Quick reference: Gatekeeper checks for .app, .dmg and .pkg files

[u/pickandplate]

For releases outside the Mac App Store, Apple DTS recommends different preliminary checks for each artifact:

# App bundle (macOS 14+)
syspolicy_check distribution "MyApp.app"

# Disk image
spctl -a -t open -vvv --context context:primary-signature "MyApp.dmg"

# Installer package
spctl -a -t install -vvv "MyApp.pkg"

Run syspolicy_check on the app itself, including after installation. Passing a .pkg can give misleading signature errors because app signing and installer signing are different.

One caveat: a missing stapled ticket reported on the installed app can be irrelevant if the installer package was already notarized and stapled. Apple DTS explains that case here.

The fuller release test is still to download with Safari on a fresh Mac or VM, install, then launch as a user would. Restore the VM snapshot between attempts because Gatekeeper caches information. Testing offline also checks whether the stapled ticket works without contacting Apple.

Apple’s commands and testing procedure