18

From looking at notes for the upcoming OSX version (the one after OSX Lion), it appears that all DMGs/installers need to be signed, even if not distributed via the Mac App store.

I couldn't find a command-line tool to do this signing though, or much documentation about obtaining a signing cert without submitting to the App Store.

Can someone shed light on: 1) How to obtain a certificate without distributing you app via the Mac App Store? 2) How to sign a DMG without using built-in XCode tools (preferable a cross-platform tool)?

Thanks!

psychotik
  • 38,153
  • 34
  • 100
  • 135
  • Most details of OS X 10.8 are still under NDA. –  Mar 16 '12 at 19:13
  • 4
    OK fine, treat this as a "how to sign a DMG for Snow Leopard". I also edited by question to not mention the "thing that's under NDA". I hope that eases your trigger-happiness to hit the close button instead of contributing something meaningful to the conversation. – psychotik Mar 16 '12 at 19:22
  • check the `xcrun` tool which does the most job for signing stuff (including provisioning profiles). – Eimantas Apr 13 '12 at 16:01
  • @Eimantas thanks, but what tool do I invoke with `xcrun`? (`xcrun` is just a command line tool to invoke other sdk tools (https://developer.apple.com/library/mac/#documentation/Darwin/Reference/ManPages/man1/xcrun.1.html) – psychotik Apr 13 '12 at 17:23
  • @psychotik there is tool called `codesign` which probably does what you want. – Eimantas Apr 13 '12 at 18:02

3 Answers3

4

Codesigning is described in detail here and here - basically you need to obtain a cert and then you can sign your application... AFAIK there is currently no official docs on signing the DMG itself. As for your second question (cross-platform signing) there no such tool available (at least none that is officially supported by Apple). As for information regarding future OS X version(s) I highly recommend asking on the proper Apple-Forums (usually there are also forums for NDA-related things).

Yahia
  • 69,653
  • 9
  • 115
  • 144
4

It's super easy:

CODESIGN_IDENTITY='Name of Code Sign Cert' # Found in Keychain Access

codesign -s "$CODESIGN_IDENTITY" -v path/to/YourApp.app

Then on the dmg:

codesign -s "$CODESIGN_IDENTITY" -v path/to/YourApp.dmg

This even works on read-only DMGs like UDZO.

2

Signing Disk Images (Source : Apple)

Disk images can be signed using the codesign tool on macOS 10.11.5 and later. This allows the entire disk image to be validated by Gatekeeper the first time it is mounted.

Gatekeeper will validate the contents of the disk image as well.

Disk images should only be signed with your Developer ID Application identity.

On macOS Sierra and later, spctl can be used to assess a disk image's signature, like this:

$ spctl -a -t open --context context:primary-signature -v MyImage.dmg /Users/me/Downloads/MyImage.dmg: accepted source=Developer ID

Note: A disk image signed on OS X 10.11.5 or 10.11.6 may not be able to be re-signed. In this situation, the operation will appear to succeed, but the signature will be invalid. If you encounter this condition, sign a new (unsigned) copy of the image on macOS Sierra or later.

Borongaj
  • 451
  • 4
  • 16