Shipping a JUCE plugin on macOS means the same ceremony every release: sign inside-out, hardened runtime, secure timestamp, notarize, staple, and hope spctl is happy on a clean machine. SignetKeys' free checker tells you exactly where a build stands.

Drop in a finished .pkg, .dmg, or a zip of your .vst3/.component bundles. It runs the full battery (codesign, spctl, pkgutil) together — not just codesign --verify, which happily passes ad-hoc and un-notarized builds that then fail at the user's Gatekeeper — and reports each ship-blocking issue with the fix:

• signed vs unsigned (including unsigned embedded frameworks)
• hardened runtime / secure timestamp present
• notarized and stapled — and stapled to the bundles, not the zip
• Developer ID Application vs Installer cert mix-ups on .pkg

Plus a plain-English reference for the specific error strings: signetkeys.com/errors

Run a check: signetkeys.com/diagnose

Free, no account, nothing stored past the check.

SignetKeys also offers a paid service that removes signing from your CI entirely — your Developer ID lives on a hardware token we custody and your pipeline holds zero secrets — but the checker above is free and useful on its own.