Troubleshooting the wrapper package deployment

This section lists the symptoms most commonly encountered when building and deploying the wrapper package, and how to resolve them.

Symptom	Likely cause	Resolution
`zsh: event not found: /bin/bash`	A multi-line script, including its `#!/bin/bash` shebang, was pasted directly into an interactive zsh prompt. The zsh history expansion misreads `!`.	Write the script into a file first, for example using `nano`, or use a quoted heredoc: `cat > file << 'EOF' ... EOF`.
Terminal stuck showing `heredoc>` indefinitely	The heredoc's closing delimiter does not exactly match the opening one, often because of smart quotes auto-inserted by the source application instead of straight quotes.	Press Control+C or Control+D to cancel, then re-enter the command using `nano` instead of a heredoc to avoid quote-matching issues entirely.
Package installs manually using Terminal but fails silently when deployed through Intune	The package is not signed with a Developer ID Installer certificate, or notarization is missing, so the MDM install channel rejects it even though a local Terminal install bypasses that check.	Sign the package using `productsign` with a valid Developer ID Installer certificate, then notarize and staple it before uploading to Intune.
`pkgutil --check-signature` reports `Status: no signature`	The package was never signed, or the signing step did not complete successfully.	Re-run `productsign` with the correct certificate name, confirming the exact string with `security find-identity -v -p basic`, and then re-check.
`no identity found`	The certificate is not installed in the Keychain of this macOS endpoint, or the identity string does not match exactly.	Run `security find-identity -v -p basic` and copy the quoted string exactly as printed into the signing command.
`notarytool submit` reports `Invalid credentials` or HTTP 401	The app-specific password has expired or been revoked, or the Team ID contains a typo.	Generate a new app-specific password, then re-run `xcrun notarytool store-credentials "Notarytool"`.
Notarization status comes back `Invalid`	Apple's automated scan found a problem, commonly an unsigned nested binary inside the package payload, or a missing hardened runtime entitlement.	Run `xcrun notarytool log <submission-id> --keychain-profile "Notarytool"` and correct what the log reports.
`spctl` reports `rejected` with `source=Unnotarized Developer ID`	The package is signed, but Apple never notarized it, or notarization was rejected.	Repeat the notarization and stapling steps, and check the notarization log if it fails again.
`stapler` reports `Error 65` or `no ticket` immediately after a successful notarization	A timing issue. The ticket had not yet fully propagated on Apple's side.	Wait a minute, then run `xcrun stapler staple` against the package on its own.
All local checks pass, but Intune installs still fail	At that point this is usually not a signing problem.	Check the Intune install and detection logic, and the device enrollment logs, separately. Signing problems surface in the local checks, not here.

Warning: Never disable Gatekeeper, for example with spctl --master-disable, and never bypass the signing checks to force an unsigned or unnotarized package through. Doing so removes a security control across the whole fleet and only masks the underlying problem, which then resurfaces as an unpredictable install failure on some subset of devices.