title: Can't sign kext in Mavericks/Yosemite?
body: <p>Goal: to sign my own packages, and my own kernel extensions. "My own" in the context means "that I wrote, or that I picked elsewhere, recompiled myself from their sources, and want to install on my machine.</p>
  
  <p>Problem: Mavericks does not accept my signature with <code>Code Signing Failure: code signature is invalid</code> (but loads the kext), Yosemite won't even load it.</p>
  
  <p>I have my own CA, and code-signing certs. I've been able to successfully sign code and set up policies that would allow code signed by the given certs to be installed and executed - both <a href="https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/codesign.1.html" rel="nofollow noreferrer">codesign</a> and <a href="https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man8/spctl.8.html" rel="nofollow noreferrer">spctl</a> like it, as you see in the output below. However, that does not seem to apply to kext (kernel extensions) - <a href="https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man8/kextutil.8.html" rel="nofollow noreferrer">kextutil</a> insists that the signature is invalid. Here's the output I'm getting:</p>
  
  <pre><code>$ codesign --verify -vvvv /opt/local/Library/Filesystems/osxfusefs.fs/Support/osxfusefs.kext
  /opt/local/Library/Filesystems/osxfusefs.fs/Support/osxfusefs.kext: valid on disk
  /opt/local/Library/Filesystems/osxfusefs.fs/Support/osxfusefs.kext: satisfies its Designated Requirement
  
  $ spctl -a -vvv -t exec /opt/local/Library/Filesystems/osxfusefs.fs/Support/osxfusefs.kext
  /opt/local/Library/Filesystems/osxfusefs.fs/Support/osxfusefs.kext: accepted
  source=XXXXXCode
  origin=XXXXXCoder
  $ spctl -a -vvv -t install /opt/local/Library/Filesystems/osxfusefs.fs/Support/osxfusefs.kext
  /opt/local/Library/Filesystems/osxfusefs.fs/Support/osxfusefs.kext: accepted
  source=XXXXXInstall
  origin=XXXXXCoder
  
  $ kextutil -tn /opt/local/Library/Filesystems/osxfusefs.fs/Support/osxfusefs.kext
  Diagnostics for /opt/local/Library/Filesystems/osxfusefs.fs/Support/osxfusefs.kext:
  Code Signing Failure: code signature is invalid
  /opt/local/Library/Filesystems/osxfusefs.fs/Support/osxfusefs.kext appears to be loadable (including linkage for on-disk libraries).
  </code></pre>
  
  <p>On Mavericks this kext loads with a warning message, on Yosemite it will not.</p>
  
  <p>I noticed <a href="https://stackoverflow.com/questions/26283158/codesigning-kext-with-kext-enabled-certificate-fails-during-kextload-code-sign">here</a> and in <a href="http://images.apple.com/certificateauthority/pdf/Apple_Developer_ID_CPS_v1.1.pdf" rel="nofollow noreferrer">Apple CA CPS Developer ID</a> that the cert must have the following extension: <code>( 1.2.840.113635.100.6.1.18 )</code> to designate it as kext-signing certificate. Mine does not have it. I suspect it to be the cause of my problem, but don't know how to resolve it. There does not seem to be an type option in <em>spctl</em> to create a policy designating a given cert as a kext-signing one.</p>
  
  <p>How do I add this extension (preferably within Keychain Certificate Assist, though an OpenSSL-based solution would be fine too), short of paying Apple annual "usage fee" of $100?</p>