For macOS packaging, the pkg and the app bundle/binary are validly codesign-ed and notarized, gatekeeper doesn't complain (

spctl

accepts it) on a fresh VM