Notarized app not from 'identified developer' on Big Sur

Are there new restrictions on entitlements or notarization in Big Sur?

We distribute our macOs app notarized without using the app store. When running an app on a fresh Catalina machine it runs fine, but in the Big Sur public beta the user sees an error that the App ' was blocked from use because it is not from an identified developer'. Running scripts on the device confirms that the .dmg is in fact signed by our company. We have no such issues on Catalina.

Gatekeeper settings allow apps from 'App Store and identified developers'

Because our app based on the Electron framework we have the following entitlements enabled.
   <key>com.apple.security.cs.allow-jit</key><true/>
  <key>com.apple.security.cs.allow-unsigned-executable-memory</key><true/>
Check console logs when you run the app. This can happen when you have something funky going on trying to load dylibs. And unfortunately, Electron generates such problems on a regular basis.
Hmmm... I checked and I'm not seeing any console log errors.
I run 'spctl -a -vv -t install <appname>' to verify the app and and it shows the app is properly signed and notarized

I checked and I'm not seeing any console log errors.

Unfortunately it can be quite hard to spot these errors. I posted some hints here.

I run spctl -a -vv -t install <appname> to verify the app and and it
shows the app is properly signed and notarized

Unfortunately that’s not definitive. This command gives you a high-level summary of whether we’ll even think about running the app based on the current system policy, but there are numerous circumstances where Gatekeeper will reject your app after it’s passed that check.

My experience is that these problems are most often caused by code signing issues within your app (this is especially true when you use ‘foreign’ third-party development environments). If you can’t find any hints in the system log, I recommend that you review your code signing based on the advice in Signing a Mac Product For Distribution.

If you still can’t figure it out, you should open a DTS tech support incident about this. While DTS doesn’t support pre-release software, and that includes the current 11.0 beta, it’s likely that there are signs of this problem that show up even on earlier systems.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@apple.com"

Hmmm... I checked and I'm not seeing any console log errors.
I run 'spctl -a -vv -t install <appname>' to verify the app and and it shows the app is properly signed and notarized

Then it is almost certainly a runtime problem. Using console is quite tricky. You have to be fast on the keyboard.

Launch Console.app. Recent (beta?) versions may have a button to "start streaming". Otherwise it will fire right up with thousands of messages per second.

Get your app ready to run. Have it sitting in a Finder window ready for a double-click, but hold off. If Console is already streaming, then click the clear button to erase the window. Otherwise, click the "start streaming" button.

Then, just as fast as you possibly can, launch your app. When it dies, just as fast as you possibly can, go back to Console.app and stop streaming, if possible. If not, make note of the time so that you can stop reading at that point. You will need to scroll up to the top. If you can't stop the streaming, Console will take about 100% of your CPU and wind up your fans. Nothing you can do about that. Search for your app. That entry may not be interesting. You may need to read line by line for a meaningful error message. There will be thousands, if not tens of thousands of log messages. The error message may be not from your app. I did this for one person who posted a download URL. It isn't that hard once you get used to it. I don't remember what the message was in that case.




You have to be fast on the keyboard.

It’s easier to use log collect for this. See the post I referenced earlier for info on the process I use.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@apple.com"
Good morning rolfro2!

Could you solve this problem? The same thing is happening to us, We already updated electron and electron-builder but it keeps showing that warning even while the dmg is notarized. It is only shown on Big Sur.

Regards.
Notarized app not from 'identified developer' on Big Sur
 
 
Q