title: Create signed and notified MacOS installer for .net core console app
body: <p>I have read heaps of advice and related problems, but haven't stumbled upon exact one that troubles me. The problem is straightforward: I have a console app written in .Net Core 3.1, which I would like to distribute to MacOS, among others. Hence, I need an installer. Ideally, the whole process shall be script-based, no clicking. Yep, CI. My steps:</p>
  <ol>
  <li><code>dotnet publish -c Release -r osx-x64</code> (when done on Windows, I add the <code>chmod +x</code> to allow execution - no caveat here)</li>
  <li>pack the whole <code>bin/Release/osx-x64/publish</code> directory into an <code>.app</code> file (using Platypus for now just to make sure the whole <code>.app</code> thing is valid). At this point, clicking on the app actually runs it as expected (apart from the Untrusted developer warning).</li>
  <li>I have a valid 3rd Party Mac Developer Application certificate, which I use to sign the <code>.app</code> and all files within (using a simple script). My entitlements are scarce (basically just the ones <a href="https://docs.microsoft.com/en-us/dotnet/core/install/macos-notarization-issues" rel="nofollow noreferrer">listed in Microsoft documentation</a>).</li>
  <li><code>codesign -vvv --deep-verify MyApp.app</code> returns nice <code>valid on disk</code> and <code>satisfies its Designated Requirements</code></li>
  <li>Another script then compresses the <code>.app</code> into a <code>.zip</code> archive and uploads it for notarization, which fails. Reason: <code>Invalid package</code>. Running <code>spctl -vvv --assess --type exec MyApp.app</code> returns <code>rejected</code>, so no surprise.</li>
  </ol>
  <p>I have learnt that Invalid package may mean almost anything, as it just don't passes a whitelist of allowed stuff and it is not really possible to indicate where it got wrong (would have to list a rejection reason for each and every rule).</p>
  <p>It might be insufficient set of entitlements, as my list only contains the 'default' values per MS documentation. However, I have also tried to create a simple <code>Hello world</code> console app to minimize anything going on inside - and sure, <code>Invalid package</code>. So it shouldn't be that my app is trying to do something that is not listed in the entitlements.</p>
  <p>Which leaves us for... <strong>Hardened Runtime is not enabled?</strong> I haven't found any explicit way to enable it in .net core console app (the only reference was for Xamarin.Mac, which is not applicable here IMO). Neither a way to verify that this is the problem indeed. But I don't expect MS to put so much effort into making .net core cross-platform and then throwing it all away just because Apple mandates Hardened Runtime.</p>
  <p>I have tried building on both Windows and Mac, no help. My &quot;Mac&quot; is 10.15 Catalina in a VM (could this be an issue?).</p>
  <p>Can anyone please help me, set me on a correct path or show me some piece of documentation I have been missing? I cannot believe that it is impossible.</p>
  <p>Thank you.</p>