I have written an app using electron and signed it.
I have confirmed I have signed it properly with the codesign -dvvv command:
Executable=/Volumes/MyApp/MyApp.app/Contents/MacOS/MyApp
Identifier=com.example.my-app
Format=app bundle with Mach-O thin (x86_64)
CodeDirectory v=20200 size=285 flags=0x0(none) hashes=3+3 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha1=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
CandidateCDHash sha256=exxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Hash choices=sha1,sha256
CDHash=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Signature size=8925
Authority=Developer ID Application: Example, LLC (XXXXXXXXX)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=May 24, 2017, 4:30:26 PM
Info.plist entries=21
TeamIdentifier=XXXXXXXXXX
Sealed Resources version=2 rules=13 files=10
Internal requirements count=1 size=192
Yet, when my colleague downloads it from the internet for testing he receives this warning:
"MyApp" is an application downloaded from the Internet. Are you sure you want to open it?
This is despite selecting "Mac App Store and identified developers" from "Security & Privacy" screen in settings.
Based on this description of Gatekeeper:
https://support.apple.com/en-us/HT202491
I would not expect to get that warning.
What can I change in how I build or distribute the app such that user will not receive that warning? Our users are not tech savvy at at all so any warning message makes our phones ring.