As I was reading https://lokal.so/blog/guide-to-sign-and-notarize-your-go-app-for-outside-mac-app-store-distribution I noticed that they notarize the installer .pkg. We currently notarize the contents, and hadn't considered notarizing the .pkg itself. Not sure what's necessary here but wanted to call it out.

There's also some stapling step which I've never seen before.

As part of this work, the GitHub CLI website should be updated, directing users to download the Mac universal binary

https://developer.apple.com/news/?id=saqachfa

Updates to runtime protection in macOS Sequoia
August 6, 2024
…
If you distribute software outside of the Mac App Store, we recommend that you submit your software to be notarized.

There's also some stapling step which I've never seen before.

Stapling is worthwhile, it attaches the notarization receipt to the package so that it's available even during offline validation.

There's no need to notarize a package's contents separately, it can all be done in one pass (see here).

You can authenticate to the notarization service either using an API key or an app-specific password. You can create an app-specific password through the Apple ID settings page for the account used to submit the notarization (docs).

Here's an example using an app-specific password:

productsign \
    --sign "$DEVELOPER_ID_INSTALLER_CERTIFICATE" \
    unsigned.pkg \
    stapled.pkg

xcrun notarytool submit \
    --wait \
    --apple-id $APPLE_ID \
    --team-id $TEAM_ID \
    --password $APP_SPECIFIC_PASSWORD \
    stapled.pkg

xcrun stapler staple stapled.pkg