GateKeeper refues to allow execution of notarized and stapled app on MacOS - macos

Question

We have developed a small test .app with C code that loads (dlopen()) a simple one function dylib library (the dylib file is included in the app Contents under /Contents/Frameworks/), which printf's two text lines to a text file in /tmp/ using xcode 12.
The app (and dylib inside) was signed using provisioning profile that is tied with Developer ID based certificate. App's runtime is hardened, signed, notarized and stapled correctly for Developer ID (to be published on our website) by Xcode archiving/exporting tool's UI.
We verified that it works on our build machine by placing it under /Applications/loadtest.app and executing it by double click ( /tmp/loadtest.log is created and entries are printed correctly. )
Once we download it on another macbook (running with osx 11.4), it will not exeute (getting "You do not have permission to open the application" message from the GateKeeper), and will crash with "Termination Reason: Namespace CODESIGNING, Code 0x1" (see full crash dump below).
Checking with spctl on the new macbook:
spctl -a -t exec -v /Applications/loadtest.app:
"/Applications/loadtest.app: accepted
source=Notarized Developer ID"
We have tried changing the permissions and attributes of the app (found few hints for this on the internet), but it does not help. Someone suggested to restart the machine (to allow it to re-concile Apple's notarization services and download the latest stapling "tickets"), which also didn't help.
If we disable SIP on that test MacBook, the application now runs, not before we get a warning about "unknown publisher" from the gatekeeper and allowing it, but we need our apps to run with SIP enabled.
Does anyone have any hint or suggestion? We contacted Apple, but havn't recieved any answer from them since.
...
Crash dump:
rocess: loadtest [582]
Path: /Applications/loadtest.app/Contents/MacOS/loadtest
Identifier: loadtest
Version: ???
Code Type: X86-64 (Native)
Parent Process: ??? [1]
Responsible: loadtest [582]
User ID: 501
Date/Time: 2021-07-15 12:56:09.913 +0300
OS Version: macOS 11.4 (20F71)
Report Version: 12
Bridge OS Version: 5.4 (18P4663)
Anonymous UUID: FD00A5BA-5166-EC7D-B051-E28BDEE29E95
Time Awake Since Boot: 110 seconds
System Integrity Protection: enabled
Crashed Thread: Unknown
Exception Type: EXC_CRASH (Code Signature Invalid)
Exception Codes: 0x0000000000000000, 0x0000000000000000
Exception Note: EXC_CORPSE_NOTIFY
Termination Reason: Namespace CODESIGNING, Code 0x1
kernel messages:
VM Regions Near 0 (cr2):
-->
mapped file 104a09000-104a0d000 [ 16K] r-x/r-x SM=COW Object_id=a7cdfe2f
Backtrace not available
Unknown thread crashed with X86 Thread State (64-bit):
rax: 0x0000000000000000 rbx: 0x0000000000000000 rcx: 0x0000000000000000 rdx: 0x0000000000000000
rdi: 0x0000000000000000 rsi: 0x0000000000000000 rbp: 0x0000000000000000 rsp: 0x00007ffeeb1f6a88
r8: 0x0000000000000000 r9: 0x0000000000000000 r10: 0x0000000000000000 r11: 0x0000000000000000
r12: 0x0000000000000000 r13: 0x0000000000000000 r14: 0x0000000000000000 r15: 0x0000000000000000
rip: 0x000000010ee38000 rfl: 0x0000000000000200 cr2: 0x0000000000000000
Logical CPU: 0
Error Code: 0x00000000
Trap Number: 0
Unknown thread instruction stream not available.
Unknown thread last branch register state not available.
Binary images description not available
External Modification Summary:
Calls made by other processes targeting this process:
task_for_pid: 0
thread_create: 0
thread_set_state: 0
Calls made by this process:
task_for_pid: 0
thread_create: 0
thread_set_state: 0
Calls made by all processes on this machine:
task_for_pid: 0
thread_create: 0
thread_set_state: 0
VM Region Summary:
Writable regions: Total=8400K written=0K(0%) resident=0K(0%) swapped_out=0K(0%) unallocated=8400K(100%)
VIRTUAL REGION
REGION TYPE SIZE COUNT (non-coalesced)
=========== ======= =======
STACK GUARD 56.0M 1
Stack 8192K 1
VM_ALLOCATE 8K 2
VM_ALLOCATE (reserved) 232K 3 reserved VM address space (unallocated)
mapped file 968K 7
=========== ======= =======
TOTAL 65.2M 14
TOTAL, minus reserved VM space 65.0M 14
Model: MacBookPro16,1, BootROM 1554.120.19.0.0 (iBridge: 18.16.14663.0.0,0), 6 processors, 6-Core Intel Core i7, 2.6 GHz, 16 GB, SMC
Graphics: kHW_IntelUHDGraphics630Item, Intel UHD Graphics 630, spdisplays_builtin
Graphics: kHW_AMDRadeonPro5300MItem, AMD Radeon Pro 5300M, spdisplays_pcie_device, 4 GB
Memory Module: BANK 0/ChannelA-DIMM0, 8 GB, DDR4, 2667 MHz, Micron, 8ATF1G64HZ-2G6E1
Memory Module: BANK 2/ChannelB-DIMM0, 8 GB, DDR4, 2667 MHz, Micron, 8ATF1G64HZ-2G6E1
AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0x7BF), wl0: Feb 16 2021 03:05:58 version 9.30.444.10.32.5.67 FWID 01-3d719d60
Bluetooth: Version 8.0.5d7, 3 services, 25 devices, 1 incoming serial ports
Network Service: USB 10/100/1000 LAN, Ethernet, en7
USB Device: USB3.0 Hub
USB Device: USB 10/100/1000 LAN
USB Device: USB 3.1 Bus
USB Device: USB2.0 Hub
USB Device: Microsoft® Nano Transceiver v1.0
USB Device: USB 2.0 BILLBOARD
USB Device: Apple T2 Bus
USB Device: Composite Device
USB Device: Touch Bar Backlight
USB Device: Touch Bar Display
USB Device: Apple Internal Keyboard / Trackpad
USB Device: Headset
USB Device: Ambient Light Sensor
USB Device: FaceTime HD Camera (Built-in)
USB Device: Apple T2 Controller
Thunderbolt Bus: MacBook Pro, Apple Inc., 63.5
Thunderbolt Bus: MacBook Pro, Apple Inc., 63.5
...