I just want to check if a downloaded installer is safe to open.+
Use DMGKit Inspector (free). It tells you who signed it, whether Apple notarized it, whether Gatekeeper accepts it and, for PKG installers, whether it runs scripts with system-level commands. No tool can promise a file is harmless; Inspector shows you the evidence Apple’s own tools report.
I’m a developer and I want a beautiful, signed, notarized DMG.+
Use DMGKit. Design the window, export, and DMGKit signs, notarizes, staples and checks everything.
I release from a script or a CI server.+
Use CLIKit (free). Design once in DMGKit (optional), save the template next to your app, and run clikit start in your pipeline. The DMG matches the one DMGKit would make, without Finder or a logged-in desktop.
Do I need DMGKit to use CLIKit?+
No. CLIKit works on its own and builds DMGs in the standard DMGKit style. You only need DMGKit to design custom backgrounds (templates) or to install CLIKit from its Settings.
Do I need Inspector if I have DMGKit?+
No. DMGKit includes the same checks on its Reports screen, plus Kit to explain them. Inspector is for people who only want the checks, or want them one click away in the menu bar.
Can I make a PKG instead of a DMG?+
Yes, in DMGKit (DMG / PKG switch) and CLIKit (--format pkg). Both add your license agreement and can sign, notarize and staple it.
Can I notarize a DMG or PKG I already have?+
Yes. Import it into DMGKit, or run clikit notarize file.dmg.
Where are my passwords stored?+
Nowhere in DMGKit or CLIKit. Notarization uses a notarytool keychain profile (stored by macOS in your keychain) or an App Store Connect API key (.p8 file). DMGKit keeps its copy of the key in a private folder that only your user account can read.
Can I notarize with an App Store Connect API key instead of an Apple ID?+
Yes, in both DMGKit and CLIKit. It’s handy for teams and shared build Macs, because no Apple ID or app-specific password is involved.
Can I release straight from Xcode?+
Yes. DMGKit’s Settings > CLIKit > Xcode Archive Action gives you a script for Xcode’s Archive post-actions. After every Archive, CLIKit makes the DMG or PKG, signs, notarizes and staples it.
Which compression should I pick?+
Keep zlib if your users might be on very old Macs. LZFSE makes smaller DMGs that open faster and works on macOS 10.11 or later, so it suits almost everyone today. LZMA is the smallest, but it takes longer to build and open, and needs macOS 10.15 or later.
Can I see what permissions an app asks for before installing it?+
Yes. DMGKit Inspector, DMGKit’s Reports screen and clikit inspect list the app’s entitlements and warn about ones that relax macOS security.
Does it work with Electron, Tauri, Python or other non-Xcode apps?+
Yes. DMGKit and CLIKit work with any macOS .app bundle.
Does it work offline?+
Designing, building and inspecting work offline. Signing needs Apple’s timestamp server, and notarization needs Apple’s notary service. Kit works offline once its model is available.
Which macOS do I need?+
DMGKit: macOS 15 or later. CLIKit and Inspector: macOS 14.6 or later. The modern disk image tools option needs macOS 27.
