I'm trying to notarise a command line tool (DuckDB) so people can download it from the web, double-click on it and it opens in Terminal.app just like it does locally.
However, despite signing and notarising properly (I think) I cannot get the dialog where "open" is allowed, saying that it cannot be opened because "the identity of the developer cannot be confirmed".
Here's what I'm doing: We start with a "raw" universal binary (called duckdb), pretty much what is in this file: https://github.com/duckdb/duckdb/releases/download/v0.7.1/duckdb_cli-osx-universal.zip
I code-sign this like so:
codesign --all-architectures --force --options runtime --sign "..." duckdb`
This seems to work:
codesign --verify -v duckdb
bin/duckdb: valid on disk
bin/duckdb: satisfies its Designated Requirement
Then, I create a ZIP archive and submit the binary for notarisation
zip -j duckdb.zip duckdb
xcrun notarytool submit --apple-id [...] --team-id[...] --keychain-profile [...] --wait --progress duckdb.zip
This succeeds with status "Accepted".
The notarization seems to have worked
codesign -vvvv -R="notarized" --check-notarization duckdb
duckdb: valid on disk
duckdb: satisfies its Designated Requirement
duckdb: explicit requirement satisfied
Because I cannot staple the notarization to a ZIP file or a binary (I think), I am creating a DMG with the binary in it, sign it, notarise it again, and then staple the new notarisation (the one from the DMG) to that.
But alas, when I download that DMG onto another computer, I still get the issue about the identity.
Any ideas here? Is it just not possible to notarise a "raw" command line tool that opens in Terminal?