Fix macOS installer signature validation

[iamfatness]

Summary

• distinguish a valid Developer ID Application signature from an ad-hoc code seal before building a distributable package
• verify the final .pkg certificate chain and require Developer ID Installer
• print useful signature evidence into the build log when macOS rejects an installer

Why

codesign --verify --strict validates the bundle seal, but it can also succeed for an ad-hoc signature. That allowed a Developer ID Installer-signed outer package to contain ad-hoc-signed plugin code, which Gatekeeper can still reject.

Validation

• bash -n scripts/make-macos-installer.sh
• git diff --check

Rebuild on the certificate-equipped Mac

Confirm both identities are installed:

security find-identity -v

Build the bundle with the Application identity, then build and notarize the package with the separate Installer identity. Replace the paths, identity names, version, and notary profile as appropriate:

scripts/make-macos-bundle.sh \
  --build-dir build \
  --zoom-sdk third_party/zoom-sdk \
  --obs-app /Applications/OBS.app \
  --sign "Developer ID Application: YOUR NAME (TEAMID)"

scripts/make-macos-installer.sh \
  --bundle build/obs-zoom-plugin.plugin \
  --version 0.1.45-beta.1 \
  --out dist \
  --sign "Developer ID Installer: YOUR NAME (TEAMID)" \
  --notarize YOUR_NOTARYTOOL_PROFILE

Final verification:

pkgutil --check-signature dist/CoreVideo-Setup-0.1.45-beta.1.pkg
spctl --assess -vv -t install dist/CoreVideo-Setup-0.1.45-beta.1.pkg
xcrun stapler validate dist/CoreVideo-Setup-0.1.45-beta.1.pkg

Expected Gatekeeper result: accepted and source=Notarized Developer ID.