Skip to content

[macOS arm64] v6.0.2 release pkg matches GitHub digest but pkgutil reports invalid signature #29436

Description

@felixtfc-png

Issue description

The official Podman v6.0.2 macOS arm64 installer matches the size and SHA-256
published by GitHub's release API, but macOS reports an invalid Installer
package signature.

Asset identity:

  • release: v6.0.2
  • asset ID: 485432449
  • file: podman-installer-macos-arm64.pkg
  • size: 74,802,386 bytes
  • SHA-256:
    5a1d97f98f626cdb82dbd9932cf43102d1e9b6621627085fec2dcadf59743930

Environment:

  • macOS 15.3 (24D60)
  • Apple Silicon / arm64
  • Darwin 24.3.0

Verification performed

$ pkgutil --check-signature podman-installer-macos-arm64.pkg
Package "podman-installer-macos-arm64.pkg":
   Status: invalid signature

The file size and SHA-256 were checked before this command. The package was not
installed or expanded, and none of its scripts or binaries were executed.

Workflow evidence

  • annotated tag target:
    b28edb9ad70ce4317dc762ee9ce0a6d081d154e9; GitHub tag verification is
    valid
  • release workflow run: 29887033210, attempt 1, conclusion success
  • macOS installer job: 88819584126, conclusion success
  • exposed steps Create Keychain, Build and Sign ARM, and Artifact all
    report success

At the exact tag, release-build-artifacts.yml supplies a Developer ID
Installer identity and runs make ARCH=aarch64 notarize. package.sh uses
productsign --timestamp, and the Makefile submits with notarytool --wait
before stapling the ticket.

Expected result

pkgutil --check-signature should report a valid Developer ID Installer chain
for the exact release asset, consistent with the successful signing and
notarization workflow.

Clarification requested

Could maintainers please confirm:

  1. the expected Developer ID Installer certificate subject/team ID;
  2. the expected pkgutil --check-signature and
    spctl -a -vv -t install results for this exact SHA-256;
  3. the notarization request result/identifier and whether its ticket was
    stapled to the uploaded bytes;
  4. whether asset ID 485432449 is the exact output of macOS job 88819584126;
  5. whether the asset is known-bad and, if so, whether a separately versioned
    corrected immutable artifact will be published;
  6. whether signed checksums or a GitHub artifact attestation are available.

I found no existing issue or Discussion for this exact asset hash or Apple
Installer signature failure. Issues #22887 and #24558 concern older incomplete
shasums files, not package-signature validity.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions