macOS v1.4.0 ARM DMG contains app bundle with invalid code signature

Hi, I downloaded the official macOS ARM DMG from the v1.4.0 release and verified that the downloaded DMG matches the SHA-256 digest published in the GitHub release asset metadata.

However, the app bundle inside the DMG fails macOS code signature verification.

Environment

• macOS: local Apple Silicon Mac
• Architecture: arm64
• Release: v1.4.0
• Asset: Openscreen-mac-installer.dmg
• Asset URL: https://github.com/siddharthvaddem/openscreen/releases/download/v1.4.0/Openscreen-mac-installer.dmg

Steps to reproduce

curl -L -o /tmp/Openscreen-mac-installer.dmg \
  https://github.com/siddharthvaddem/openscreen/releases/download/v1.4.0/Openscreen-mac-installer.dmg

shasum -a 256 /tmp/Openscreen-mac-installer.dmg
# 0914ac10d9c1c0ef143eb8bbca7c3491f253e965b6312bbddeb9bfd1c3ee3122

hdiutil attach /tmp/Openscreen-mac-installer.dmg -nobrowse

codesign --verify --deep --strict --verbose=2 /Volumes/Openscreen/Openscreen.app

Actual result

/Volumes/Openscreen/Openscreen.app: invalid signature (code or signature have been modified)
In architecture: arm64

Additional signature details:

codesign -dv --verbose=4 /Volumes/Openscreen/Openscreen.app

Relevant output:

Authority=(unavailable)
Info.plist=not bound
TeamIdentifier=N26FZ4GW28

After copying the app to /Applications, Gatekeeper assessment also fails on the installed app:

spctl --assess --type execute --verbose /Applications/Openscreen.app

/Applications/Openscreen.app: internal error in Code Signing subsystem

Expected result

The app bundle in the official macOS DMG should pass code signature verification, especially because the v1.4.0 release notes mention that the app is notarized.

Why this matters

This may cause Gatekeeper warnings or require users to bypass macOS security controls. It also makes it harder for users to verify the integrity and trust chain of the official macOS release artifact.

Could you please check whether the v1.4.0 macOS ARM release asset was signed/notarized/stapled correctly?