Signing and Archiving mac app with productbuild without using xcode for distributing app out side of Mac App Store

Question

I am new to MAC App development and working on project which uses Zoom Mac SDK but that SDK doesn't support archive with Xcode so I need to make archive with other tools suggested by zoom support center. As per their reply app can be archived with pkgbuild/pkgutil/productbuild but I don't know the exact steps to create archive/pkg/dmg file for my Mac App.

Also please let me know which file extension I need to create for downloading my app from website for users.

I am using "Developer ID Application" and "Developer ID Installer" certificates for sign my build but don't know how to create build without using Xcode because with Xcode I am getting error for third party framework as "code object is not signed at all".

Appreciated your great help.

Answer 1

First, you need pkgbuild AND productbuild, to do something productive.

Here you specify a root folder, identifier, version, install-location, signage, and post-install scripts.

For example:

pkgbuild --root "${ROOTFOLDER}" \
--identifier "${IDENTIFIER}" \
--version ${VERSION} \
--install-location "/" \
--sign "${IDENTITY}" \
--scripts '${SCRIPT}' \
"${PKGNAME}.pkg"

In your ${ROOTFOLDER}, you can control files/folders like it would be on your local machine after "/". For example, if you want to put "xy.app" into /Applications, you would create inside your ${ROOTFOLDER} a "Applications" folder and put xy.app into that. When you install the package, inside your "/Applications" folder on your machine, there will be xy.app. You can also copy files to /Library or whatever, just by creating the folder inside your specified rootfolder.

When you want any .pkg / .dmg or .sdk's installed, you would create a scripts folder that you specify under --scripts ${SCRIPTSFOLDER}, and inside there you create a "postinstall" file.

The postinstall file will contain stuff that will be execute with your package, for example installing another .pkg or .sdk, that will be inside your ${ROOTFOLDER}.

So put multiple .pkg' files into ${ROOTFOLDER}/Packages for example. On your root folder, the /Packages folder will be created. Means, in your postinstall you can say:

sudo installer -pkg /Packages/anotherPackageOrApp.pkg target /

After you've done that, you got a simple package. However, you don't really want only that.

With productbuild, you can create a distribution file: it includes all the configuration of the product archive, including a product license, product README file, the list of component packages, constraints (such as minimum OS version).

Go ahead and do the following:

productbuild --synthesize --package "${PKGNAME}.pkg" distribution.dist

Now that you got your distribution.dist out of your package, you can edit it however you want. Build it back together:

productbuild --distribution distribution.dist --scripts "${SCRIPTS}" --sign "${IDENTITY}" --package-path "${PKGNAME}.pkg" --resources . --version ${VERSION} "${PKGNAME}_New.pkg"

Now you got your final signed Package. Containing the locations for your .sdk's, .pkg's and .dmg's that can be installed via the postinstall file, or just copied to a directory on the machine that the pkg will be installed on.

Greets