Why does spctl say 'the code is valid but does not seem to be an app'?

The bundle is signed correctly, but Gatekeeper can't classify it as an application because its Info.plist is missing required keys — most often CFBundlePackageType (APPL) and CFBundleExecutable. Add the keys, re-sign, and spctl -a -t exec will accept it. Assessing a non-app with the exec type also triggers this.

Code signing errors › does not seem to be an app

"the code is valid but does not seem to be an app"

Short answer: the signature is fine, but Gatekeeper can't classify the bundle as an application — usually because its Info.plist is missing CFBundlePackageType (APPL) or CFBundleExecutable. Add the keys, re-sign, and re-check. This can also appear if you assess a non-app bundle (a plugin or a plain folder) with spctl -t exec.

The full message

YourApp.app: rejected
source=Notarized Developer ID
override=security disabled
the code is valid but does not seem to be an app

Why it happens

The app's Info.plist lacks CFBundlePackageType = APPL and/or CFBundleExecutable, so Gatekeeper won't treat it as an application. Common with hand-assembled or tool-generated bundles.
Missing version keys (CFBundleShortVersionString, CFBundleVersion) can contribute.
You ran spctl -a -t exec on something that isn't an app — a .vst3/.component plugin or a bare binary. Plugins are validated differently; they don't launch as apps.

How to fix it

Ensure the app's Contents/Info.plist has the core keys:

/usr/libexec/PlistBuddy -c "Add :CFBundlePackageType string APPL" \
  YourApp.app/Contents/Info.plist
/usr/libexec/PlistBuddy -c "Add :CFBundleExecutable string YourApp" \
  YourApp.app/Contents/Info.plist
# also ensure CFBundleIdentifier + version keys are present

Re-sign after editing the plist (editing it breaks the seal):

codesign --force --options runtime --timestamp \
  --sign "Developer ID Application: Your Co (TEAMID)" YourApp.app

For a plugin, don't assess it as an executable. Verify the signature and notarization instead:

codesign --verify --strict YourPlugin.vst3
spctl -a -vvv -t install YourInstaller.pkg   # validate the delivery vehicle

How to confirm it's fixed

spctl -a -vvv -t exec YourApp.app
# expect: accepted, source=Notarized Developer ID

Not sure if it's a plist or a plugin issue?

Upload your build — the free checker tells you exactly what Gatekeeper sees and what to change.

Check my installer →

Preventing it entirely

This one bites hand-assembled bundles and mixed app/plugin releases. SignetKeys verifies each artifact with the right check for its type — apps, plugins, and installers — and runs the full sign → notarize → staple → verify sequence so you find classification problems before your users do. See how it works →

← All code signing errors