diff --git a/Makefile b/Makefile
index 7b980b1322f3e02fa6771f2dcd1448b21f977629..287715db45cb852d83c654b567ca71bbf009f1b4 100644
--- a/Makefile
+++ b/Makefile
@@ -48,7 +48,7 @@ build: $(foreach path,$(wildcard cmd/*),build_$(patsubst cmd/%,%,$(path)))
 
 build_%:
 	go build -tags $(TAGS) -ldflags "-X main.version=`git describe --tags`" -o $* ./cmd/$*
-	-@strip $*
+	-# doesn't work for cross compile: @strip $*
 	@mkdir -p build/bin
 	@mv $* build/bin/
 	-@rm -rf build/${PROVIDER}/staging && mkdir -p build/${PROVIDER}/staging
diff --git a/branding/templates/makefile/Makefile b/branding/templates/makefile/Makefile
index 9612190d096e9a1a6f03d7070f916086f1df8b4f..f6705cd25f683aef43674f27b0834c6e26e26aa2 100755
--- a/branding/templates/makefile/Makefile
+++ b/branding/templates/makefile/Makefile
@@ -16,6 +16,7 @@ WIN_CERT_PATH?=z:\leap\LEAP.pfx
 WIN_CERT_PASS?=
 OSX_CERT = "Developer ID Installer: LEAP Encryption Access Project"
 DEB_VERSION = $(shell echo ${VERSION} | cut -d '-' -f 1,2)
+SYSTEM = $(shell uname -s)
 
 
 # -----------------------------------------------------------------------------
@@ -40,32 +41,28 @@ openvpn_cross_win:
 	cp $(STAGING)/openvpn/bin/*.dll $(STAGING)
 	cp $(STAGING)/openvpn/lib/engines-1_1/*.dll $(STAGING)
 
-# TODO no need to build systray in windows, but move this powershell hack to main build makefile
-#powershell '$$gopath=go env GOPATH;$$version=git -C $$gopath/src/$(SYSTRAY) describe --tags; go build -ldflags "-H windowsgui -s -w -X main.version=$$version" -o $(STAGING)/$(SYSTRAY_BIN).exe $(SYSTRAY)/cmd/bitmask-vpn'
-
 pkg_win: staging\nssm.exe helper_win systray_win
 # I assume you did bootstrap openvpn_win manually already.
 	echo "[+] building windows"
 	"C:\Program Files (x86)\NSIS\makensis.exe" windows/$(APPNAME)-installer.nsi
 
+pkg_cross_win: staging/nssm.exe
+	makensis windows/$(APPNAME)-installer.nsi
+
 sign_win:
 	echo "[+] signing windows build"
 	python windowns/sign.py $(WIN_CERT_PATH) $(WIN_CERT_PASS)
 
-# TODO move to main build makefile
-build_cross_win: staging/nssm.exe
-	echo "!define VERSION $(VERSION)" > $(STAGING)/version.nsh
-	$(CROSS_FLAGS) $(MAKE) helper_win
-	mkdir -p dist
-	make -C win VERSION=$(VERSION)
-	makensis win/$(APPNAME)-installer.nsi
-
 # -----------------------------------------------------------------------------
 # OSX
 # -----------------------------------------------------------------------------
 
 pkg_osx:
 	echo "[+] Building osx package..."
+	cp ../bin/bitmask-vpn dist/$(APPNAME).app/Contents/MacOS/
+	cp ../bin/bitmask-helper dist/$(APPNAME).app/Contents/MacOS/
+	cp $(STAGING)/openvpn-osx dist/$(APPNAME).app/Contents/Resources/openvpn.leap
+ifeq ($(SYSTEM), Darwin)
 	osx/quickpkg --output dist/$(APPNAME)-$(VERSION)_unsigned.pkg --scripts osx/scripts/ dist/$(APPNAME).app/
 	@if [ $(BUILD_RELEASE) = no ]; then\
 		echo "[!] BUILD_RELEASE=no, skipping signature";\
@@ -73,6 +70,17 @@ pkg_osx:
 		echo "[+] Signing the bundle";\
 		productsign --sign $(OSX_CERT) dist/$(APPNAME)-$(VERSION)_unsigned.pkg dist/$(APPNAME)-$(VERSION).pkg;\
 	fi
+else
+	mkdir dist/tmp
+	mv dist/$(APPNAME).app dist/tmp
+	mkbom -u 0 -g 80 dist/tmp dist/$(APPNAME)/Bom
+	mv dist/tmp/$(APPNAME).app dist
+	rmdir dist/tmp
+	
+	cd dist && find $(APPNAME).app | cpio -o --format odc --owner 0:80 | gzip -c > $(APPNAME)/Payload
+	cd osx/scripts && find . | cpio -o --format odc --owner 0:80 | gzip -c > ../../dist/$(APPNAME)/Scripts
+	xar --compression none -cf dist/RiseupVPN-$(VERSION)_unsigned.pkg dist/$(APPNAME)/
+endif
 
 # -----------------------------------------------------------------------------
 # Linux 
diff --git a/branding/templates/osx/generate.py b/branding/templates/osx/generate.py
index 6ea15bdb815ad9df39a0e4a3f67d21c46381134c..ada7269b799c68ae708546afdffbdb0053b0ca33 100644
--- a/branding/templates/osx/generate.py
+++ b/branding/templates/osx/generate.py
@@ -10,16 +10,16 @@ import os
 import os.path
 import shutil
 import stat
+import sys
 
 from string import Template
 
 here = os.path.split(os.path.abspath(__file__))[0]
 
 ENTRYPOINT = 'bitmask-vpn'
-HELPER = 'bitmask-helper'
-OPENVPN = 'openvpn-osx'
 TEMPLATE_INFO = 'template-info.plist'
 TEMPLATE_HELPER = 'template-helper.plist'
+TEMPLATE_PACKAGEINFO = 'template-packageinfo.plist'
 
 TEMPLATE_PREINSTALL = 'template-preinstall'
 TEMPLATE_POSTINSTALL = 'template-postinstall'
@@ -30,12 +30,14 @@ APPNAME = data.get('applicationName')
 VERSION = data.get('version', 'unknown')
 
 APP_PATH = os.path.abspath(here + '/../dist/' + APPNAME + ".app")
+PKG_PATH = os.path.abspath(here + '/../dist/' + APPNAME)
 STAGING = os.path.abspath(here + '/../staging/')
 ASSETS = os.path.abspath(here + '/../assets/')
 ICON = os.path.join(ASSETS, 'icon.icns')
 SCRIPTS = os.path.join(os.path.abspath(here), 'scripts')
 INFO_PLIST = APP_PATH + '/Contents/Info.plist'
 HELPER_PLIST = os.path.join(SCRIPTS, 'se.leap.bitmask-helper.plist')
+PACKAGEINFO = os.path.join(PKG_PATH, 'PackageInfo')
 PREINSTALL = os.path.join(SCRIPTS, 'preinstall')
 POSTINSTALL = os.path.join(SCRIPTS, 'postinstall')
 RULEFILE = os.path.join(here, 'bitmask.pf.conf')
@@ -64,16 +66,6 @@ data['bundle_name'] = APPNAME
 # utils
 
 
-def copy_payload(filename, destfile=None):
-    if destfile is None:
-        destfile = APP_PATH + "/Contents/MacOS/" + filename
-    else:
-        destfile = APP_PATH + destfile
-    shutil.copyfile(STAGING + '/' + filename, destfile)
-    cmode = os.stat(destfile).st_mode
-    os.chmod(destfile, cmode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)
-
-
 def generate_from_template(template, dest, data):
     print("[+] File written from template to", dest)
     template = Template(open(template).read())
@@ -95,13 +87,15 @@ with open(APP_PATH + "/Contents/PkgInfo", "w") as f:
     f.write("APPL????")
 
 
-# 3. Copy the binary payloads
+# 3. Generate if needed the package info (for cross build)
 # --------------------------------------------
 
-# TODO ------------------------ move this to makefile
-# copy_payload(ENTRYPOINT)
-# copy_payload(HELPER)
-# copy_payload(OPENVPN, destfile='/Contents/Resources/openvpn.leap')
+if not sys.platform.startswith('darwin'):
+    try:
+        os.mkdir(PKG_PATH)
+    except FileExistsError:
+        pass
+    generate_from_template(TEMPLATE_PACKAGEINFO, PACKAGEINFO, data)
 
 # 4. Copy the app icon from the assets folder
 # -----------------------------------------------
diff --git a/branding/templates/osx/template-packageinfo.plist b/branding/templates/osx/template-packageinfo.plist
new file mode 100644
index 0000000000000000000000000000000000000000..729744296a4a9b17f172806f6028e2f2a588e92b
--- /dev/null
+++ b/branding/templates/osx/template-packageinfo.plist
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="utf-8" standalone="no"?>
+<pkg-info overwrite-permissions="true" relocatable="false" identifier="se.leap.$applicationNameLower" postinstall-action="none" version="$applicationName $version" format-version="2" generator-version="InstallCmds-502 (14A389)" install-location="/Applications" auth="root">
+    <payload numberOfFiles="15" installKBytes="10188"/>
+    <bundle path="./$applicationName.app" id="se.leap.$applicationNameLower" CFBundleShortVersionString="$applicationName $version" CFBundleVersion="0.19.1"/>
+    <bundle-version>
+        <bundle id="se.leap.$applicationNameLower"/>
+    </bundle-version>
+    <upgrade-bundle>
+        <bundle id="se.leap.$applicationNameLower"/>
+    </upgrade-bundle>
+    <update-bundle/>
+    <atomic-update-bundle/>
+    <strict-identifier>
+        <bundle id="se.leap.$applicationNameLower"/>
+    </strict-identifier>
+    <relocate/>
+    <scripts>
+        <preinstall file="./preinstall"/>
+        <postinstall file="./postinstall"/>
+    </scripts>
+</pkg-info>