Fixing the Keychain access popups, and a couple of typos in the scripts, I get further, but not quite working yet. Now the pkgbuild is failing to sign. [exec] Valid identities only ... [exec] 3) ... "Apple Development: John Lussmyer (9W4G27WAV9)" [exec] 4) ... "Developer ID Application: Eps Us, LLC (F3YTHMJYQ9)" [exec] 4 valid identities found [exec] /usr/bin/pkgbuild --root /Users/jenkins/MetrixSetup/Metrix/MetrixApplication/ --component-plist /Users/jenkins/MetrixSetup/build/temp/component.plist --identifier com.efi.MetrixApplication --version 202220050 --scripts /Users/jenkins/MetrixSetup/build/temp/Scripts --sign F3YTHMJYQ9 --timestamp /Users/jenkins/MetrixSetup/build/MetrixApplication.pkg [exec] pkgbuild: Reading components from /Users/jenkins/MetrixSetup/build/temp/component.plist ... [exec] pkgbuild: error: Could not find appropriate signing identity for “F3YTHMJYQ9”. ... [exec] pkgbuild returned 1 The signing ID is there, and (as far as I can tell) is the correct type. "security find-identity" just before the call did show it as a valid identity.

The post you referenced helped, though all the dialogs and text were significantly different from what the Mac is showing me. I ended up using the Keychain app to modify the Access Control of the key associated with each Cert to "Allow all applications to access this item". I would have preferred to specify the list of applications, but the Finder window it brought up doesn't seem to have any way to select the relevant folder/file. Though, I do see that when I go back into Keychain, and look at those keys - the "Allow all ..." is no longer selected, but the shell scripts are NOT popping up the Keychain Unlock Dialog anymore. Which makes me wonder if this is going to stop working after the next reboot or something.

That is correct, and is one of the reasons I'm confused. I pass one identity, and it complains about the other. The 9W4G... cert is a "Apple Development", and the F3YT... is a "Mac Installer Distribution". It sounds like neither of these is what I need. (I should note that the code used to use the same cert for everything.) Looking at the page to create new Certs, I'm not sure if I need a "Apple Distribution", or a "Developer ID Application". Our app is a Java app, that is launched by a script, and embeds the JVM in the .app. Xcode is not used for this. We have an Installer application that was written years ago that does what we need at install time. That one item is built with Xcode. The instructions you referenced are very clear on how to do things with Xcode, but don't help much with a shell script command line built system.