I use productsign to sign packages for distribution outside the App Store. Everything worked fine until Beta 5 and then it started being inconsistent--I couldn't figure out a pattern to when they worked and when they got the "unidentified developer" message. Sometimes they worked, sometimes they didn't. With the September 9 GM Candidate, though, they're absolutely consistent. I download the installer, click it, get the "unidentified developer" message, click the same downloaded installer a second time, and it works. My installers pass the spctl test with no problem (I use --raw to be sure I get the complete info), so it seems like there shouldn't be a problem in the real world. Unsigned installers don't work no matter how many times I try them, so it looks like Gatekeeper just has to think about my signed installers before it decides they're OK, which makes no sense. It should either approve them or not. I am still using PackageMaker because it's continued to work fine for me, but maybe that's part of the problem now?