Hi, I downloaded the official macOS ARM DMG from the v1.4.0 release and verified that the downloaded DMG matches the SHA-256 digest published in the GitHub release asset metadata.
However, the app bundle inside the DMG fails macOS code signature verification.
Environment
- macOS: local Apple Silicon Mac
- Architecture:
arm64
- Release:
v1.4.0
- Asset:
Openscreen-mac-installer.dmg
- Asset URL:
https://github.com/siddharthvaddem/openscreen/releases/download/v1.4.0/Openscreen-mac-installer.dmg
Steps to reproduce
curl -L -o /tmp/Openscreen-mac-installer.dmg \
https://github.com/siddharthvaddem/openscreen/releases/download/v1.4.0/Openscreen-mac-installer.dmg
shasum -a 256 /tmp/Openscreen-mac-installer.dmg
# 0914ac10d9c1c0ef143eb8bbca7c3491f253e965b6312bbddeb9bfd1c3ee3122
hdiutil attach /tmp/Openscreen-mac-installer.dmg -nobrowse
codesign --verify --deep --strict --verbose=2 /Volumes/Openscreen/Openscreen.app
Actual result
/Volumes/Openscreen/Openscreen.app: invalid signature (code or signature have been modified)
In architecture: arm64
Additional signature details:
codesign -dv --verbose=4 /Volumes/Openscreen/Openscreen.app
Relevant output:
Authority=(unavailable)
Info.plist=not bound
TeamIdentifier=N26FZ4GW28
After copying the app to /Applications, Gatekeeper assessment also fails on the installed app:
spctl --assess --type execute --verbose /Applications/Openscreen.app
/Applications/Openscreen.app: internal error in Code Signing subsystem
Expected result
The app bundle in the official macOS DMG should pass code signature verification, especially because the v1.4.0 release notes mention that the app is notarized.
Why this matters
This may cause Gatekeeper warnings or require users to bypass macOS security controls. It also makes it harder for users to verify the integrity and trust chain of the official macOS release artifact.
Could you please check whether the v1.4.0 macOS ARM release asset was signed/notarized/stapled correctly?
Hi, I downloaded the official macOS ARM DMG from the v1.4.0 release and verified that the downloaded DMG matches the SHA-256 digest published in the GitHub release asset metadata.
However, the app bundle inside the DMG fails macOS code signature verification.
Environment
arm64v1.4.0Openscreen-mac-installer.dmghttps://github.com/siddharthvaddem/openscreen/releases/download/v1.4.0/Openscreen-mac-installer.dmgSteps to reproduce
curl -L -o /tmp/Openscreen-mac-installer.dmg \ https://github.com/siddharthvaddem/openscreen/releases/download/v1.4.0/Openscreen-mac-installer.dmg shasum -a 256 /tmp/Openscreen-mac-installer.dmg # 0914ac10d9c1c0ef143eb8bbca7c3491f253e965b6312bbddeb9bfd1c3ee3122 hdiutil attach /tmp/Openscreen-mac-installer.dmg -nobrowse codesign --verify --deep --strict --verbose=2 /Volumes/Openscreen/Openscreen.appActual result
Additional signature details:
Relevant output:
After copying the app to
/Applications, Gatekeeper assessment also fails on the installed app:Expected result
The app bundle in the official macOS DMG should pass code signature verification, especially because the v1.4.0 release notes mention that the app is notarized.
Why this matters
This may cause Gatekeeper warnings or require users to bypass macOS security controls. It also makes it harder for users to verify the integrity and trust chain of the official macOS release artifact.
Could you please check whether the v1.4.0 macOS ARM release asset was signed/notarized/stapled correctly?