Plugin distribution: DMG install gives Error code 1000 - do I need two factor authentication on my Apple Dev account?

edit: the dmg installer was corrupted when I copied it, so nothing to do with 2FA.

(apologies if this thread is not 100% JUCE related)
I’m distributing my plugins in a .dmg, and signing, notarizing/stapling everything as I should.

However, I tried installing it on a friends Mac who has a later version of the OS and got the Error code 1000

This error may occur if something went wrong when authenticating using Sign in with Apple
Error Code 1000 for Sign in with Apple refers to an unknown error that occurred authenticating your Apple ID. Please make sure that you have Two-Factor authentication enabled for your Apple ID.

Has anyone experienced this? It is because my Apple Dev account doesn’t have two factor, or his personal Apple ID does not?

First off, your Apple ID needs to have two-factor authentication enabled if you have an Apple Developer Program account. You can’t even sign in to Xcode without having two-factor auth enabled these days.

Second, is your plug-in using the Authentication Services framework to let users log in to your services using their Apple ID?

No, I don’t believe so. That privilege would be apparent in the info.plist , correct?
I don’t know if its getting to the “plugin stage”, its invoking the dmg, then the license agreement appears, and directly after the “Agree” it looks like its loading something up , and then this Error 1000 appears.

I’ll turn on my 2 factor, I can use Xcode fine, but must not be using the very latest version apparently.

I checked in my Developer account portal and could not find mention of 2FA, but at appleid.com I logged in there and did find I had 2FA turned on.
In that case, it must be my friend on his Mac who doesn’t have 2FA enabled and perhaps thats why my .dmg failed on his machine.
I’d like to be 100% sure.

You could DM a link to the dmg to me and I could have a look on my machine. I do have 2FA enabled but the error might actually be something completely different. Like, why would opening a dmg require using an Apple ID in the first place?

Thanks for the info