Sign flat package with non-Apple certificate I have a program that I ported from the Windows environment to macOS. I would like to sign the flat installer .pkg with the same certificate I used on Windows, which is valid and granted by DigiCert.

I created a keychain in Keychain Access, imported the certificate and saved it locally as company.keychain. I looked in the informations and saw that the Common Name of the Subject is, say, 'Company &amp; Co'. When I try to sign with:

productsign --sign "Company &amp; Co" --keychain company.keychain --timestamp=none unsigned.pkg signed.pkg


The following error occurs:

productsign: error: Could not find appropriate signing identity for "Company &amp; Co" in keychain at company.keychain.
An installer signing identity (not an application signing identity) is required for signing flat-style products.


I looked it up and, even if the productsign man page does not suggest it, it seems that in order to sign a flat package the certificate should be an Apple Developer ID Installer: Company name certificate issued by Apple itself. Since every post about the subject on StackExchange is pretty old I ask it again: is it so? If not, how do I understand if the certificate I have available can sign the flat package?

Notes:


If I open the keychain, the "Company &amp; Co" entry has the extension triangle which shows the relevant private key, so it is actually a "complete" certificate.
I do not need to distribute the app on the Apple App Store, my goal is just to prevent Gatekeeper from complaining about the app not being trusted.
The package was created with packagebuild and productbuild.
If I manage to sign the package, do I also need to sign the application and the dynamic libraries shipped within?


Thank you for your attention.
Yes, it is so. The certificate must be a Developer ID Installer certificate from Apple. You cannot use the same code signing certificate you have been using for your Windows application previously.

You can read the instructions on how to properly sign flat installer packages here:

https://developer.apple.com/library/content/documentation/IDEs/Conceptual/AppDistributionGuide/DistributingApplicationsOutside/DistributingApplicationsOutside.html