Checking DMG notarization never successed, allways shows:Rejected

hello , I am developing a MacOS App. I stuck in some errors during DMG notarization.

after

xcrun stapler staple -v "${APP_PATH}.dmg"

it allways shows dmg: rejected:

spctl -a -t exec -vv ${APP_PATH}.dmg
../dist/IM-darwin-x64/IM.app.dmg: rejected
source=Notarized Developer ID
origin=Developer ID Application: ........ (.......)

I stuck here for a while , please help me to fix this error , thank you very much

my step demo:

#!/bin/bash
OSX_PUBLISH_USER="APP PUBLISHER USER"
OSX_PUBLISH_PASSWD="APP PUBLISHER PASSWD"
APP_PATH="YOUR APP PATH"
PLIST_PATH="YOUR entitlements.plist PATH"

ASC_PORVIDER="xxxxx" #UMZRU526AB
APPLICATION_CER_NAME="Developer ID Application: XXXXX ({$ASC_PORVIDER})" #"Developer ID Application: XXX XXX (UMZRU526AB)"
PRIMARY_BUNDLE_ID="app primary-bundle-id name"


if [ "$OSX_PUBLISH_USER" == "" ]; then
  echo "OSX_DEV_USER is empty"
  exit -1
fi

if [ "$OSX_PUBLISH_PASSWD" == "" ]; then
  echo "OSX_PUBLISH_PASSED is empty"
  exit -1
fi

RESULT=$(codesign --deep --force --sign "${APPLICATION_CER_NAME}" --options runtime --entitlements ${PLIST_PATH} ${APP_PATH} 2>&1)
echo $RESULT

result=$(echo $RESULT | grep "The timestamp service is not available")
if [[ "$result" != "" ]]; then
  echo "codesign fail:The timestamp service is not available"
  exit 3
fi
echo "codesign-finish"

echo "createArchive-start"
ditto -c -k -rsrc --sequesterRsrc --keepParent $APP_PATH ${APP_PATH}.zip
echo "createArchive-finish"
echo "notarize-start"
RESULT=$(xcrun altool --notarize-app --primary-bundle-id $PRIMARY_BUNDLE_ID --username $OSX_PUBLISH_USER --password $OSX_PUBLISH_PASSWD --asc-provider=$ASC_PORVIDER -t osx --file ${APP_PATH}.zip)
UUID=$(echo $RESULT | grep -Eo 'RequestUUID = [[:alnum:]]{8}-([[:alnum:]]{4}-){3}[[:alnum:]]{12}' | grep -Eo '[[:alnum:]]{8}-([[:alnum:]]{4}-){3}[[:alnum:]]{12}' | sed -n "1p")
echo $RESULT
echo $UUID
if [[ "$UUID" == "" ]]; then
  echo "notarize-upload-fail"
  exit 3
fi
echo "notarize-finish"

i=0
times=5
while [ $i -le $times ]; do
  let i++
  echo "sleep 60 seconds to get history"
  sleep 60
  RESULT=$(xcrun altool --notarization-history 0 -u "$OSX_PUBLISH_USER" -p "$OSX_PUBLISH_PASSWD" | sed -n "6p")
  echo $RESULT
  result=$(echo $RESULT | grep "success")
  if [[ "$result" != "" ]]; then
    xcrun stapler staple -v $APP_PATH
    echo "notarize app success"
    times=-1
  else
    if [[ $i > 5 ]]; then
      echo "notarize app fail:timeout"
      xcrun altool --notarization-history 0 -u "$OSX_PUBLISH_USER" -p "$OSX_PUBLISH_PASSWD"
      exit 1
    fi
  fi
  result=$(echo $RESULT | grep "Package Invalid")
  if [[ "$result" != "" ]]; then
    echo "notarize app fail:Package Invalid"
    xcrun altool --notarization-info "$UUID" -u "$OSX_PUBLISH_USER" -p "$OSX_PUBLISH_PASSWD"
    times=-1
    exit 2
  else
    if [[ $i > 5 ]]; then
      echo "notarize app fail:timeout.."
      xcrun altool --notarization-history 0 -u "$OSX_PUBLISH_USER" -p "$OSX_PUBLISH_PASSWD"
      exit 1
    fi
  fi
done

result=$(echo $RESULT | grep "success")
if [[ "$result" != "" ]]; then
  echo "createDMG-start"
  #node createMacDMG.js
  hdiutil create -srcFolder $APP_PATH -o ${APP_PATH}.dmg
  codesign --deep --force  --verify --verbose --sign "${APPLICATION_CER_NAME}" -i "${PRIMARY_BUNDLE_ID}" --timestamp ${APP_PATH}.dmg

  #codesign -s III --timestamp -i BBB ${APP_PATH}.dmg
  echo "createDMG-finish"
  echo "notarize-start"
  RESULT=$(xcrun altool --notarize-app --primary-bundle-id "${PRIMARY_BUNDLE_ID}" --username $OSX_PUBLISH_USER --password $OSX_PUBLISH_PASSWD --asc-provider=$ASC_PORVIDER -t osx --file ${APP_PATH}.dmg)
  UUID=$(echo $RESULT | grep -Eo 'RequestUUID = [[:alnum:]]{8}-([[:alnum:]]{4}-){3}[[:alnum:]]{12}' | grep -Eo '[[:alnum:]]{8}-([[:alnum:]]{4}-){3}[[:alnum:]]{12}' | sed -n "1p")
  echo $RESULT
  echo $UUID
  if [[ "$UUID" == "" ]]; then
    echo "notarize-upload-fail"
    exit 3
  fi
  echo "notarize-finish"

  i=0
  times=5
  while [ $i -le $times ]; do
    let i++
    echo "sleep 60 seconds to get history"
    sleep 60
    RESULT=$(xcrun altool --notarization-history 0 -u "$OSX_PUBLISH_USER" -p "$OSX_PUBLISH_PASSWD" | sed -n "6p")
    echo $RESULT
    result=$(echo $RESULT | grep "success")
    if [[ "$result" != "" ]]; then
      xcrun stapler staple -v "${APP_PATH}.dmg"
      echo "notarize dmg success"
      times=-1
    else
      if [[ $i > 5 ]]; then
        echo "notarize dmg fail:timeout"
        xcrun altool --notarization-history 0 -u "$OSX_PUBLISH_USER" -p "$OSX_PUBLISH_PASSWD"
        exit 1
      fi
    fi
    result=$(echo $RESULT | grep "Package Invalid")
    if [[ "$result" != "" ]]; then
      echo "notarize dmg fail:Package Invalid"
      xcrun altool --notarization-info "$UUID" -u "$OSX_PUBLISH_USER" -p "$OSX_PUBLISH_PASSWD"
      times=-1
      exit 2
    else
      if [[ $i > 5 ]]; then
        echo "notarize dmg fail:timeout.."
        xcrun altool --notarization-history 0 -u "$OSX_PUBLISH_USER" -p "$OSX_PUBLISH_PASSWD"
        exit 1
      fi
    fi
  done

fi

echo "check-notarize-result"
xcrun altool --notarization-info "$UUID" -u "$OSX_PUBLISH_USER" -p "$OSX_PUBLISH_PASSWD"

echo "check-app"
spctl -a -t exec -vv $APP_PATH
echo "check-dmg"
spctl -a -t exec -vv ${APP_PATH}.dmg

exit 0