Apple's notary service rejects ad-hoc-signed nested executables. The
bundled pg_dump/pg_restore/psql + libpq and mariadb/mariadb-dump +
OpenSSL dylibs must be signed with the Developer ID Application
certificate, with hardened runtime (--options runtime) and a secure
timestamp (--timestamp).
Move the signing-identity detection before the tool builds and sign the
tools with $SIGNING_IDENTITY instead of ad-hoc.
adrianbonpin