I dig into the issue, hence I have 2 executable files in the app under ***.app/Contents/MacOS: M and N, M is in the Info.plist and is the CFBundleExecutable file, after signed the M with codesign, returns with this: signed app bundle with Mach-O thin (arm64) [CFBundleIdentifier]; otherwise, the N signed with codesign in the same way, returned with this: signed Mach-O thin (arm64) [N]. And I installed the APP on my machine, when I clicked the M executable file, seems it passed the gatekeeper, but I clicked the N, seems the gatekeeper check fails. I am not sure it's the reason.

And after I tried to sign the dmg file, the command spctl -a -t open -vvv --context context:primary-signatue ***.dmg status is accepted, but after the dmg installed on the machine, it still failed with the gatekeeper. spctl -a -t open --context context:primary-signature -vvv aaa.dmg aaa.dmg: accepted source=Notarized Developer ID origin=Developer ID Application: ***