The correct place to report it is feedbackassistant.apple.com
Post
Replies
Boosts
Views
Activity
Always call codesign with the SHA-1 hash of the valid certificate
# List valid code signing certs
security find-identity -v -p codesigning
# Sign with a specific certificate
codesign -s <sha-1> -f binary
The other thing to check is to make sure the keychain that certificate in is unlocked.
# Get the path to the keychain
security list-keychains
# Unlock the keychain
security unlock-keychain -p <password> /path/to/keychain