Skip to content

v1.8.x macOS DMG fails Gatekeeper notarization assessment #398

Description

@devaxai

Hi,
I downloaded the VibeProxy-arm64.dmg from the official releases page from github.
The app bundle inside the DMG appears to be signed and notarized correctly:

>spctl --assess --type execute -v /Volumes/VibeProxy/VibeProxy.app
/Volumes/VibeProxy/VibeProxy.app: accepted
source=Notarized Developer ID

However, the downloaded DMG itself appears to be signed but not notarized/stapled, so Gatekeeper assessment rejects the disk image:

>codesign --verify --verbose=4 VibeProxy-arm64.dmg
VibeProxy-arm64.dmg: valid on disk
VibeProxy-arm64.dmg: satisfies its Designated Requirement

>spctl --assess --type open --context context:primary-signature -v VibeProxy-arm64.dmg
VibeProxy-arm64.dmg: rejected
source=Unnotarized Developer ID
origin=Developer ID Application: Automaze, Ltd. (GJ2RT96SZT)

>xcrun stapler validate -v VibeProxy-arm64.dmg
VibeProxy-arm64.dmg does not have a ticket stapled to it.

The release notes mention "Code Signed & Notarized - No Gatekeeper warnings", so I wanted to flag that the DMG artifact may be missing the stapled notarization ticket, even though the contained app bundle looks notarized.

Thanks

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions