How to Sign Audio Plugins on macOS with SIP Enabled
Use case: Yamaha/Steinberg plugins (MONTAGE M) in Logic Pro with SIP enabled. Also works for other plugin formats: .component, .vst3, .vst, .clap.

 
Prerequisites
macOS with SIP enabled (no need to disable it)
Xcode installed (free on the App Store)
Apple ID (free account)
 
Step 1 — Create an Apple Development Certificate in Xcode
Open Xcode
Go to Xcode → Settings... (Cmd+,)
Click the Accounts tab → click + → Apple ID
Sign in with your Apple ID
Click Manage Certificates...
Click + → Apple Development
Close Xcode
 
Step 2 — Install the Apple Intermediate Certificate
curl -O https://www.apple.com/certificateauthority/AppleWWDRCAG3.cer
sudo security import ~/AppleWWDRCAG3.cer -k /Library/Keychains/System.keychain

 
Step 3 — Verify Your Certificate
security find-identity -v -p codesigning

You should see something like:

1) XXXXXXXXXXXXXXXX "Apple Development: youremail@gmail.com (XXXXXXXXXX)"

Copy the full name between quotes — you'll use it in the next steps.

 
Step 4 — Sign the Plugins
Replace youremail@gmail.com (XXXXXXXXXX) with your actual certificate name.

function prep() {
  sudo xattr -cr "$1"
  sudo chown -R ${USER} "$1"
  sudo chmod -R 777 "$1"
  sudo codesign --force --deep --sign "Apple Development: youremail@gmail.com (XXXXXXXXXX)" "$1"
}

prep "/Library/Audio/Plug-Ins/Components/Expanded Softsynth Plugin for MONTAGE M.component"
prep "/Library/Audio/Plug-Ins/VST3/Yamaha/Expanded Softsynth Plugin for MONTAGE M.vst3"

 
Step 5 — Sign Apps with Hardened Runtime (if needed)
Some apps like the Steinberg License Engine have extra protections that prevent direct re-signing. Use this copy-sign-replace method instead:

cp -R "/Library/Application Support/Steinberg/Activation Manager/Steinberg License Engine.app" /tmp/
sudo codesign --force --deep --sign "Apple Development: youremail@gmail.com (XXXXXXXXXX)" --timestamp=none /tmp/"Steinberg License Engine.app"
sudo rm -rf "/Library/Application Support/Steinberg/Activation Manager/Steinberg License Engine.app"
sudo mv /tmp/"Steinberg License Engine.app" "/Library/Application Support/Steinberg/Activation Manager/"

And for the license bundle:

prep "/Library/Application Support/Steinberg/Activation Manager/license-engine-access.bundle"

 
Step 6 — Restart and Test
Restart your Mac and open Logic Pro (or your DAW of choice).

 
Adapting for Other Plugins
Replace the paths according to the plugin. Common locations:

Type
Default Path
.component
/Library/Audio/Plug-Ins/Components/
.vst3
/Library/Audio/Plug-Ins/VST3/
.vst
/Library/Audio/Plug-Ins/VST/
.app
/Applications/
 
Common Errors and Solutions
Error
Cause
Solution
0 valid identities found
Certificate not installed
Redo Steps 1 and 2
errSecInternalComponent
Missing intermediate certificate
Install AppleWWDRCAG3.cer (Step 2)
unable to build chain
Incomplete certificate chain
Install AppleWWDRCAG3.cer (Step 2)
Operation not permitted
Hardened Runtime active
Use the copy method (Step 5)
 
Notes
A free Apple Development certificate (via Xcode + Apple ID) is sufficient — no need to pay for a developer account ($99/year)
The certificate expires after 1 year — you will need to repeat this process after it expires
Plugins using the Steinberg Silk licensing system strictly require a legitimate Apple Development certificate — self-signed certificates will cause a crash

I installed it on Mac intel. seems like it has been installed but it doesn't work