App notarized/stapled but Gatekeeper says "App" cannot be opened because the developer cannot be verified

Question

Level 1

6 points

App notarized/stapled but Gatekeeper says "App" cannot be opened because the developer cannot be verified

Hi,

As software developer/provider my Foo.app is signed and notarized successfully since many releases, and nobody reported that Gatekeeper complains about.

But today, preparing and testing the next version, I get the message usually displayed when an App is not notarized:

"Foo.app" cannot be opened because the developer cannot be verified

However my Foo.app is 1/ signed, 2/ notarized, 3 stapled successfully:

{
  "logFormatVersion": 1,
  "jobId": "xxxx",
  "status": "Accepted",
  "statusSummary": "Ready for distribution",
  "statusCode": 0,
  "archiveFilename": "Foo.app.zip",
  "uploadDate": "2024-03-14T15:48:25.520Z",
  "sha256": "xxxxx",
  "ticketContents": [ ...]
}

$ spctl -a Foo.app -vv
Foo.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: XXXXXXXXX (XXXXXX)

Tested on 3 distinct Mac...

Could somebody help me to understand what is going wrong ?

Thanks!

Posted on Mar 14, 2024 10:10 AM

Reply

Answer 1

etresoft

Level 9

56,308 points

Mar 14, 2024 1:24 PM in response to jdestm

Most likely something is failing at load time. There are several categories of "clever" things that can be done, that most apps don't do, and will require some kind of special entitlement in the hardened runtime configuration. If you inspect Console while launching your app, it may tell you what it doesn't like. This is one of the few useful things you can do in Console.

Reply