Advanced installation on macOS

This document describes various alternative ways to install and verify the application signature to prove authenticity of downloaded software on macOS.

Install using self-signed flat package installer (pkg)

The alternative distribution in form of self-signed flat package installer is available at portfelj-0.2.0-macos.pkg

WARNING

Unfortunately the installer will not be able to complete the installation without adding trust for the self-signed certificate. Follow the steps below to add trust for self-signed certificate before launching the installer. This only needs to be done once.

Add trust for self-signed certificate (one time only)

• Download the self-signed certificate from GitHub ApplePkgSigningCertificate.crt

• Type in the following command to output the certificate fingerprint:

  openssl x509 -noout -fingerprint -sha256 -inform pem -in ApplePkgSigningCertificate.crt

• Verify the output matches the following fingerprint:

  sha256 Fingerprint=4F:1E:93:22:10:36:66:A0:52:49:44:B1:66:54:43:D8:B3:8E:C5:2F:5A:1D:4A:AC:28:C9:48:0D:23:0E:EB:EE

  If the fingerprint does not match, delete the installer and report the incident on GitHub

• Add trust for installer certificate:

  sudo security add-trusted-cert -d -r trustRoot -k login.keychain ApplePkgSigningCertificate.crt

Check the installer signature

pkgutil --check-signature portfelj-0.2.0-macos.pkg

This should output that the pkg is signed by a trusted certificate, check the fingerprint once again, i.e:

Package "portfelj-0.2.0-macos.pkg":
Status: signed by a certificate trusted on this system
Signed with a trusted timestamp on: 2025-03-28 11:09:15 +0000
Certificate Chain:
    1. Portfelj Installer
    Expires: 2030-03-23 11:43:16 +0000
    SHA256 Fingerprint:
        4F 1E 93 22 10 36 66 A0 52 49 44 B1 66 54 43 D8 B3 8E C5 2F 5A 1D 
        4A AC 28 C9 48 0D 23 0E EB EE

Install the app

Run the pkg installer by double clicking it in Finder or via command line:

sudo /usr/sbin/installer -pkg portfelj-0.2.0-macos.pkg -tgt /

The app should now be successfully installed at /opt/portfelj. Add install directory to path:

echo 'export PATH="/opt/portfelj:$PATH"' >> ~/.zshrc

Re-open the terminal or run source ~/.zshrc to reload the path.