# How to sign macOS PKG files for deployment Signing a PKG file is essential for security purposes. It ensures that the app is safe and trustable for use, and is free from malware. A signed PKG app file can be remotely deployed to the enterprise-ready macOS devices through the Hexnode UEM console. To sign macOS packages, you will require access to an Apple Developer account using which the certificates can be signed. Two basic requirements that should be met to deploy macOS PKGs are: 1. The .pkg file is built as a product archive. 2. To distribute the **macOS PKG** as an enterprise app. The .pkg file should be **signed** with a Developer ID obtained from an Apple Developer Enterprise account. For all other apps to be distributed via the Mac App Store, the .pkg file is signed using the “Developer ID Installer” certificate, obtained from an Apple Developer account. Note: Apps are not natively available in .pkg file type. You have to repackage these installation files from their native format for package deployment into PKG files. Apps packaged in DMG/APP file formats can be easily converted to PKG format. - [Convert dmg files into PKG files.](https://www.hexnode.com/mobile-device-management/help/convert-dmg-to-pkg-mac/) - [Convert app files into PKG files.](https://www.hexnode.com/mobile-device-management/help/convert-app-to-pkg/) Signing a package is a multi-step process. 1. Generate a signing request. 2. Generate Developer ID Installer certificate. 3. Sign the macOS PKG file. Steps to generate a signing request ----------------------------------- To generate a certificate, first you require a Certificate Signing Request (CSR) file. 1. Open the “Keychain Access” program within your macOS device. 2. Click on **Keychain Access** appearing on the top menu bar. 3. Go to **Certificate Assistant** > **Request a Certificate From a Certificate Authority.** 4. Add your email address in the **User Email Address** field and name in the **Common Name** field. Leave the **CA Email Address** field blank. 5. Under the **Request is** option, click **Saved to Disc**. 6. Click **Continue**. 7. Specify the location on the device where the .csr file is to be saved and click **Save**. The signing request will be saved to your machine in the specified location. This file is required to generate the “Developer ID Installer” certificate. Steps to generate Developer ID Installer certificate ----------------------------------------------------- To generate the Developer ID certificate: 1. Go to the [Apple Developer Portal](https://developer.apple.com/). Click on **Accounts**. 2. Either create a new account or sign in using an existing one. 3. Click on **Certificates** > **IDs** > **Profiles**. 4. Click on **Certificates +** and select **Developer ID Installer**. 5. Upload the Certificate Signing Request, which was downloaded in the step mentioned above. 6. The Developer ID Installer certificate will be generated. Download the certificate and install it on your macOS device to sign the packages. Steps to build and sign a macOS PKG file ----------------------------------------- To build and sign a macOS PKG file for a third-party app, 1. Install the app on the device. 2. Open **Terminal**. 3. Build the .pkg file using the pkgbuild command. sudo pkgbuild --component /path\_to\_installed\_app/macapp.app --install-location /Applications --sign "Developer ID Installer: \*\*\*\*\*\*\*" /path\_to\_saved\_package/packagename.pkg 1 sudo pkgbuild --component /path\_to\_installed\_app/macapp.app --install-location /Applications --sign "Developer ID Installer: \*\*\*\*\*\*\*" /path\_to\_saved\_package/packagename.pkg Here, the quoted text refers to the name of your certificate. The two arguments specify the location of the already installed .app file (/path\_to\_installed\_app/macapp.app) and the location of the newly generated .pkg file (/path\_to\_saved\_package/packagename.pkg), respectively. 4. Sign the .pkg file using the productbuild command. sudo productbuild --package /path\_to\_saved\_package/packagename.pkg --content /path\_to\_app/ --sign "Developer ID Installer: \*\*\*\*\*\*\*" /path\_to\_signed\_pkg/signed.pkg 1 sudo productbuild --package /path\_to\_saved\_package/packagename.pkg --content /path\_to\_app/ --sign "Developer ID Installer: \*\*\*\*\*\*\*" /path\_to\_signed\_pkg/signed.pkg Here, the quoted text refers to the name of the certificate. The two arguments specify the location of the newly generated .pkg file (/path\_to\_saved\_package/packagename.pkg) and the location of the signed .pkg file (/path\_to\_signed\_pkg/signed.pkg), respectively. Steps to sign macOS PKG files ----------------------------- To sign a macOS PKG file: 1. Open “Keychain Access” within the macOS device and locate the certificate. The name of the certificate should be of the format: Developer ID Installer: Apple account name (serial number). 2. Open “Terminal”. The command to sign the package would look something like this: productsign --sign “Developer ID Installer: Your Apple Account Name (\*\*\*\*\*\*\*\*\*\*)” ~/Desktop/example.pkg ~/Desktop/signed-example.pkg 1 productsign --sign “Developer ID Installer: Your Apple Account Name (\*\*\*\*\*\*\*\*\*\*)” ~/Desktop/example.pkg ~/Desktop/signed-example.pkg Here, the quoted text following the –sign tag refers to the name of your certificate. The two arguments, following the name of the certificate, refer to the current location of the unsigned package (/Desktop/example.pkg) and the location of the signed package (/Desktop/signed-example.pkg), respectively. The signed certificate gets stored in the destination path specified in the command. Now you can upload it to the app inventory. Check the signature ------------------- Verify the signature of the PKG file. Execute the command below to display the signature details like the timestamp of signing, and the Certificate Chain. Script to check PKG file signing pkgutil --check-signature 1 pkgutil --check-signature Replace `` with the name of the PKG file along with the path of the PKG file. Check file contents -------------------- You can check the contents of the PKG file using the command provided below. Script to check file contents pkgutil --expand 1 pkgutil --expand Replace `` with the name of the PKG file along with the path and `` with the path to a new folder. The command will create a new folder (with the provided name) where the PKG file contents will be listed. Expand and check the contents to determine if the PKG file contains the root file and the distribution root file for successful package validation. Exception: Hexnode supports only signed distribution packages for package deployment. The pkg file should contain both the package info root file and the distribution root file during package validation. Uploading a signed flat package without these files causes the package validation to fail, and hence the app upload will be unsuccessful.