I've been unable to notarize an installer for an app (https://fxfactory.com/info/fxcore/) ever since adding a plug-in SDK that I was hoping to distribute as follows:
/Library/Developer/SDKs/FxCore.sdk
/Library/Developer/Xcode/Templates/FxCore/FxCore.xctemplate
This creates the smoothest possible UX for someone who starts using the SDK, mimicking official SDKs.
This is causing notarization failure, without a useful explanation, but a search suggests that Apple is preventing installers from touching the /Library/Developer directory as this might otherwise compromise the developer toolchain.
What is the correct strategy for third-party SDKs? I'm assuming that ADDITIONAL_SDKS doesnt' care if the SDK isn't located at that specific location, but is there any other place where I can put the xctemplate and have it appear when creating a new project in Xcode? (I haven't tried using a post-install script to copy files after the fact but I’d assume that would fail... otherwise what would be the point of this extra safety check.)
Thank you!
To answer my own question after some more trial and error: the Notarization process does not in fact reject installers that place items under /Library/Developer. That suggestion was hallucinated by Google’s AI response (should have checked with a better LLM, Grok and Claude don't make the same mistake.)
The error turned out to be an invalid signature in the framework that is distributed inside that SDK. A signature isn't needed by Xcode to access its headers or to link against it, so the problem wouldn't happen while testing that part. But naturally a framework is a binary and notarization wants a valid signature for it.