产品签名的Mac应用程序没有安装在不是我的电脑上

Question

我有一个Mac应用程序，我使用终端上的“productsign”命令进行了签名。

productsign --sign "3rd Party Mac Developer Installer: My company (dasdfjkaj)" InstallerUnsigned.pkg InstallerSigned.pkg

productsign: signing product with identity "3rd Party Mac Developer Installer: My company (dasdfjkaj)" from keychain /Users/me/Library/Keychains/login.keychain
productsign: adding intermediate certificate "Apple Worldwide Developer Relations Certification Authority"
productsign: Wrote signed product archive to InstallerSigned.pkg

然后运行“评估”命令。

spctl -a -v --type install  InstallerSigned.pkg
InstallerSigned.pkg: accepted

我还检查了签名

pkgutil --check-signature InstallerSigned.pkg 
Package "InstallerSigned.pkg":
Status: signed by a developer certificate issued by Apple
   Certificate Chain:
    1. 3rd Party Mac Developer Installer: My company (dasdfjkaj)
    2. Apple Worldwide Developer Relations Certification Authority
    3. Apple Root CA

当我从我的机器上运行安装程序时(将网关管理员设置为“machine和标识开发人员”)，它就运行得很好。当我将相同的pkg部署到我的网站后，它也正确地安装了。

但是..。当我在另一台机器上下载pkg时，它无法安装。当我在故障机器上运行spctl命令时，我得到

spctl -a -v --type install  InstallerSigned.pkg
InstallerSigned.pkg: rejected

有人知道为什么它在我自己的机器上运行得很好，但是当pkg在另一台机器上运行时却失败了吗？我真的没有主意了

编辑:这就是我得到的

spctl --list --type execute
3[Apple System] P0 allow execute
    anchor apple
4[Mac App Store] P0 allow execute
    anchor apple generic and certificate leaf[field.<I removed this>] exists
5[Developer ID] P0 allow execute
    anchor apple generic and certificate 1[field.<I removed this>] exists and certificate leaf[field.<I removed this>] exists
7[GKE] P0 allow execute [(gke)]
    cdhash H"<I removed this>"
10[GKE] P0 allow execute [(gke)]
    cdhash H"<I removed this>"
14[GKE] P0 allow execute [(gke)]
    cdhash H"<I removed this>"
15[GKE] P0 allow execute [(gke)]
    cdhash H"<I removed this>"
18[GKE] P0 allow execute [(gke)]

Answer 1

证书问题

这些是您需要一起使用的证书，用于协同设计：

• 开发人员ID安装程序
• 开发人员ID应用程序

- **3rd Party Mac Developer Installer** (usually only used for the AppStore apps).

​

"Developer ID Installer“证书是如果不向AppStore提交的话将使用的证书。对于具体的协同设计部分，您需要使用"Developer ID Application“证书。

Apple Developer Codesigning Workflow Guide