Hey guys,

So I just noticed, the certificate for package installers (.pkg files) for Mac offline installers will expire next year.

I've seen other (non-GOG) packages with a certificate that's valid for another 4-5 years, and I'm guessing this might be a simple fix?

I know this is not a serious issue, but would be awesome if you guys do it sooner rather than later as some games might not get new updates/installers from now on.

I'm also aware it is still possible to install expired packages, but there will be some warnings that might be scary for some users.

Also, thanks for all the hard work! I'm new to GOG, but really love it because of the DRM-Free approach.

I'm glad I live on an OS where this sort of thing is nonexistant.

Wait, so Mac installers have an expiry date?

More like all issued digital certificates have an expiry date. But for some applications (such as signing installers) it can be safely ignored. For protecting/verifying the validity of an ebanking site, not so much.

Right, as long as you're allowed to ignore the expired certificate I guess it doesn't matter.

Is it really worth it for GOG to update the certificates? If the certificate was valid when the installer was made then the expired certificate doesn't really matter.

That's also true for windows installer if signed. The only thing that expire is the certificate so you can ignore the warnings and or change the local date on your pc.
I had to use a certificate for a windows store app that I released also there and it was a pain in the ass. The sign is to identify if the installer is real or fake to identify virus (at least that's what they say).

I don't think so... unless MacOS reacts in a nasty way to such situations (I have no idea how it's handled). Right. But if the OS displays some weird "This certificate is expired - the world may end if you proceed" message, I can see why someone might request they be updated.

It's not really an issue...the oldest .pkg installer I have is from 2016 (before then, GOG used .dmg files instead of installers, which is preferable, but they changed it because of Galaxy so yeah that's something else Galaxy ruined). The cert expired in 2019 but the game installs (and runs) fine with no messages or anything.

Also, even if it was somehow an issue, the .pkg file is just a xar archive and the files can be extracted without going through the installer. Kinda like how you can use innoextract to get files out of GOG Windows installers except you don't need a third-party tool.

Dead cert.... Sorry....