Hi,
I downloaded the VibeProxy-arm64.dmg from the official releases page from github.
The app bundle inside the DMG appears to be signed and notarized correctly:
>spctl --assess --type execute -v /Volumes/VibeProxy/VibeProxy.app
/Volumes/VibeProxy/VibeProxy.app: accepted
source=Notarized Developer ID
However, the downloaded DMG itself appears to be signed but not notarized/stapled, so Gatekeeper assessment rejects the disk image:
>codesign --verify --verbose=4 VibeProxy-arm64.dmg
VibeProxy-arm64.dmg: valid on disk
VibeProxy-arm64.dmg: satisfies its Designated Requirement
>spctl --assess --type open --context context:primary-signature -v VibeProxy-arm64.dmg
VibeProxy-arm64.dmg: rejected
source=Unnotarized Developer ID
origin=Developer ID Application: Automaze, Ltd. (GJ2RT96SZT)
>xcrun stapler validate -v VibeProxy-arm64.dmg
VibeProxy-arm64.dmg does not have a ticket stapled to it.
The release notes mention "Code Signed & Notarized - No Gatekeeper warnings", so I wanted to flag that the DMG artifact may be missing the stapled notarization ticket, even though the contained app bundle looks notarized.
Thanks
Hi,
I downloaded the VibeProxy-arm64.dmg from the official releases page from github.
The app bundle inside the DMG appears to be signed and notarized correctly:
>spctl --assess --type execute -v /Volumes/VibeProxy/VibeProxy.app /Volumes/VibeProxy/VibeProxy.app: accepted source=Notarized Developer IDHowever, the downloaded DMG itself appears to be signed but not notarized/stapled, so Gatekeeper assessment rejects the disk image:
The release notes mention "Code Signed & Notarized - No Gatekeeper warnings", so I wanted to flag that the DMG artifact may be missing the stapled notarization ticket, even though the contained app bundle looks notarized.
Thanks