I'm trying to distribute my macOS application (a .dmg file) to customers, and I've followed all the steps to sign and notarize the application. However, when I try to install the .dmg containing the app, Gatekeeper rejects it with the error "AppName cannot be opened because developer is not verified". Even though I’ve signed the app with my Developer ID, notarized it, and verified the signature using codesign, I am still encountering issues when attempting to install or open the app on a clean macOS environment. Here’s the error I see when using spctl to check the .dmg:

spctl --assess --type open --verbose=4 output/App.dmg
output/App.dmg: rejected
source=Insufficient Context

pctl -a -t open --context context:primary-signature -v ./output/Unbounded-0.0.1-arm64.dmg
./output/App.dmg: accepted
source=Notarized Developer ID

My .app is signed and notarised by electron builder and I explicitly signed and notarised dmg too but still not working

I'm trying to distribute my macOS application (a .dmg file) to customers, and I've followed all the steps to sign and notarize the application. However, when I try to install the .dmg containing the app, Gatekeeper rejects it with the error "AppName cannot be opened because developer is not verified". Even though I’ve signed the app with my Developer ID, notarized it, and verified the signature using codesign, I am still encountering issues when attempting to install or open the app on a clean macOS environment. Here’s the error I see when using spctl to check the .dmg:

spctl --assess --type open --verbose=4 output/App.dmg
output/App.dmg: rejected
source=Insufficient Context

pctl -a -t open --context context:primary-signature -v ./output/Unbounded-0.0.1-arm64.dmg
./output/App.dmg: accepted
source=Notarized Developer ID

My .app is signed and notarised by electron builder and I explicitly signed and notarised dmg too but still not working

• macos
• electron-builder
• notarization

• Won't you need to sign it with an Installer certificate? – trojanfoe Commented Nov 19, 2024 at 8:53

1 Answer 1

Correct steps are:

1. Sign all your your *.app bundles
2. If you create installer sign also *.pkg
3. Put all wanted files into *.dmg file.
4. Sign *.dmg file
5. Notarize *.dmg (send it to Apple Notarization service).
6. Staple *.dmg file stapler staple ...

After every singning step you should verify, the signing process is OK and signature is valid codesign -vertify ... or codesign -vvv ..., then check Notarization Service output and finaly verify stapling process stapler verify ....