<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">I would still like to hear from someone on the jpackage team about this issue...<br><div><br><blockquote type="cite"><div>On Jun 25, 2023, at 8:21 AM, Alan Snyder <javalists@cbfiddle.com> wrote:</div><br class="Apple-interchange-newline"><div><meta http-equiv="content-type" content="text/html; charset=utf-8"><div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">I’m having trouble using the code signing feature of jpackage for macOS.<div><br></div><div>The problem appears to be here:</div><div><br></div><div><div>result = MacBaseInstallerBundler.findKey(</div><div> "Developer ID Application: ", user, keychain);</div><div> }</div></div><div><br></div><div><div> boolean useAsIs = teamName.startsWith(keyPrefix)</div><div> || teamName.startsWith("Developer ID")</div><div> || teamName.startsWith("3rd Party Mac");</div><div><br></div><div> String key = (useAsIs) ? teamName : (keyPrefix + teamName);</div></div><div><br></div><div><br></div><div><br></div><div>My certificate has a different prefix “Apple Development: ” in the keychain.</div><div>I don’t think I made this up, so I don’t think I should try to change it.</div><div><br></div><div>Why is jpackage being so restrictive in its lookup of the signing key?</div><div>Why doesn’t it just pass the string to codesign, which has its own rules for interpreting signing identities (see below)?</div><div><br></div><div>I typically use the 10 character alphanumeric key that is part of the name when I use codesign directly.</div><div><br></div><div><p style="margin-top: 5px; margin-bottom: 5px; caret-color: rgb(77, 77, 77); color: rgb(77, 77, 77); font-family: Lato; font-size: 14px;">The identity is first considered as the <span class="italic" style="margin-top: 0px !important;">full name of a keychain identity preference</span>. If such a preference exists, it directly names the identity used. Otherwise, the identity is located by searching all keychains for a certificate <span class="italic" style="margin-bottom: 0px !important;">whose subject common name (only) contains the identity string given</span>. If there are multiple matches, the operation fails and no signing is performed; however, an exact match is preferred over a partial match. These comparisons are case sensitive. Multiple instances of the exactly same certificate in multiple keychains are tolerated as harmless.</p><p style="margin-top: 5px; caret-color: rgb(77, 77, 77); color: rgb(77, 77, 77); font-family: Lato; font-size: 14px; margin-bottom: 0px !important;">If identity consists of exactly forty hexadecimal digits, it is instead interpreted as the SHA-1 hash of the certificate part of the desired identity. In this case, the identity's subject name is not considered.</p></div></div></div></blockquote></div><br></body></html>