macOS code signing & notarization errors
A plain-English reference for the exact errors developers hit when signing and notarizing macOS apps, installers, and audio plugins (VST3/AU/AAX). Each page explains what the message means, why it happens, and how to fix it — with the commands to confirm the fix worked.
Not sure which error is yours?
Upload your finished .pkg, .dmg, or a zip of
your plugins and get the exact reason it passes or fails Apple's checks —
free, no account, nothing stored past the check.
Signing errors
- "code object is not signed at all" The bundle has no signature — Gatekeeper blocks it everywhere.
- "a sealed resource is missing or invalid" The bundle was changed after it was signed, breaking the seal.
- "the code is valid but does not seem to be an app" Gatekeeper won't classify the bundle as an app — usually a missing Info.plist key.
Notarization errors
- "The executable does not have the hardened runtime enabled" Apple's notary service refuses binaries without the hardened runtime.
- "Apple cannot check it for malicious software" The end-user Gatekeeper message when an app is signed but not notarized (or not stapled).
Why these keep happening
Almost every failure above comes from hand-rolling the signing steps in CI: a flag forgotten, a file touched after signing, a step run in the wrong order, or a build that was signed but never notarized. The SignetKeys pipeline runs the whole inside-out walk — sign, timestamp, harden, notarize, staple, verify — as one correct sequence, with your Developer ID held in hardware custody and zero secrets in your CI. See how it works →