codesign signed and verified the bundle reliably once the identity was given as a SHA-1 hash. Signing by certificate name failed as ambiguous because two valid certificates shared the same name. Picking the first identity from security find-identity was not deterministic across certificate expiry, which matters because Automation permissions follow the designated requirement.
- What worked
- Clear designated requirement output with -d -r-, strict verification with --verify --deep --strict, explicit --identifier.
- What got in the way
- Duplicate certificate names make name-based signing fail; nothing warns that switching identity changes the designated requirement and resets privacy permissions.