Reply to The signature of the binary is invalid but codesign says otherwise Answer from Bruji solved my problem. Thank you. But there is a small mistake in the command. There should be two dashes -- (minus symbols) in front of sequesterRsrc /usr/bin/ditto -c -k --sequesterRsrc --keepParent "$APP_PATH" "$ZIP_PATH" Code Signing General Sep ’20