We package a nightly build of our application for distribution. About 1 month ago, this package has started showing the "Apple could not verify 'Application' is free of malware" message.
This only happens to our development branch package. We run the same pipeline with the same signature for our stable branch and the stable package does not show this message.
$ codesign -dv --verbose=4 KiCad.app
Executable=/Applications/KiCad/KiCad/KiCad.app/Contents/MacOS/kicad
Identifier=org.kicad.kicad
Format=app bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=51931 flags=0x10000(runtime) hashes=1612+7 location=embedded
VersionPlatform=1
VersionMin=722432
VersionSDK=983552
Hash type=sha256 size=32
CandidateCDHash sha256=4f15435c1d3cc056a83432b78a2f6acae8fb0e6d
CandidateCDHashFull sha256=4f15435c1d3cc056a83432b78a2f6acae8fb0e6d03cbe70641719fd1ced3395b
Hash choices=sha256
CMSDigest=4f15435c1d3cc056a83432b78a2f6acae8fb0e6d03cbe70641719fd1ced3395b
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=3915776
Executable Segment flags=0x1
Page size=4096
CDHash=4f15435c1d3cc056a83432b78a2f6acae8fb0e6d
Signature size=9002
Authority=Developer ID Application: KiCad Services Corporation (9FQDHNY6U2)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=Dec 19, 2025 at 5:21:05 AM
Info.plist entries=17
TeamIdentifier=9FQDHNY6U2
Runtime Version=15.2.0
Sealed Resources version=2 rules=13 files=37238
Internal requirements count=1 size=176
codesign --verify --verbose=4 KiCad.app
<snipped all libs validated>
KiCad.app: valid on disk
KiCad.app: satisfies its Designated Requirement
% spctl --assess --verbose=4 KiCad.app
KiCad.app: accepted
source=Notarized Developer ID
We distribute this via dmg. The notarization ticket is stapled to the dmg and the dmg opens without warning.
Any help would be appreciated