GPG.Sync.pkg can't be opened because it is from an unidentified developer about gpgsync

[micahflee]

Yes I totally codesigned, though perhaps it didn't work correctly, or I didn't sign everything. Lemme take a look.

[micahflee]

I figured out how to check this myself. When I build a .pkg on my own computer Gatekeeper doesn't prompt me. But if I upload the .pkg somewhere and download it then try running, I can reproduce:

However, pkgutil tells me that it is a signed package:

$ pkgutil --check-signature GPG.Sync.pkg 
Package "GPG.Sync.pkg":
   Status: signed by a developer certificate issued by Apple
   Certificate Chain:
    1. 3rd Party Mac Developer Installer: FIRST LOOK PRODUCTIONS, INC. (P24U45L8P5)
       SHA1 fingerprint: 73 84 BA F2 B8 8F 29 B5 15 F3 28 25 0D E2 50 C3 D5 F1 FA A7
       -----------------------------------------------------------------------------
    2. Apple Worldwide Developer Relations Certification Authority
       SHA1 fingerprint: FF 67 97 79 3A 3C D7 98 DC 5B 2A BE F5 6F 73 ED C9 F8 3A 64
       -----------------------------------------------------------------------------
    3. Apple Root CA
       SHA1 fingerprint: 61 1E 5B 66 2C 59 3A 08 FF 58 D1 4A E2 24 52 D1 98 DF 6C 60

After a bit of searching, I think I figured out that "3rd Party Mac Developer Installer" is actually the signing certificate for submitting apps to the App Store, and instead I need to use a "Developer ID" certificate. Working on figuring it out now.