Issue description
The official Podman v6.0.2 macOS arm64 installer matches the size and SHA-256
published by GitHub's release API, but macOS reports an invalid Installer
package signature.
Asset identity:
- release:
v6.0.2
- asset ID:
485432449
- file:
podman-installer-macos-arm64.pkg
- size:
74,802,386 bytes
- SHA-256:
5a1d97f98f626cdb82dbd9932cf43102d1e9b6621627085fec2dcadf59743930
Environment:
- macOS 15.3 (
24D60)
- Apple Silicon /
arm64
- Darwin
24.3.0
Verification performed
$ pkgutil --check-signature podman-installer-macos-arm64.pkg
Package "podman-installer-macos-arm64.pkg":
Status: invalid signature
The file size and SHA-256 were checked before this command. The package was not
installed or expanded, and none of its scripts or binaries were executed.
Workflow evidence
- annotated tag target:
b28edb9ad70ce4317dc762ee9ce0a6d081d154e9; GitHub tag verification is
valid
- release workflow run:
29887033210, attempt 1, conclusion success
- macOS installer job:
88819584126, conclusion success
- exposed steps
Create Keychain, Build and Sign ARM, and Artifact all
report success
At the exact tag, release-build-artifacts.yml supplies a Developer ID
Installer identity and runs make ARCH=aarch64 notarize. package.sh uses
productsign --timestamp, and the Makefile submits with notarytool --wait
before stapling the ticket.
Expected result
pkgutil --check-signature should report a valid Developer ID Installer chain
for the exact release asset, consistent with the successful signing and
notarization workflow.
Clarification requested
Could maintainers please confirm:
- the expected Developer ID Installer certificate subject/team ID;
- the expected
pkgutil --check-signature and
spctl -a -vv -t install results for this exact SHA-256;
- the notarization request result/identifier and whether its ticket was
stapled to the uploaded bytes;
- whether asset ID
485432449 is the exact output of macOS job 88819584126;
- whether the asset is known-bad and, if so, whether a separately versioned
corrected immutable artifact will be published;
- whether signed checksums or a GitHub artifact attestation are available.
I found no existing issue or Discussion for this exact asset hash or Apple
Installer signature failure. Issues #22887 and #24558 concern older incomplete
shasums files, not package-signature validity.
Issue description
The official Podman v6.0.2 macOS arm64 installer matches the size and SHA-256
published by GitHub's release API, but macOS reports an invalid Installer
package signature.
Asset identity:
v6.0.2485432449podman-installer-macos-arm64.pkg74,802,386bytes5a1d97f98f626cdb82dbd9932cf43102d1e9b6621627085fec2dcadf59743930Environment:
24D60)arm6424.3.0Verification performed
The file size and SHA-256 were checked before this command. The package was not
installed or expanded, and none of its scripts or binaries were executed.
Workflow evidence
b28edb9ad70ce4317dc762ee9ce0a6d081d154e9; GitHub tag verification isvalid29887033210, attempt 1, conclusionsuccess88819584126, conclusionsuccessCreate Keychain,Build and Sign ARM, andArtifactallreport
successAt the exact tag,
release-build-artifacts.ymlsupplies a Developer IDInstaller identity and runs
make ARCH=aarch64 notarize.package.shusesproductsign --timestamp, and the Makefile submits withnotarytool --waitbefore stapling the ticket.
Expected result
pkgutil --check-signatureshould report a valid Developer ID Installer chainfor the exact release asset, consistent with the successful signing and
notarization workflow.
Clarification requested
Could maintainers please confirm:
pkgutil --check-signatureandspctl -a -vv -t installresults for this exact SHA-256;stapled to the uploaded bytes;
485432449is the exact output of macOS job88819584126;corrected immutable artifact will be published;
I found no existing issue or Discussion for this exact asset hash or Apple
Installer signature failure. Issues #22887 and #24558 concern older incomplete
shasumsfiles, not package-signature validity.