I am having troubles notarizing an installer package. I created an installer package using the pkgbuild and productbuild, and then I tried to notarize it with notarytool, but I got an error message. The error message led me to Use a valid Developer ID certificate, which includes the statement Sign installer packages with a Developer ID Installer certificate The app is signed with the team Developer ID and is notarized (via Xcode). I signed both packages (during pkgbuild and productbuild) with a certificate created when I clicked Mac Installer Distribution in the developer portal, and it created a certificate named "3rd Party Mac Developer Installer: my company" Is this the wrong certificate? If it is the wrong certificate, which one should I create in the developer portal? (I didn't see anything specified as "Developer ID Installer") If it is the right certificate, any idea what I might have done wrong? Note: The reason I am trying to notarize the installer package is because when I tried testing the installer in my test VM, I received the following message (I thought signing the pkg would have prevented this):

I was reading through this post: https://developer.apple.com/forums/thread/718583 I've been able to reproduce this behavior by double-clicking a DMG in the Finder while the Mac is Offline. I checked the Notarization status of the app via spctl and it shows "Notarized Developer ID". So sure enough, Quinn's comment about Gatekeeper "ingesting" the notarization ticket stapled to the DMG and automatically applying it to the app inside is 100% spot-on. However, I can't seem to get the same behavior to happen when mounting the DMG via hdiutil in Terminal. While Offline, I do a: hdiutil attach /path/to/my/dmg.dmg and then spctl -a -t exec -vvv /Volumes/path/to/my/mounted/dmg/myapp.app After the spctl I'm seeing /Volumes/path/to/my/mounted/dmg/myapp.app: rejected source=Unnotarized Developer ID origin=Developer ID Application: My Developer Creds (XXXXXXXXXX) Is there a way to get Gatekeeper to "ingest" the notarization ticket stapled to the DMG when using hdiutil while Offline? Note 1: If I use hdiutil while online, everything works as expected. Note 2: I'm testing all this via a VM of macOS 12.7.1, if that makes any difference. Thanks!

I'm trying to notarize a plug-in for Autodesk Maya (project type: Mach-O Bundle). Over the past few years I was able to successfully notarize my plug-ins via command line scripts. I usually build the bundles outside XCode with a scripted process which then also automates the notarization procedure. This has been a solid and working workflow. Since yesterday, October 23rd 2023 the prior working 'altool' is now refused because of the new notarization process which starts November 1st, 2023!!! While trying to follow the new procedure outlined here: https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/customizing_the_notarization_workflow I performed the following steps: Create a ZIP archive suitable for notarization. /usr/bin/ditto -c -k --keepParent "$APP_PATH" "$ZIP_PATH" Upload for notarization. xcrun notarytool submit $ZIP_PATH --keychain-profile "Notarization" --wait The result is: $ xcodebuild[2514:78653] Requested but did not find extension point with identifier Xcode.IDEKit.ExtensionSentinelHostApplications for extension Xcode.DebuggerFoundation.AppExtensionHosts.watchOS of plug-in com.apple.dt.IDEWatchSupportCore $ xcodebuild[2514:78653] Requested but did not find extension point with identifier Xcode.IDEKit.ExtensionPointIdentifierToBundleIdentifier for extension Xcode.DebuggerFoundation.AppExtensionToBundleIdentifierMap.watchOS of plug-in com.apple.dt.IDEWatchSupportCore Conducting pre-submission checks for myPlugin.bundle.zip and initiating connection to the Apple notary service... Submission ID received id: ***-*** Successfully uploaded file id: ***-*** path: /Users/***/myPlugin.bundle.zip Waiting for processing to complete. Current status: Invalid........ Processing complete id: ***-*** status: Invalid My current assumption is that it's necessay to archive the bundle in XCode first as mentioned in the documentation: "To prepare an app for notarization, you must export the app from Xcode." But when I try to export the bundle after archiving I am not presented with the necessary options. The Organizer only gives me the button to Distribute Content which leads to another window allowing me to select either Build Products (which only exports the archive's built products) or Archive (which only creates a copy). Unfortunately neither then contains the necessary ExportOptions.plist, which is required as by the documentation. I would very much appreciate of someone could shed some light on what's necessary to perform a successful notarization. Thank you.

Hi there, I'm in a process to move from altool to notarytool, following information found at TN3147. First, TN3147 says the team-id is optional if my account has only one team membership, which is the case, but the notarytool says it's mandatory and I do have to use it (not an issue). Now, the issue I face: $ security unlock-keychain -p prorogue-stake-unused /Users/comp/Library/Keychains/my.keychain $ xcrun altool --username $APPLEID --password "@keychain:MYPASSWORD" --notarization-history 0 .. it displays the notarization history as expected .. but: $ xcrun notarytool history --apple-id $APPLEID --team-id $TEAMID --password "@keychain:MYPASSWORD" Error: HTTP status code: 401. Invalid credentials. Username or password is incorrect. Use the app-specific password generated at appleid.apple.com. Ensure that all authentication arguments are correct. The password is supposed work with both tools, according to TN3147. What am I missing? Besr regards,

According to this helpful article, I should be able to extract notarytool for use on macOS 10.15 and later. I've extracted notarytool and put it in a common location for use with a script that builds, signs, and notarizes plugin installers. The script previously relied on altool. The initial call to notarytool is: xcrun <path to notarytool> submit --apple-id <our id> --password <our password> --team-id <our ID> --wait <path to file> This works fine on a machine running macOS 13.5.1, with Xcode 14.3 installed. The installers get built and notarized. However, on a machine running macOS 11.4, with Xcode 12 installed, I get this error: xcrun: error: unable execute utility <path to notarytool> because it requires a newer version of macOS. OK, I tried removing the initial xcrun command, and now I get this error: dyld: Library not loaded: /usr/lib/swift/libswift_Concurrency.dylib Referenced from: <path to notarytool> Reason: image not found The article linked above makes it sound like notarytool should work as a standalone tool from any machine running macOS 10.15 or higher. Is the existing Xcode installation interfering? Is there an OS/Xcode version agnostic way to run notarytool?

When I run notarytool submit in my github workflow, I get what appears to be some kind of segmentation fault. Here's a direct link to the exception output: https://github.com/recyclarr/recyclarr/actions/runs/6594346352/job/17918152266#step:6:43 My project is open source, so you can also view the shell script I use in the workflow itself: https://github.com/recyclarr/recyclarr/blob/update-notary-tool/ci/notarize.sh The script above contains this: #!/usr/bin/env bash set -xe user="$1" pass="$2" teamId="$3" archivePath="$4" function submit() { xcrun notarytool submit --wait \ --apple-id "$user" \ --password "$pass" \ --team-id "$teamId" \ recyclarr.zip | \ awk '/id: / { print $2;exit; }' } function log() { xcrun notarytool log \ --apple-id "$user" \ --password "$pass" \ --team-id "$teamId" \ "$1" } tar -cvf recyclarr.tar "$archivePath" zip recyclarr.zip recyclarr.tar submissionId="$(submit)" rm recyclarr.zip recyclarr.tar if [[ -z "$submissionId" ]]; then exit 1 fi echo "Submission ID: $submissionId" until log "$submissionId" do sleep 2 done The error (from the workflow run) is: 2023-10-21 01:24:18.817 notarytool[4894:25434] *** Terminating app due to uncaught exception 'NSFileHandleOperationException', reason: '*** -[_NSStdIOFileHandle writeData:]: Broken pipe' *** First throw call stack: ( 0 CoreFoundation 0x00007ff8106c4773 __exceptionPreprocess + 242 1 libobjc.A.dylib 0x00007ff810424bc3 objc_exception_throw + 48 2 Foundation 0x00007ff8115b5962 -[NSConcreteFileHandle readDataUpToLength:error:] + 0 3 Foundation 0x00007ff811497590 -[NSConcreteFileHandle writeData:] + 263 4 notarytool 0x000000010bcff026 notarytool + 462886 5 notarytool 0x000000010bcb780d notarytool + 169997 6 notarytool 0x000000010bcd37c6 notarytool + 284614 7 notarytool 0x000000010bcea719 notarytool + 378649 8 notarytool 0x000000010bcd3d19 notarytool + 285977 9 notarytool 0x000000010bcd2a4e notarytool + 281166 10 notarytool 0x000000010bcd5009 notarytool + 290825 11 notarytool 0x000000010bc8fe66 notarytool + 7782 12 dyld 0x000000011781b52e start + 462 ) libc++abi: terminating with uncaught exception of type NSException I do not get this error when I run this script directly on my 2023 MBP. It only appears to happen in my github workflow. Is this a bug in notarytool? Notarization appears to still complete, and I also get a submission ID I can use for the notarytool log command I run after.