[KevinH]

Okay, I tested using a Sigil.dmg and when downloaded from github to my Mac it sure enough had the com.apple.quarantine attribute set.

kbhend@MacBook-Pro Desktop % ls -a@l *.dmg
-rw-r--r--@ 1 kbhend staff 198173869 16 Aug 19:04 Sigil.dmg
com.apple.macl 72
com.apple.metadata:kMDItemDownloadedDate 53
com.apple.metadata:kMDItemWhereFroms 684
com.apple.quarantine 57


but worse yet, after double clicking it and copying the Sigil.app out of it, it too was marked with com.apple.quarantine and it generated that horrid error message even though it was properly signed and notarized.

So using dmg is not going to work either unless I can somehow sign and notarize an entire dmg.

Not something I want to do.