As the security department in my company, we need to design code signing guidance for developers. It seems that the codesigning on MacOS is somewhat different than other platforms.
Some MacOS developers are saying that Apple requires top-down signing. If a product is consuming an internal component, regardless whether the component is already signed, the product team will still need to resign everything.
Is this true? Is there an official Apple document on how developers should code sign their product?