And after I tried to sign the dmg file, the command spctl -a -t open -vvv --context context:primary-signatue ***.dmg status is accepted, but after the dmg installed on the machine, it still failed with the gatekeeper.
spctl -a -t open --context context:primary-signature -vvv aaa.dmg
aaa.dmg: accepted
source=Notarized Developer ID
origin=Developer ID Application: ***
Topic:
Code Signing
SubTopic:
Notarization
Tags: