verify resulted dmg again using codesign --verify --verbose=4 <yourapp.dmg> you can also verify with gatekeeper spctl -a -t exec -vv <yourapp.dmg>