的Apple ID不同并且是特定的.)我使用该security工具获取此ID值:

$ security find-certificate -a -c "Developer ID Installer" | grep "alis"
    "alis"<blob>="Developer ID Installer: Foo B. Baz (ABCD1234)"

我使用此ID值为这些子包中的每个包签名,这似乎没有发生任何事故:

$ productsign --timestamp --sign ABCD1234 ./Parent.unsigned.mpkg/Contents/Packages/A.pkg ./Parent.unsigned.mpkg/Contents/Packages/A.signed.pkg
...
$ productsign --timestamp --sign ABCD1234 ./Parent.unsigned.mpkg/Contents/Packages/B.pkg ./Parent.unsigned.mpkg/Contents/Packages/B.signed.pkg
...
$ productsign --timestamp --sign ABCD1234 ./Parent.unsigned.mpkg/Contents/Packages/C.pkg ./Parent.unsigned.mpkg/Contents/Packages/C.signed.pkg
...

然后我将这些签名的子包移回原始文件名:

$ mv ./Parent.unsigned.mpkg/Contents/Packages/A.signed.pkg ./Parent.unsigned.mpkg/Contents/Packages/A.pkg
$ mv ./Parent.unsigned.mpkg/Contents/Packages/B.signed.pkg ./Parent.unsigned.mpkg/Contents/Packages/B.pkg
$ mv ./Parent.unsigned.mpkg/Contents/Packages/C.signed.pkg ./Parent.unsigned.mpkg/Contents/Packages/C.pkg

当我尝试productsign父包时,我收到以下警告消息:

$ productsign --timestamp --sign ABCD1234 ./Parent.unsigned.mpkg ./Parent.signed.mpkg
productsign: preparing "Parent.unsigned.mpkg" for signing ...
productsign: Using timestamp authority for signature
productsign: warning: component package "A.pkg" not found inside "Parent.unsigned.mpkg" and must be signed explicitly
productsign: warning: component package "B.pkg" not found inside "Parent.unsigned.mpkg" and must be signed explicitly
productsign: warning: component package "C.pkg" not found inside "Parent.unsigned.mpkg" and must be signed explicitly
productsign: Wrote signed product archive to ./Parent.signed.mpkg

当我尝试验证安装程序是否已签名时,我收到拒绝消息:

$ spctl -a -v --type install ./Parent.signed.mpkg 
./Parent.signed.mpkg: rejected

我正在使用此处和此处概述的Apple方向.

未签名的安装程序可以正常工作,但它需要绕过OS X Gatekeeper.因此,安装程序包和内容似乎是正确的(或至少正常工作).

我缺少哪些步骤或程序生成一个与OS X Gatekeeper一起使用的数字签名安装程序？

Answer 1

我曾经Packages.app创建过包项目.

在内部Packages.app,我将项目类型从更改Bundle为Flat并重建了安装程序存档.

然后我productsign按照上面的描述通过命令行继续执行这些步骤,除了我只需要签署父pkg文件以生成一个有效的签名安装程序(我没有签署子程序包).

使用pkgutil --flatten尝试mpkg在命令行上展平捆绑输出最终破坏了安装程序 - 我不得不将项目类型从内部更改Bundle为Flat内部Packages.app并重建该应用程序中的安装程序,并在外部签署平面安装程序文件Packages.app.