Expected Team ID for verifying the Developer ID signature of UTM v5.0.8 (macOS)

[tavozamudio]

Hello,

We are documenting how to verify the authenticity of the official macOS release of UTM before installing it, and we would like an independent reference for the expected code-signing identity.

From the repository we understand that the GitHub release DMG is signed with a Developer ID Application certificate and notarized, using the Team ID stored in the SIGNING_TEAM_ID repository variable (.github/workflows/build.yml, Documentation/Release.md). The Team ID value itself is not published in the repository or documentation.

Could you please confirm:

1. The Apple Developer Team ID associated with the Developer ID Application certificate used to sign the official macOS builds of UTM.
2. Whether that Team ID applies specifically to UTM v5.0.8 as distributed on GitHub (https://github.com/utmapp/UTM/releases/download/v5.0.8/UTM.dmg, SHA-256 7b2d7b2e2a02b3de1757ef19a8f36573e6d9cceae8c8cca0abcbcaa4a852019a).
3. Whether there is (or could be) an official page where this signing identity can be verified in the future.

We are not asking for any certificates, keys, credentials or other private information — only the public Team ID that appears in the signature.

Thank you for your work on UTM.

[osy]

I'm not sure how me telling you a value and you checking that specific value verifies anything. If you want to make sure the build you're getting is correct, check that the binary matches the unsigned artefacts in GitHub actions.