I just tried this with Xcode 15.2 and a Clean build. The same thing is happening. The frameworks that Xcode compiles and links at project Build time are left untouched. However, all pre-built Frameworks that my app links to get Merged into the app's binary. While I don't think anything bad is happening because of this, I'd prefer to have complete control over my build chain. Is there any way to disable this behavior?

If it’s an app you could avoid this problem by: Siging your app. Notarising your app. Stapling to your app. Wrapping it in a disk image. Signing, notarising, and stapling your disk image, or not, as you see fit. Yup, that's exactly what we do. We'll just keep on doing that. Thanks Quinn.

Unfortunately I can't seem to use xattr -w com.apple.quarantine "..." /Volumes/path/to/my/mounted/dmg/myapp.app to trigger Gatekeeper. Xattr doesn't like that our DMG's are all re-only. Sigh. I think I may need to stick with hdiutil and just continue with our existing two-pass Notarizing system.

Quinn - Yes, using "open" works:) However we're actually mounting the dmg from within our app, and doing an "hdiutil attach -nobrowse -noautoopen" to keep it off the Desktop. From there we copy the app inside using NSFileManager. Basically, we're trying not to bother our users about it:) So sticking with hdiutil is important. Paradigm777 - Wow, that's crazy that someone asked practically the same (very esoteric!) question on Codermite just a few hours after I posted it here. I haven't tried manually setting the Quarantine flag as suggested in that post. It looks like using xattr to do this is a bit tricky, however I think I'll give it a try just to see what happens. But question back to Quinn: How "safe" would it be to manually set the Qurantine flag, in an attempt to trigger Gatekeeper's "ticket ingestion"? Without going into too many gory details, the reason I'm looking into this is that our systems currently do a two-pass Notarization: App first, build the dmg, then Notarize the dmg. It'd be nice if we could skip the first Notarization step and just stick with Notarizing the dmg. But we could certainly just stick with a two-pass Notarization system and call it a day:)

Hadn't tried Sandbox testing in a while and it's DOA for me again. Just got done filing feedback FB1014100.

It appears that it's finally fixed (at least for me) on macOS 12.2. YMMV.

FWIW, my account is still busted. Anyone else? I haven't been able to test any build since before Thanksgiving, which has basically prevented me from posting new apps or updates. I filed Feedback as well as a DTS incident. They got back to me and asked for some logs, which I provided. Since then: crickets. With the holidays now here, I doubt this will be fixed before January.

Same here since Friday with all my MAS apps. I've had similar issues in the past. Filing Radar helps. But in the past the Radar guys typically have me file a DTS incident. So I went ahead and did that earlier today.