I have a simple question, but I could not find an exhaustive answer. We have an .app that we distribute (download) as a .dmg. We can code-sign and notarise without problems using the Terminal. Everything works fine. However, we have doubts about the right thing that needs to be code signed and notarised: the app, the image or both?
As for now, we followed this:
- .app is code signed and .app is notarised
- notarised .app is inserted in .dmg
- the .dmg as it is is loaded to our server for deployment
However, I am not sure this is the right way. Should instead be like this?
- .app is code signed
- code signed .app is inserted in .dmg
- the .dmg is code signed too and notarised, and loaded to server
Or even: + .app is code signed and .app is notarised + notarised .app is inserted in .dmg + the .dmg is code signed too and notarised, and loaded to server
Thank you for your advice.