I think the

.app

is something a little different. It’s not a package, and we don’t need to deconstruct it. After tinkering yesterday, and what now seems obvious, is that we cannot just treat the app bundle as a directory structure. It’s closer to a monolithic artifact, and should be signed as one. (Curious what Shavil says) Basically, I think I’m proposing: 1. osquery builds produce package-data 2. Something produces the .app (whether it’s an earlier step in packaging, or in (1) I don’t know) 3. codesign signs the app 4. codesign invokes the package code 5. codesign signs the pkg The change is that (2) moves from (4) to (1)