Permission denied GateKeeper warnings in the terminal when running macOS CLI tool even after signing and notarizing

Question

I've been trying to get my CLI tool running without any GateKeeper UI's showing up, which makes the experience more annoying for users.

Answer 1

I finally realized what I was missing. I need a Info.plist embedded inside the binary, which is installed by the .pkg installer. This is because macOS GateKeeper looks for that when it launches the binary. I had to do 3 things:

• create an Info.plist somewhere in your project (I recommend the root of the project) which has at least 3 items, CFBundleIdentifier, CFBundleName, and CFBundleShortVersionString. I took this requirement from Howard Oakley's blog post

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>CFBundleIdentifier</key>
    <string>com.example.example-cli-tool</string>
    <key>CFBundleName</key>
    <string>Example CLI Tool</string>
    <key>CFBundleShortVersionString</key>
    <string>1</string>
</dict>
</plist>

• Reference this Info.plist in the build settings: Set Info.plist File to the path, for example $(PROJECT_DIR)/Info.plist
• In Build Settings, I had to set Create Info.plist Section in Binary to Yes.

Then after I archived the project, build the package installer, downloaded it onto my machine, installed the package, I had no permission denied/ GateKeeper warnings.

---

I posted step by step actions to get an Xcode CLI project built and shipped, including notarization here.