App Signature
Only apps signed with an Apple-issued certificate can be sold on the App Store, so the app we've developed must be signed.
There are two ways to sign a signature, one is to use Xcode, to set up a signature in the configuration, a signature for the compiled app, and a manual signature using the Codesign command line. Here we use manual codesign to sign the app.
codesign-s "Your application Certificates"App_path
For example, you need to sign Myappdemo.app and use the certificate you requested earlier.
Codesign-s "3rd party Mac developerapplication:xxxx" Myappdemo.app
Signed apps have two more files than unsigned apps _codesignature and coderesources
Pkg Signature
A signed app can use the Productbuild command line to play pkg package. Here you will need to use the installer certificate you created earlier.
Productbuild--component app_path/applications--sign "3rd party Mac Developer installer:xxx"--product info.plist_ Pathdest_pkg_path.pkg
For example, you want to play pkg bag on the myappdemo.app that you just signed?
Productbuild--component myappdemo.app/applications--sign "3rd party Mac Developer installer:xxx"--product MyAppDemo.a Pp/contens/info.plistmyappdemo.app.pkg
http://blog.csdn.net/cocoasprite/article/details/9624815
App Signature and pkg signature for MAC App Store (must be signed before it can be sold)