Thanks for the replies. You are both quite right that I should have provided more information.
When I say that notarization succeeds, I mean that I submit the dmg file produced by the build to the Apple notarization service and receive a status of 'Accepted'. I take this to mean all is well.
When I say that notarization fails, I mean that the notarization step produces a status of 'Invalid'. Retrieving the notarization log indicates that the binaries were not signed.
I've just gone through this again with my two machines. The build here is performed by scripts that are maintained in source code control and forced to be identical in both setups. The build infrastructure is also the same for both. Before beginning, both machines were powered off for a period of time.
-
Power up one machine. Ensure the source tree is up-to-date. Run the build to produce a signed dmg. Submit it for notarization. The submission produces a status of Accepted.
-
Power down the first machine. Power up the second machine. Again ensure the source tree is up-to-date. Run the build to produce the signed dmg. Submit it for notarization. The submission produces a status of Invalid. The notarization log indicates the binaries are not signed.
-
Reboot the second machine and do the process again. This time the dmg is Accepted by notarization.
I've run variations on this set of steps. The only way I have been able to build things reliably is to use one machine at a time.
Signing relies on my Developer ID Application and/or Installer certificates. They are present in Keychain Access with private keys, intermediate certs and the root cert. I don't think signing would ever succeed if this setup were not valid.
Since the notarization log may say the binaries are not signed, you may well ask how they are being signed. This build does not use Xcode at all. It is a Java application and uses the Java jpackage tool to produce the signed dmg. You may at this point say 'Aha' and wash your hands of me. Internally, however, I believe this tool calls the Apple codesign tool. I have other builds that call codesign directly and show similar behavior.
Independently detecting whether a binary or an installer is signed correctly seems to be difficult. I have tried several tools with mixed results. Some will say yes, some no, on the same file. I would welcome a definitive way to do it.
