Notarization requirements for casks using disk images

[rlpvin]

Output of brew config

HOMEBREW_VERSION: 4.4.17-20-g55475cb
ORIGIN: https://github.com/Homebrew/brew
HEAD: 55475cb11a0ebda03c7a4dce19db52b748cd5db3
Last commit: 4 hours ago
Branch: master
Core tap HEAD: 581c519e154f91554cddc1da4942b851bb187c00
Core tap last commit: 6 hours ago
Core tap JSON: 22 Jan 12:55 UTC
Core cask tap HEAD: 7d912decad6f3537db27664aed73b63e503300df
Core cask tap last commit: 8 hours ago
Core cask tap JSON: 22 Jan 12:55 UTC
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_EDITOR: /Applications/Sublime Text.app/Contents/SharedSupport/bin/subl
HOMEBREW_MAKE_JOBS: 10
HOMEBREW_SORBET_RUNTIME: set
Homebrew Ruby: 3.3.7 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/3.3.7/bin/ruby
CPU: deca-core 64-bit arm_firestorm_icestorm
Clang: 16.0.0 build 1600
Git: 2.48.1 => /opt/homebrew/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 14.6.1-arm64
CLT: 16.0.0.0.1.1724870825
Xcode: 16.2
Rosetta 2: false

Output of brew doctor

Warning: Some taps are not on the default git origin branch and may not receive
updates. If this is a surprise to you, check out the default branch with:
  git -C $(brew --repo rlpvin/audio) checkout

Description of issue

I have written a cask for a VST plugin that uses a .pkg installer. The cask has been rejected before because the package wasn't notarized. However, I think now it is?

I checked notarization by running:

spctl --assess --type install -vvv ./ValhallaSupermassiveOSX.pkg

Output:

ValhallaSupermassiveOSX.pkg: accepted
source=Notarized Developer ID
origin=Developer ID Installer: Valhalla DSP, LLC (8MV85B4Z2E)

Previously, the .pkg file was contained within a .zip, but is now within a .dmg file. Before submitting a new PR, I thought it would be better to make sure whether the .dmg file needs to be notarized as well in order for the cask to be acceptable.

[p-linnane]

Try running brew audit --cask --new $foo where $foo is your cask name. It should emit an error if it's not properly signed.

[rlpvin]

Sounds good, thank you!