Seems to check out:
pkgutil --check-signature /Volumes/Apache\ NetBeans\ 11.2/Apache\ NetBeans\
11.2.pkg scott@Scotts-MacBook-Pro
Package "Apache NetBeans 11.2.pkg":
Status: signed by a developer certificate issued by Apple for distribution
Certificate Chain:
1. Developer ID Installer: The Apache Software Foundation (2GLGAFWEQD)
SHA256 Fingerprint:
2F E6 F2 85 F3 CD 55 CC 9E 7D BD C2 7A D6 6A 67 1A CA A9 CC 0B 28
11 F2 BF F7 0A 09 4D B4 68 F9
------------------------------------------------------------------------
2. Developer ID Certification Authority
SHA256 Fingerprint:
7A FC 9D 01 A6 2F 03 A2 DE 96 37 93 6D 4A FE 68 09 0D 2D E1 8D 03
F2 9C 88 CF B0 B1 BA 63 58 7F
------------------------------------------------------------------------
3. Apple Root CA
SHA256 Fingerprint:
B0 B1 73 0E CB C7 FF 45 05 14 2C 49 F1 29 5E 6E DA 6B CA ED 7E 2C
68 C5 BE 91 B5 A1 10 01 F0 24
So it must be something else.. Perhaps the notarization as Neil suggests.
Either way, I think we should get it dealt with as it will scare people away in
any case.
Scott
> On Oct 26, 2019, at 1:20 PM, Geertjan Wielenga <[email protected]> wrote:
>
> What happens when you run this:
>
> pkgutil --check-signature ~/Downloads/Apache*.pkg
>
> Gj
>
> On Sat, Oct 26, 2019 at 7:17 PM Scott Palmer <[email protected]
> <mailto:[email protected]>> wrote:
> Double-clicking the .pkg on macOS 10.15.1 beta leads to the following dialog
>
>
> If that image doesn’t come through, the text in the dialog reads:
>
> “Apache NetBeans 11.2.pkg” can’t be opened because Apple cannot check it for
> malicious software.
>
> This software needs to be updated. Contact the developer for more information.
>
> This item is on disk image “Apache-NetBeans-11.2-bin-macosx.dmg” Safari
> downloaded this disk image yesterday at 12:32 PM.”
>
>
>
>> On Oct 26, 2019, at 1:12 AM, [email protected]
>> <mailto:[email protected]> wrote:
>>
>> pkg is signed using Developer ID Installer certificate.
>>
>> pkgutil --check-signature ~/Downloads/Apache*.pkg
>> Package "Apache NetBeans 11.2.pkg":
>> Status: signed by a certificate trusted by Mac OS X
>> Certificate Chain:
>> 1. Developer ID Installer: The Apache Software Foundation (2GLGAFWEQD)
>> SHA1 fingerprint: FE B5 04 54 A5 67 F9 0D 41 7D 43 48 81 9E 0F F0 0A
>> F4 E8 9A
>> -----------------------------------------------------------------------------
>> 2. Developer ID Certification Authority
>> SHA1 fingerprint: 3B 16 6C 3B 7D C4 B7 51 C9 FE 2A FA B9 13 56 41 E3
>> 88 E1 86
>> -----------------------------------------------------------------------------
>> 3. Apple Root CA
>> SHA1 fingerprint: 61 1E 5B 66 2C 59 3A 08 FF 58 D1 4A E2 24 52 D1 98
>> DF 6C 60
>>
>> Thanks,
>>
>> Reema
>>
>> On 26/10/19 4:12 AM, Scott Palmer wrote:
>>> I can’t remember, was there a plan to have the .pkg signed?
>>>
>>> Delivering unsigned installers is a barrier to the end users that we really
>>> shouldn’t tolerate.
>>>
>>> Scott
>>>
>>>> On Oct 25, 2019, at 4:55 PM, Geertjan Wielenga <[email protected]
>>>> <mailto:[email protected]>> wrote:
>>>>
>>>> +1. Installs fine and did the various checks.
>>>>
>>>> Gj
>>>>
>>>> On Fri, Oct 25, 2019 at 5:56 PM <[email protected]
>>>> <mailto:[email protected]>> wrote:
>>>>
>>>>> Hi
>>>>>
>>>>> Artifacts are available here:
>>>>>
>>>>> https://urldefense.proofpoint.com/v2/url?u=https-3A__dist.apache.org_repos_dist_dev_netbeans_netbeans_11.2-2Dvc1&d=DwIFaQ&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=I_-Y15BecdUmuYLJbvbi0hFUs7JgHZnV_jPFSP8DQF0&m=FbR0d3Tnh4ma57lgC7izA4G7jWlkx3LNr02UtXj0N4g&s=qzDrunP-uIwKYAmh-ogeKns7phhL-h813Swm_j1XOY0&e=
>>>>>
>>>>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__dist.apache.org_repos_dist_dev_netbeans_netbeans_11.2-2Dvc1&d=DwIFaQ&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=I_-Y15BecdUmuYLJbvbi0hFUs7JgHZnV_jPFSP8DQF0&m=FbR0d3Tnh4ma57lgC7izA4G7jWlkx3LNr02UtXj0N4g&s=qzDrunP-uIwKYAmh-ogeKns7phhL-h813Swm_j1XOY0&e=>
>>>>>
>>>>> Built locally from release112 branch using JDK 1.8 on macOS 10.13.6:
>>>>>
>>>>> Primary voting artifact:
>>>>>
>>>>>
>>>>> https://urldefense.proofpoint.com/v2/url?u=https-3A__dist.apache.org_repos_dist_dev_netbeans_netbeans_11.2-2Dvc1_Apache-2DNetBeans-2D11.2-2Dbin-2Dmacosx.dmg&d=DwIFaQ&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=I_-Y15BecdUmuYLJbvbi0hFUs7JgHZnV_jPFSP8DQF0&m=FbR0d3Tnh4ma57lgC7izA4G7jWlkx3LNr02UtXj0N4g&s=etC_uQ93Y1ItGLVGigN7ppD7scJxsaWUk1T-kh_ifpg&e=
>>>>>
>>>>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__dist.apache.org_repos_dist_dev_netbeans_netbeans_11.2-2Dvc1_Apache-2DNetBeans-2D11.2-2Dbin-2Dmacosx.dmg&d=DwIFaQ&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=I_-Y15BecdUmuYLJbvbi0hFUs7JgHZnV_jPFSP8DQF0&m=FbR0d3Tnh4ma57lgC7izA4G7jWlkx3LNr02UtXj0N4g&s=etC_uQ93Y1ItGLVGigN7ppD7scJxsaWUk1T-kh_ifpg&e=>
>>>>>
>>>>> SHA512:
>>>>>
>>>>> 7cde2e5ff1fe2125ff0446b1cd663172eb64db4d852b6cbc265ce33b0eb2ce30b4f4bb632ce8860ce1a16c2127858f45391518b6e8fcfe32ea534d32f24769f8
>>>>>
>>>>> Apache-NetBeans-11.2-bin-macosx.dmg
>>>>>
>>>>> KEYS file:
>>>>>
>>>>> https://urldefense.proofpoint.com/v2/url?u=https-3A__dist.apache.org_repos_dist_release_netbeans_KEYS&d=DwIFaQ&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=I_-Y15BecdUmuYLJbvbi0hFUs7JgHZnV_jPFSP8DQF0&m=FbR0d3Tnh4ma57lgC7izA4G7jWlkx3LNr02UtXj0N4g&s=UwVlRgDVXj4WPsYLq8cM7Xy3tlzXGhrDPwMf6i784DA&e=
>>>>>
>>>>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__dist.apache.org_repos_dist_release_netbeans_KEYS&d=DwIFaQ&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=I_-Y15BecdUmuYLJbvbi0hFUs7JgHZnV_jPFSP8DQF0&m=FbR0d3Tnh4ma57lgC7izA4G7jWlkx3LNr02UtXj0N4g&s=UwVlRgDVXj4WPsYLq8cM7Xy3tlzXGhrDPwMf6i784DA&e=>
>>>>>
>>>>> Installer build steps:
>>>>>
>>>>> https://urldefense.proofpoint.com/v2/url?u=https-3A__cwiki.apache.org_confluence_display_NETBEANS_Installer-2BBuild-2BSteps&d=DwIFaQ&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=I_-Y15BecdUmuYLJbvbi0hFUs7JgHZnV_jPFSP8DQF0&m=FbR0d3Tnh4ma57lgC7izA4G7jWlkx3LNr02UtXj0N4g&s=_xOCa67JgJ61B-4YDN7PV-JR5rsKz9YhcRF4sv9JZYM&e=
>>>>>
>>>>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__cwiki.apache.org_confluence_display_NETBEANS_Installer-2BBuild-2BSteps&d=DwIFaQ&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=I_-Y15BecdUmuYLJbvbi0hFUs7JgHZnV_jPFSP8DQF0&m=FbR0d3Tnh4ma57lgC7izA4G7jWlkx3LNr02UtXj0N4g&s=_xOCa67JgJ61B-4YDN7PV-JR5rsKz9YhcRF4sv9JZYM&e=>
>>>>>
>>>>> Please check that the artifact functions correctly and has been
>>>>> correctly signed by a PMC member.
>>>>>
>>>>> This vote is going to be open at least 72 hours, vote with +1, 0, and -1
>>>>> as usual.
>>>>>
>>>>> Please mark your vote with (binding) if you're an Apache NetBeans PMC
>>>>> member.
>>>>>
>>>>> Apache NetBeans 11.2 macOS Installer will be released if and when this
>>>>> vote passes.
>>>>>
>>>>>
>>>>> Thanks,
>>>>>
>>>>> Reema
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> ---------------------------------------------------------------------
>>>>> To unsubscribe, e-mail: [email protected]
>>>>> <mailto:[email protected]>
>>>>> For additional commands, e-mail: [email protected]
>>>>> <mailto:[email protected]>
>>>>>
>>>>> For further information about the NetBeans mailing lists, visit:
>>>>> https://urldefense.proofpoint.com/v2/url?u=https-3A__cwiki.apache.org_confluence_display_NETBEANS_Mailing-2Blists&d=DwIFaQ&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=I_-Y15BecdUmuYLJbvbi0hFUs7JgHZnV_jPFSP8DQF0&m=FbR0d3Tnh4ma57lgC7izA4G7jWlkx3LNr02UtXj0N4g&s=VTQsNSTZwO6aoE0AgP6zLOLJGGzUjSH1aXXUfzIYr3k&e=
>>>>>
>>>>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__cwiki.apache.org_confluence_display_NETBEANS_Mailing-2Blists&d=DwIFaQ&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=I_-Y15BecdUmuYLJbvbi0hFUs7JgHZnV_jPFSP8DQF0&m=FbR0d3Tnh4ma57lgC7izA4G7jWlkx3LNr02UtXj0N4g&s=VTQsNSTZwO6aoE0AgP6zLOLJGGzUjSH1aXXUfzIYr3k&e=>
>>>>>
>>>>>
>>>>>
>>>>>
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: [email protected]
>>> <mailto:[email protected]>
>>> For additional commands, e-mail: [email protected]
>>> <mailto:[email protected]>
>>>
>>> For further information about the NetBeans mailing lists, visit:
>>> https://urldefense.proofpoint.com/v2/url?u=https-3A__cwiki.apache.org_confluence_display_NETBEANS_Mailing-2Blists&d=DwIFaQ&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=I_-Y15BecdUmuYLJbvbi0hFUs7JgHZnV_jPFSP8DQF0&m=FbR0d3Tnh4ma57lgC7izA4G7jWlkx3LNr02UtXj0N4g&s=VTQsNSTZwO6aoE0AgP6zLOLJGGzUjSH1aXXUfzIYr3k&e=
>>>
>>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__cwiki.apache.org_confluence_display_NETBEANS_Mailing-2Blists&d=DwIFaQ&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=I_-Y15BecdUmuYLJbvbi0hFUs7JgHZnV_jPFSP8DQF0&m=FbR0d3Tnh4ma57lgC7izA4G7jWlkx3LNr02UtXj0N4g&s=VTQsNSTZwO6aoE0AgP6zLOLJGGzUjSH1aXXUfzIYr3k&e=>
>>>
>>>
>>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: [email protected]
>> <mailto:[email protected]>
>> For additional commands, e-mail: [email protected]
>> <mailto:[email protected]>
>>
>> For further information about the NetBeans mailing lists, visit:
>> https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
>> <https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists>
