As a follow‑up for anyone hitting the same issue: Per Quinn’s advice, I switched to manual signing outside Xcode and followed the “Exporting a Developer ID Network Extension” guidance. The code signing / notarization side now looks correct and works locally: Host app and DNS Proxy system extension are both signed with Developer ID Application for our team (for example, TEAMID1234). com.apple.developer.networking.networkextension in both host and system extension entitlements uses `dns-proxy-systemextension. The app bundle identifier is com.myapp.agent.MyProxy. The installer pkg is signed with Developer ID Installer: MyApp Inc (TEAMID1234), notarized with notarytool (status: Accepted), stapled, and passes `pkgutil --check-signature. On the test Mac (macOS 14.4, Apple Silicon), sudo installer -pkg MyProxy_…pkg -target / succeeds, the app appears in/Applications, and spctl --assess -vvv -t exec reportssource=Notarized Developer ID`. The app launches and the DNS Proxy system extension runs (any
Topic:
App & System Services
SubTopic:
Networking
Tags: