Pkg Signing Check support
Pkg Signing Check is a Mac app that finds installer packages (.pkg) signed through Apple's original
Developer ID Certification Authority. That authority expires on 1 February 2027 at 22:12:15 UTC
(2 February 09:12 in Sydney, 1 February 14:12 in San Francisco), and Apple has said that
Starting February 1, 2027, .pkg files signed with an affected certificate will no longer install.
Contact
Email apps@evanhunter.xyz. Please include the app version (Pkg Signing Check > About Pkg Signing Check)
and, if you can, the exported CSV row for the package in question. If a verdict looks wrong, also include the output of
pkgutil --check-signature for that package.
Seller: Evan Hunter (sole trader), Australia.
What the app does
- Checks many packages in one pass: drop folders and .pkg files onto the window. A Munki repository is recognised by its
pkgsinfofolder; a Jamf package list (CSV) can be dropped together with its distribution point folder. - Checks packages on web servers from a pasted list of download addresses, reading only the first part of each file (about 64 KB) instead of downloading it.
- Looks inside packages for other packages (in the archive, and in its Scripts and Payload archives), because a G2-signed wrapper can still carry an old-CA package that the installer runs.
- Shows each package's full certificate chain, signer, Team ID and timestamp, and exports a CSV, a Markdown report and a one-page PDF summary.
- Optionally marks your own Team IDs, so the report separates packages you must re-sign from packages a vendor must replace.
Requirements
macOS 14 Sonoma or later. No account is needed.
What “affected” means
A package is affected when its signature chain runs through the original Developer ID Certification Authority
(certificate SHA-256 beginning 7AFC9D01, expiring 1 February 2027), or when its signing certificate was issued by that authority.
Packages signed through Developer ID Certification Authority G2 (SHA-256 beginning F16CD3C5, OU=G2, expiring 2031) are not affected.
For packages, Apple's notice makes no exception for a secure timestamp, so the verdict does not depend on one.
Apps that are already installed keep working; it is installing the package that fails, whether through Installer, Jamf, Munki, Intune or another MDM.
The explainer page has the evidence for each install path.
| Verdict | Meaning | What to do |
|---|---|---|
| Old CA | The chain includes the original Developer ID CA, or the signing certificate was issued by it. | It stops installing at the cutoff. If you build it, re-sign it with a G2 Developer ID Installer certificate and notarize it. If a vendor builds it, ask the vendor for a G2-signed build. Help > Re-sign Checklist has the steps. |
| G2 | The chain goes through Developer ID CA G2. | Nothing. |
| Unsigned | The package has no signature. | Not affected by this cutoff. PreStage enrollment, MDM InstallEnterpriseApplication and Intune line-of-business apps need a signed package anyway. |
| Not Developer ID | Signed by Apple, the Mac App Store or an in-house certificate authority. | Not affected by this cutoff. |
| Not audited | The file is missing or unreadable, it is inside a disk image, it is a bundle-style package, or the chain is an unknown Developer ID chain. | Read the reason in the detail pane, then check the package by hand with pkgutil --check-signature. |
Common questions
Why does a package show “Not audited: inside a disk image”?
The App Store sandbox doesn't let apps mount disk images. Open the .dmg in Finder and drop the mounted volume onto the window.
Why does a bundle-style (folder) .pkg show “Not audited”?
Only Apple's pkgutil can read the signature of those old-style packages, and App Store apps may not run it. In Terminal, run
pkgutil --check-signature /path/to/Package.pkg and look at the “Developer ID Certification Authority” line:
Expires: 2027-02-01 22:12:15 +0000 means the old CA, an expiry in 2031 means G2.
My Jamf CSV rows say the file wasn't found.
Drop the CSV together with the distribution point folder (select both in Finder and drag them in at once). If your export has a download URL column, those addresses are used instead.
Does the app validate the signature?
No. It reads which chain a package's signature carries. To check that the signature itself is intact, run pkgutil --check-signature file.pkg.
The optional trust check asks macOS whether the chain is trusted now and just after the cutoff, using only certificates already on your Mac.
What network access does it use?
Only requests to the download addresses you paste or list. There are no analytics and no account, and nothing is sent to the developer. See the privacy policy.
Refunds
Purchases are handled by Apple. Request a refund at reportaproblem.apple.com.
Can I check a single package without the app?
Yes: the free browser checker on this site checks one or more .pkg files on your own computer.