Screenshot from SuspiciousPackage:
The 1.3 release of utiluti has an extraneous hyphen in the Package Version in the receipt, because the build_number variable in the pkgAndNotarize.sh script is never set to any value.
Lines 159 andf 177 pass the following to productbuild : --version "$version-$build_number" causing the version of the pkg to be 1.3- since $build_number is unset
Suggested Fix:
Remove build_number from this script altogether, or have it as part of the --version option from utiluti itself (or have some other way to derive it when running the pkgAndNotarize.sh script)