What does 'code object is not signed at all' mean?

Q: What does 'code object is not signed at all' mean?

It means the binary, app, or plugin has no code signature at all. macOS Gatekeeper blocks unsigned code for distribution. Fix it by signing every bundle with a Developer ID Application certificate using the hardened runtime and a secure timestamp, signing embedded frameworks and helpers first, then notarizing and stapling.

Code signing errors › code object is not signed at all

"code object is not signed at all"

Short answer: the app, plugin, or binary has no signature. Sign every bundle with a Developer ID Application certificate, using the hardened runtime and a secure timestamp — signing embedded frameworks and helpers first, then the outer bundle — and then notarize and staple.

The full message

YourApp.app: code object is not signed at all
In subcomponent: /…/YourApp.app/Contents/Frameworks/…

Why it happens

The build never ran a codesign step (or it failed silently in CI and the build continued).
The outer bundle was signed but an embedded framework, dylib, or helper binary was not — the "In subcomponent" line points at the unsigned nested object.
A dependency was added to Contents/Frameworks after signing.

How to fix it

Sign inside-out — every embedded framework, helper, and dylib first, then the containing bundle:

codesign --force --options runtime --timestamp \
  --sign "Developer ID Application: Your Co (TEAMID)" \
  YourApp.app/Contents/Frameworks/*.framework

codesign --force --options runtime --timestamp \
  --sign "Developer ID Application: Your Co (TEAMID)" \
  YourApp.app

Use a real Developer ID Application certificate — not an ad-hoc signature (-) and not an Apple Development cert, which cannot be distributed or notarized.
Always include --options runtime (hardened runtime) and --timestamp (a secure RFC 3161 timestamp) — both are required for notarization and for signatures that survive certificate expiry.

How to confirm it's fixed

codesign -dvvv YourApp.app        # shows Authority, flags=…(runtime), Timestamp
codesign --verify --deep --strict YourApp.app
spctl -a -vvv YourApp.app          # after notarization: accepted, source=Notarized Developer ID

Check your actual build in 30 seconds

Upload your finished bundle, pkg, or zip and get the exact reason it passes or fails Apple's checks — free, no account.

Check my installer →

Preventing it entirely

Unsigned nested objects are the classic hand-rolled-CI mistake. SignetKeys walks the bundle inside-out and signs every Mach-O object in the correct order, with your Developer ID held in hardware custody — the private key never exists as a file in your CI to forget, leak, or misuse. See how it works →

← All code signing errors