Merge pull request #20300 from Homebrew/codesign-audit-update

cask/audit: refine codesign audits

Author: bevanjkay

Library/Homebrew/cask/audit.rb

@@ -510,12 +510,17 @@ def audit_signing
           when Artifact::Pkg
             system_command("spctl", args: ["--assess", "--type", "install", path], print_stderr: false)
           when Artifact::App
-            system_command("spctl", args: ["--assess", "--type", "execute", path], print_stderr: false)
+            if which("syspolicy_check")
+              system_command("syspolicy_check", args: ["distribution", path], print_stderr: false)
+            else
+              system_command("spctl", args: ["--assess", "--type", "execute", path], print_stderr: false)
+            end
           when Artifact::Binary
             # Shell scripts cannot be signed, so we skip them
             next if path.text_executable?
 
-            system_command("codesign",  args: ["--verify", path], print_stderr: false)
+            system_command("codesign",  args:         ["--verify", "-R=notarized", "--check-notarization", path],
+                                        print_stderr: false)
           else
             add_error "Unknown artifact type: #{artifact.class}", location: url.location
           end