{"action":"created","issue":{"url":"https://api.github.com/repos/sethlu/electron-osx-sign/issues/5","repository_url":"https://api.github.com/repos/sethlu/electron-osx-sign","labels_url":"https://api.github.com/repos/sethlu/electron-osx-sign/issues/5/labels{/name}","comments_url":"https://api.github.com/repos/sethlu/electron-osx-sign/issues/5/comments","events_url":"https://api.github.com/repos/sethlu/electron-osx-sign/issues/5/events","html_url":"https://github.com/sethlu/electron-osx-sign/issues/5","id":132744393,"number":5,"title":"Feature request - create and sign package file","user":{"login":"jasonhinkle","id":313176,"avatar_url":"https://avatars.githubusercontent.com/u/313176?v=3","gravatar_id":"","url":"https://api.github.com/users/jasonhinkle","html_url":"https://github.com/jasonhinkle","followers_url":"https://api.github.com/users/jasonhinkle/followers","following_url":"https://api.github.com/users/jasonhinkle/following{/other_user}","gists_url":"https://api.github.com/users/jasonhinkle/gists{/gist_id}","starred_url":"https://api.github.com/users/jasonhinkle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jasonhinkle/subscriptions","organizations_url":"https://api.github.com/users/jasonhinkle/orgs","repos_url":"https://api.github.com/users/jasonhinkle/repos","events_url":"https://api.github.com/users/jasonhinkle/events{/privacy}","received_events_url":"https://api.github.com/users/jasonhinkle/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/sethlu/electron-osx-sign/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2016-02-10T16:16:07Z","updated_at":"2016-02-12T21:59:35Z","closed_at":null,"body":"In my build script, after signing the .app I create a .pkg file and sign that. Because Application Loader requires the app to be packaged up for submission. You must have this file in order to submit the app to the app store.\r\n\r\nEven though it is more than technically signing - it seems like it would be appropriate to include in electron-osx-sign because it is the final step for MAS preparation (and there is more signing involved).\r\n\r\nHere is the code in my script that does this:\r\n```\r\nAPP_PATH=\"MyApp.app\"\r\nRESULT_PATH=\"MyApp.pkg\"\r\nAPP_KEY=\"3rd Party Mac Developer Application: Company, Inc (C123K93QGT)\"\r\nINSTALLER_KEY=\"3rd Party Mac Developer Installer: Company, Inc (C123K93QGT)\"\r\n\r\n# build the pkg installer file which application loader expects\r\nproductbuild --component \"$APP_PATH\" /Applications --sign \"$INSTALLER_KEY\" \"$RESULT_PATH\"\r\n\r\n# sign the package file (seems redundant, but otherwise binary is rejected by itunesconnect)\r\ncodesign -fs \"$APP_KEY\" \"$RESULT_PATH\"\r\n```"},"comment":{"url":"https://api.github.com/repos/sethlu/electron-osx-sign/issues/comments/183503699","html_url":"https://github.com/sethlu/electron-osx-sign/issues/5#issuecomment-183503699","issue_url":"https://api.github.com/repos/sethlu/electron-osx-sign/issues/5","id":183503699,"user":{"login":"jasonhinkle","id":313176,"avatar_url":"https://avatars.githubusercontent.com/u/313176?v=3","gravatar_id":"","url":"https://api.github.com/users/jasonhinkle","html_url":"https://github.com/jasonhinkle","followers_url":"https://api.github.com/users/jasonhinkle/followers","following_url":"https://api.github.com/users/jasonhinkle/following{/other_user}","gists_url":"https://api.github.com/users/jasonhinkle/gists{/gist_id}","starred_url":"https://api.github.com/users/jasonhinkle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jasonhinkle/subscriptions","organizations_url":"https://api.github.com/users/jasonhinkle/orgs","repos_url":"https://api.github.com/users/jasonhinkle/repos","events_url":"https://api.github.com/users/jasonhinkle/events{/privacy}","received_events_url":"https://api.github.com/users/jasonhinkle/received_events","type":"User","site_admin":false},"created_at":"2016-02-12T21:59:35Z","updated_at":"2016-02-12T21:59:35Z","body":"Ok so I went through the entire process and everything worked with producing a .pkg file, however the final signing of the pkg didn't occcur.  I don't really understand why this is necessary because `productbuild` does have the --sign argument.  However in my experience if the .pkg is then not signed again afterwards (with the developer key - not the installer key), it gets rejected once it is uploaded to itunesconnect.  The error in itunesconnect will say \"code object is not signed at all\".\r\n\r\nFor my own app, as a final step I run this and my package has passed validation in itunesconnect:\r\n```\r\ncodesign -fs \"3rd Party Mac Developer Application: MyCompany, Inc (C296K93QYG)\" \"My App-mas-x64/My App.pkg\"\r\n```\r\n\r\nHere's my command line output:\r\n\r\n```\r\nJasons-MBP:Tube-DL jason$ electron-osx-flat \"My App-mas-x64/My App.app\" --verbose\r\nNo `--pkg` passed in arguments, will fallback to default, inferred from the given application.\r\nNo `--install` passed in arguments, will fallback to default `/Applications`.\r\nNo `--identity` passed in arguments, matching identities...\r\nNo `--platform` passed in arguments, cheking Electron platform...\r\nFlattening application...\r\n> application        My App-mas-x64/My App.app\r\n> package-output     My App-mas-x64/My App.pkg\r\n> install-path       /Applications\r\n> identity           3rd Party Mac Developer Installer: MyCompany, Inc (B796K93QHT)\r\nFlattening with productbuild...\r\nApplication flattened: My App-mas-x64/My App.pkg\r\nJasons-MBP:Tube-DL jason$ \r\n```\r\n\r\nThen verifying the pkg is signed, though:\r\n\r\n```\r\nJasons-MBP:My App-mas-x64 jason$ codesign -dvvv My\\ App.pkg\r\nMy App.pkg: code object is not signed at all\r\n```"}}