The app is successfully notarized and stapled, I packaged it in a .dmg using hdiutil and went ahead and notarized and stapled that as well.
You don't need to notarize both. If this is a stand-alone app, I recommend just notarizing the app and distributing it as a ZIP file. You don't really need a disk image at all.
The only times where a download actually worked with no problems was when I downloaded through the terminal using curl,
The curl tool won't add the quarantine attribute. That makes it avoid Gatekeeper altogether.
Problems like this are usually because of some runtime check. There is a new tool called "syspolicy_check", as described here, that is supposed to help with that.
Are you building in Xcode? This is a common problem, but occurs most often to people who aren't using Xcode. If you are using some 3rd party build system, I recommend you put your efforts towards porting to Xcode. This makes lots of problems, including notarization, go away.
Topic:
Code Signing
SubTopic:
General
Tags: