I’m facing an issue with my macOS app after code signing and notarization.
The app is signed with my Developer ID and notarized using xcrun notarytool. Everything works fine on the machine where the signing was done — Gatekeeper accepts it, no warning appears, and codesign/spctl checks pass.
However, when running the same .app on other Macs, users receive a Gatekeeper warning saying the app is "malicious software and cannot be opened". The signature is valid and the notarization log shows status: Accepted.
What I've tried:
Verified signature with codesign --verify --deep --strict --verbose=2
Checked notarization status via xcrun notarytool log
Assessed Gatekeeper trust with spctl --assess --type execute
Everything passes successfully on the development machine.
Why would the app be treated as malicious on other systems even after notarization?
I'm happy to share logs and technical details if needed.
Selecting any option will automatically load the page