Signed pkg using productbuild --distribute but codesign says "code object is not signed at all"
Use spctl, not codesign

The codesign tool does not work with package files, .pkg.

Use the spctl tool instead:

/usr/sbin/spctl --assess --ignore-cache --verbose --type install &lt;pkg-path&gt;


Alternatively, Installer.app

You can also check the package certificate using Installer.app:


Open the package in macOS's Installer.app;
Click the padlock in the top-right of the installer window.