Update — exhaustive diagnostics done, still failing, requesting Apple-side investigation

Code Signing Notarization
Thededicated OP
Created 4w
Replies 6
Boosts 0
Views 1.3k
Participants 2

Following up with a full diagnostic summary since my last post, in case it helps narrow this down.

Certificates: Developer ID Installer and Developer ID Application (Team ID 6VCLSHAN7R), both freshly created Aug 19, 2026. Both show as valid/trusted in Keychain Access and match the developer portal (expiration 2031/08/20).

What I've verified/tried, all pointing to the same conclusion: Local signature is valid. pkgutil --check-signature shows a full chain (Developer ID Installer → Developer ID Certification Authority → Apple Root CA) with a trusted timestamp. codesign -dvv on the embedded binaries (VST3, AU component, standalone app) all show Authority=Developer ID Application: ..., hardened runtime enabled, valid secure timestamp. No account/cert issues found. No duplicate certificates (security find-identity -v -p basic returns exactly 2 valid identities). No pending Program License Agreement. developer.apple.com/system-status shows Notary Service operational. Signed with productsign directly, not just via the packaging GUI (Packages/Whitebox) — same result. Isolated from product content: a minimal pkgbuild test package (single text file, signed only with productsign, no relation to my actual product) fails with the exact same error. Waited 3+ days in case of certificate propagation delay — no change. Tried both authentication methods — Apple ID + app-specific password, and a Team-scoped App Store Connect API key — both fail identically. Every single attempt returns: "message": "The binary is not signed with a valid Developer ID certificate." Latest Submission IDs (all Invalid, same error): 5b495af5-1a31-41cd-b8a3-d1e33ab2a12a (product pkg, API key auth) 91eee4f0-778a-4edb-9515-eabfc6711f3f (minimal test pkg, Apple ID auth) At this point I've ruled out everything on my end I can think of — package contents, signing tool, authentication method, certificate freshness/propagation, account status. This looks like something wrong with how these specific certificates are provisioned on Apple's side for notarization. Could someone from DTS take a look at the account/certificates directly? Happy to provide any further diagnostics needed.

Thanks for your patience.

Replies  6
Boosts  0
Views  1.3k
Participants  2
DTS Engineer OP
Apple
3w

If you submit a zip archive containing one of your plug-ins, does the notary service accept that?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
Thededicated OP
2w

Hello ! The notarization fails and the status displays : Invalid Here Is the screenshot of my latest upload...

Thededicated OP
2w

But what I have noticed... — a zip containing just the signed VST3 plug-in (signed with my Developer ID Application certificate) was accepted successfully. Submission ID: 5d2ee526-31a7-420b-90da-8f6956ab08e4 — status: Accepted So it seems the issue is isolated to my Developer ID Installer certificate specifically (used to sign the .pkg via productsign) — the Developer ID Application certificate works fine with the notary service. Does that help narrow down what might be misconfigured?

DTS Engineer OP
Apple
2w

OK, you posted two replies that touch on two separate issues. I want to address the first issue first, then we can come back to your installer package issue.

Oh, before we do that, if you need to post a Terminal transcript, it’s best to do that as text in a code block rather than as a screenshot. That makes it much easier to read, and also allows me to copy’n’paste. See tip 5 in Quinn’s Top Ten DevForums Tips for more about this.

The notarization fails and the status displays : Invalid

OK. Then the next step is to fetch the notary log and see what it’s complaining about. See Fetching the Notary Log for info on how to do that.

If you’d like my input on that log, feel free to post it here. You can post it either as a text attachment [1] or, if it’s relatively short, in a code block.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] Posting a Crash Report had some hints and tips that’ll help you post a text attachment.
Thededicated OP
2w

Here's the notary log from a recent Invalid submission of the signed .pkg (productsign, Developer ID Installer certificate):

  "logFormatVersion": 1,
  "jobId": "5b495af5-1a31-41cd-b8a3-d1e33ab2a12a",
  "status": "Invalid",
  "statusSummary": "Archive contains critical validation errors",
  "statusCode": 4000,
  "archiveFilename": "Drone_Pad_Signed_v2.pkg",
  "uploadDate": "2026-08-22T22:40:38.429Z",
  "sha256": "e5983f8f468af3fc6b11ae9aa819a98544a22a853e459c8eeee6a91385476375",
  "ticketContents": null,
  "issues": [
    {
      "severity": "error",
      "code": null,
      "path": "Drone_Pad_Signed_v2.pkg",
      "message": "The binary is not signed with a valid Developer ID certificate.",
      "docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087721",
      "architecture": null
    }
  ]
}

Submission ID: 5b495af5-1a31-41cd-b8a3-d1e33ab2a12a

DTS Engineer OP
Apple
2w

OK. What does this report?

% pkgutil --check-signature /path/to/your.pkg

Pasted in below is an example of what I see.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

% pkgutil --check-signature Test843122.pkg 
Package "Test843122.pkg":
   Status: signed by a developer certificate issued by Apple for distribution
   Signed with a trusted timestamp on: 2026-09-03 12:26:25 +0000
   Certificate Chain:
    1. Developer ID Installer: Quinn Quinn (SKMME9E2Y8)
       Expires: 2027-07-12 13:47:32 +0000
       SHA256 Fingerprint:
           15 4E 11 93 04 99 B2 15 4E 9B 1E AF 9E 2C 72 C7 BA 48 E1 8C 61 18 
           C9 0A E4 62 A3 EF 87 94 79 D4
       ------------------------------------------------------------------------
    2. Developer ID Certification Authority
       Expires: 2031-09-17 00:00:00 +0000
       SHA256 Fingerprint:
           F1 6C D3 C5 4C 7F 83 CE A4 BF 1A 3E 6A 08 19 C8 AA A8 E4 A1 52 8F 
           D1 44 71 5F 35 06 43 D2 DF 3A
       ------------------------------------------------------------------------
    3. Apple Root CA
       Expires: 2035-02-09 21:40:36 +0000
       SHA256 Fingerprint:
           B0 B1 73 0E CB C7 FF 45 05 14 2C 49 F1 29 5E 6E DA 6B CA ED 7E 2C 
           68 C5 BE 91 B5 A1 10 01 F0 24
Update — exhaustive diagnostics done, still failing, requesting Apple-side investigation
First post date Last post date
 
 
Q