Hello, builds we've submitted for notarization have been stuck in the In-Progress stage for a while now. The process has taken less than 10 minutes in the past. The latest of which is id: 86916f85-b82f-4a95-982b-1232387a92e1. We haven't made any stark changes so we're not clear on what the issue is. Is the best way forward to submit a support ticket?

I am packaging an app with QtWebEngine in it, after codesign the app and the QtWebEngine Framework, the app can run properly. The codesign result is: valid on disk staisfies its Designated requirements Then I notarized and stapled the dmg file, after the dmg installed on Mac, gatekeeper still failed the check. Here is the result for spctl: spctl -a -t open -vvv --context context:primary-signatue Remote\ Graphics\ Workstation_.dmg Remote Graphics Workstation_.dmg: rejected source=Insufficient Context Need help to identify the codesign process and the root cause why gatekeeper fail here, thanks.

Here is the situation: We are shipping an application bundle which is submitted to the notarization service for approval. The application bundle adheres to the notarization standards and is approved. Problem: We need to ship a zip file inside this application. This zip file has all the files that are signed. Most of the files are signed by us. However there are some 3P zip files which are not signed by us. We would rather not open these 3P zip files as there might be SLAs involved here. As a result we end up with a zip file which contains mixed signatures. This zip file needs to be part of that application that needs to be notarized. Question: What is the best way to do this in order for the notarization service to approve the application and ship the zip file as part of the application? Note: We don't know if all the files inside the 3P zips are correctly signed (example: With Hardened Runtime). They are all signed though Also, when the zip files contents are laid out onto the customer machine, they are all signed and validated. However, some files might not have hardened runtime. Thanks in advance.

Hi all, Occasionally, our systems grind to a halt because an agreement needs signed. As you can imagine this always happens at an inconvenient time. Is there a programmatic way we can know about this, before it happens? How is everyone else handling this? From a search through threads here and documentation, I don't see anything and thus I don't think this is possible to script, but wanted to double check. If not possible, what kind of grace period is there between when developer.apple.com mentions something will need signed, and when it stops working? I'm not the one who can sign, so can a non-signer see this? This part is basically asking: How often does someone have to log on to "poll" for this and can this be me or does it have to be the person with access to sign the agreements. Does the system maybe send out an email to the signer about these (in advance), that he's maybe not seeing? Thanks!

...and some more simple command line utilities. I've code signed all executables and binary libraries I could find. This has got rid of most errors already. Now I'm struggling with the "hardened runtime" requirements. I understand I can somehow add entitlements - but have no clue how to do that, and what to add. Somewhere there was reference to PCRE - I don't think Perl uses that itself, but certainly does deal with regexes a lot. How would I add eg. the JIT entitlement (if that was required)? Most documents refer to .mobileprovision files or similar - but I'm dealing with a desktop application. And as all of this is rather non-standard, we don't use Xcode at all. So I wouldn't even know how to use Xcode to create a profile for an an app which is managed completely "outside" of a normal macOS development environment.

Keys can vary; an account is not necessary, as only Team Keys are suitable for notarization. It seems that Developer role is sufficient for notarization. We have tried both keys and roles of Developer and Account Manager - the behavior is the same. Multiline There are two types of API keys: Team Access to all apps, with varying levels of access based on selected roles. Individual Access and roles of the associated user. Individual kevs aren't able to use Provisioning endpoints, access Sales and Finance, or notaryTool. BlockQuote Here are the parameters used for notarization via API key: `-k, --key key-path    App Store Connect API key. File system path to the private key. -d, --key-id key-id    App Store Connect API Key ID. For most teams this will be a 10 character alphanumeric string. -i, --issuer issuer    App Store Connect API Issuer ID. The issuer ID is a UUID format string.` The notarization result shows as successful, and on the same machine, the package appears as notarized. However, when the package is transferred to another system, it is displayed as not notarized.

I'm trying to distribute my macOS application (a .dmg file) to customers, and I've followed all the steps to sign and notarize the application. However, when I try to install the .dmg containing the app, Gatekeeper rejects it with the error "AppName cannot be opened because developer is not verified". Even though I’ve signed the app with my Developer ID, notarized it, and verified the signature using codesign, I am still encountering issues when attempting to install or open the app on a clean macOS environment. Here’s the error I see when using spctl to check the .dmg: spctl --assess --type open --verbose=4 output/App.dmg output/App.dmg: rejected source=Insufficient Context When trying: spctl -a -t open -vvv --context context:primary-signature output/App.dmg output/Unbounded.dmg: accepted source=Notarized Developer ID origin=Developer ID Application: My .app is signed and notarised by electron builder and I explicitly signed and notarised dmg too but still not working

I'm trying to store credentials on my keychange by doing this: xcrun notarytool store-credentials --apple-id APPLE-ID --team-id TEAM-ID I then I'm asked for a profile name, and the the App-specific password for my apple-id. This is when I'm getting an error: "Invalid credentials. Username or password is incorrect. Use the app-specific password generated at appleid.apple.com. Ensure that all authentication arguments are correct.". Now, I've generated the app specific pw by logging in here: https://account.apple.com/ but when I login to my Developers account, I do it here: https://developer.apple.com/account/ I've signed up for the "$99 a year"-program. Is there a problem that I've created the pw on what looks like my "private" page and not my "developer" page?

Hi, I have been notarizing my code for several years with the same procedure, but today I have the following message : Conducting pre-submission checks for FencingFox.zip and initiating connection to the Apple notary service... Error: HTTP status code: 401. Invalid credentials. Username or password is incorrect. Use the app-specific password generated at appleid.apple.com. Ensure that all authentication arguments are correct. CloudKit query for FencingFox.pkg (1/00a276f170785e1dcbfbd6873a00b9309672338b) failed due to "Record not found". Could not find base64 encoded ticket in response for 1/00a276f170785e1dcbfbd6873a00b9309672338b The staple and validate action failed! Error 65. I have changed my apple password and migrated to Sequoia. How should I investigate the issue ?

Hello, After my developer Id had expired after 5 years, I created a new one, codesigned the app successfully, but could not notarize: xcrun notarytool submit mac_release/flow5.zip --keychain-profile "XFLR5" --wait Conducting pre-submission checks for flow5.zip and initiating connection to the Apple notary service... Error: HTTP status code: 401. Invalid credentials. Username or password is incorrect. Use the app-specific password generated at appleid.apple.com. Ensure that all authentication arguments are correct I don't think I was using an app specific password before, but the last time I went through this process was 5 years ago. Thanks in advance for any help.

We've recently updated our build server to macOS 15.1.1 and ever since notarization sporadically fails. Notarytool says No Keychain password item found for profile: foo, even though that item is present. I found out it works when I either log in using Remote Desktop (don't need to do anything else, just login and wait) or when running security unlock-keychain via SSH (but that one's not persistent, either). We're using GitLab (via gitlab-runner on the build server) and so far notarization hasn't had much problems with the keychain. That started with macOS 15.1. Are there any changes in 15.1 that we need to be aware of to make this stable?

Hello, I've notarised my app like this: ` codesign codesign --force --deep --entitlements "/Users/username/myapp/myapp.app/Contents/app.entitlements" --sign "Developer ID Application: Username (my team id)" "/Users/username/myapp/myapp.app" codesign -v /Users/username/myapp/myapp.app ` ` create .zip file ditto -c -k --keepParent "myapp.app" "myapp.zip" ` ` submit binary to Apple xcrun notarytool submit Shalloville.zip --apple-id "my icloud" --password "xxxx-xxxx-xxxx-xxxx" --team-id "my team id" ` Is there anything wrong? I submitted the .zip file on 27/11 and it's still "In Progress". Successfully received submission history. history -------------------------------------------------- createdDate: 2024-11-29T16:05:44.609Z id: eccf6248-4f2f-4cc1-bb90-88cf13aa08a0 name: Shalloville.zip status: In Progress -------------------------------------------------- createdDate: 2024-11-27T08:57:56.373Z id: 7d9887dc-6bf8-4e39-bcbe-0f22d02dce4f name: Shalloville.zip status: In Progress -------------------------------------------------- createdDate: 2024-11-27T07:05:05.544Z id: 84c08d62-189d-48b2-80d9-170ddc3edb67 name: Shalloville.zip status: In Progress

I just paid for 99$ a year and it's already 48hrs ago since I've paid. But when I click on my name it still says "Pending" and on the main landingpage on https://developer.apple.com/account it still says this "Purchase your membership. To continue your enrollment, complete your purchase now Your purchase may take up to 48 hours to process." Do I need a membership to codesign and notarising my VST plugins? Cause that'a what I bought it for.

I am developling a electron app, failed when notarize. I filled in 3 fields: appleId: my apple account email apple id password: I generated it from https://account.apple.com/account/manage/section/security, the "app-specific password" team id: I get it from https://developer.apple.com/account How can I fix it? Log: { "logFormatVersion": 1, "jobId": "7bedcb38-5ca7-4d69-be96-1bd660b67942", "status": "Rejected", "statusSummary": "Team is not yet configured for notarization. Please contact Developer Programs Support at developer.apple.com under the topic Development and Technical / Other Development or Technical Questions.", "statusCode": 7000, "archiveFilename": "Samira.zip", "uploadDate": "2024-12-04T11:34:01.999Z", "sha256": "e9cea98493836dfd4c238a25e6d8dae31ed529ed353d4f8463313ee3d431c741", "ticketContents": null, "issues": null }

Trying to notarise a small VST3 application, but get the "invalid" status. Chrcked the logfile, and there are a few issues there. How should I resolve this? { "logFormatVersion": 1, "jobId": "4438fc34-4900-4302-bf2f-dd2336f44b89", "status": "Invalid", "statusSummary": "Archive contains critical validation errors", "statusCode": 4000, "archiveFilename": "Abandoned Beta 4.vst3.zip", "uploadDate": "2024-12-07T10:22:59.950Z", "sha256": "25457e4fd6e7eae72e8a892e468cef916d173f2fb30d2156d8ff72e33d0f4fe3", "ticketContents": null, "issues": [ { "severity": "error", "code": null, "path": "Abandoned Beta 4.vst3.zip/Abandoned Beta 4.vst3/Contents/MacOS/Abandoned Beta 4", "message": "The binary is not signed.", "docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087721", "architecture": "x86_64" }, { "severity": "error", "code": null, "path": "Abandoned Beta 4.vst3.zip/Abandoned Beta 4.vst3/Contents/MacOS/Abandoned Beta 4", "message": "The signature does not include a secure timestamp.", "docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087733", "architecture": "x86_64" }, { "severity": "error", "code": null, "path": "Abandoned Beta 4.vst3.zip/Abandoned Beta 4.vst3/Contents/MacOS/Abandoned Beta 4", "message": "The signature of the binary is invalid.", "docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087735", "architecture": "arm64" }, { "severity": "error", "code": null, "path": "Abandoned Beta 4.vst3.zip/Abandoned Beta 4.vst3/Contents/MacOS/Abandoned Beta 4", "message": "The signature does not include a secure timestamp.", "docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087733", "architecture": "arm64" } ] }

I built Mac app with Electron-forge and sign and notarize my app with Developer ID Application Certification and @electron/osx-sign, @electron/notarize module. I built my app on macOS Sonoma 14.7. Then I ran the built app on other mac with "App Store and identified developers" Gatekeeper of macOS version 12.7.3 And it worked well. But when I ran it on another mac PC of macOS Sonoma 14.4.1, it said my app is damaged. Why does it happen and How can I solve this issue?

Hello, Our company's software successfully passes the notarization process when exported through Xcode Archive and compressed into a zip file. However, it fails notarization when packaged into a pkg using the Packages software (version 1.2.10), consistently returning the error "The signature of the binary is invalid." We need assistance to resolve this issue. Here are some specific details on the signature statuses and notarization information: xcrun stapler validation: Successful xcrun stapler validate Maxi\ PC\ Suite.app Processing: /Users/autel/Desktop/test11/files/Maxi PC Suite.app The validate action worked! pkgutil signature check: Successful pkgutil --check-signature Maxi\ PC\ Suite.pkg Package "Maxi PC Suite.pkg": Status: signed by a developer certificate issued by Apple for distribution Signed with a trusted timestamp on: 2025-01-09 08:09:17 +0000 Certificate Chain: 1. Developer ID Installer: Autel Intelligent Technology Co., Ltd. (MEXQ8HADL9) Expires: 2027-02-01 22:12:15 +0000 SHA256 Fingerprint: B7 F7 AC 05 19 78 CB 5D 66 C1 11 95 EE C9 2E 31 B9 AA BD F5 32 E4 B6 4D 8D 0D 06 04 EE BC 1B 5A ------------------------------------------------------------------------ 2. Developer ID Certification Authority Expires: 2027-02-01 22:12:15 +0000 SHA256 Fingerprint: 7A FC 9D 01 A6 2F 03 A2 DE 96 37 93 6D 4A FE 68 09 0D 2D E1 8D 03 F2 9C 88 CF B0 B1 BA 63 58 7F ------------------------------------------------------------------------ 3. Apple Root CA Expires: 2035-02-09 21:40:36 +0000 SHA256 Fingerprint: B0 B1 73 0E CB C7 FF 45 05 14 2C 49 F1 29 5E 6E DA 6B CA ED 7E 2C 68 C5 BE 91 B5 A1 10 01 F0 24 pkg notarization: Failed xcrun notarytool submit Maxi\ PC\ Suite.pkg --apple-id *** --team-id *** --password *** --wait Conducting pre-submission checks for Maxi PC Suite.pkg and initiating connection to the Apple notary service... Submission ID received id: ccbf6330-b64a-4b42-87c0-b5db1fe25b2d Upload progress: 100.00% (3.42 MB of 3.42 MB) Successfully uploaded file id: ccbf6330-b64a-4b42-87c0-b5db1fe25b2d path: /Users/autel/Desktop/test11/build/Maxi PC Suite.pkg Waiting for processing to complete. Current status: Invalid. Processing complete id: ccbf6330-b64a-4b42-87c0-b5db1fe25b2d status: Invalid Detailed notarization failure information: xcrun notarytool log ccbf6330-b64a-4b42-87c0-b5db1fe25b2d --keychain-profile "PC_Suit_Mac" { "logFormatVersion": 1, "jobId": "ccbf6330-b64a-4b42-87c0-b5db1fe25b2d", "status": "Invalid", "statusSummary": "Archive contains critical validation errors", "statusCode": 4000, "archiveFilename": "Maxi PC Suite.pkg", "uploadDate": "2025-01-09T08:18:22.374Z", "sha256": "0d1bd15e5c30bc890d20086de865739d01e131e34386b73ac20f8a5d52229906", "ticketContents": null, "issues": [ { "severity": "error", "code": null, "path": "Maxi PC Suite.pkg/Maxi_PC_Suite.pkg Contents/Payload/Applications/Maxi PC Suite.app/Contents/MacOS/Maxi PC Suite", "message": "The signature of the binary is invalid.", "docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087735", "architecture": "x86_64" } ] } We are looking for advice on how to resolve the error related to the invalid binary signature during the pkg notarization process. Thank you.

Hi at all, we started a notarization process and after 3 hours is still in progress.

Hi there, this is the first time I submitted a Mac app for notarization but looks like all my submissions are stuck in in progress for like one day at the moment. Can anyone help take a look? This is my submission history: Successfully received submission history. history -------------------------------------------------- createdDate: 2025-01-16T00:23:18.445Z id: 0581680c-9cfe-4e5b-9cc9-3ba101c9fd52 name: MiniCalendar.zip status: In Progress -------------------------------------------------- createdDate: 2025-01-15T05:12:13.480Z id: 55a03297-491b-4d30-8126-45d488a6beb9 name: MiniCalendar.zip status: In Progress -------------------------------------------------- createdDate: 2025-01-15T04:27:40.510Z id: 092f558f-01d0-48e5-9761-58dda54de23c name: MiniCalendar.zip status: In Progress -------------------------------------------------- createdDate: 2025-01-15T01:12:55.923Z id: 3aa74a6f-bcb8-4911-9d18-fcbb3e9a6c11 name: MiniCalendar.zip status: In Progress

I've tried to sign/notarize/staple my Electron app via electron-builder, using electron-notarize. I tried it as well in cmd line - both times, same result. Code signing runs without a problem. Notarize (I did wait two days first time, now it's couple of minutes) Stapling - failure `Downloaded ticket has been stored at file:///var/folders/.... Could not validate ticket for.... The staple and validate action failed! Error 65. ` I've checked, and the tickets are downloaded to said folder. My process: `codesign --deep --force --options runtime \ --entitlements build/entitlements.mac.plist \ --sign "Developer ID Application: Pete..." \ dist/mac-arm64/Modelist.app` ditto -c -k --sequesterRsrc --keepParent dist/mac-arm64/Modelist.app dist/mac-arm64/Modelist.zip xcrun notarytool submit dist/mac-arm64/Modelist.zip \ --apple-id "email" \ --password "app_specific_pass" \ --team-id "team_id" \ --wait Conducting pre-submission checks for Modelist.zip and initiating connection to the Apple notary service... Submission ID received id: 8fa0b3d3-291... Upload progress: 100,00% (98,1 MB of 98,1 MB) Successfully uploaded file id: 8fa0b3d3-291... path: /Users/pete/projects/modelist2/dist/mac-arm64/Modelist.zip Waiting for processing to complete. Current status: Accepted............. Processing complete id: 8fa0b3d3-291... status: Accepted xcrun stapler staple dist/mac-arm64/Modelist.app Processing: /Users/pete/projects/modelist2/dist/mac-arm64/Modelist.app Could not validate ticket for /Users/pete/projects/modelist2/dist/mac-arm64/Modelist.app The staple and validate action failed! Error 65. The certs were installed via XCode. Variables are all exported in env. I followed the instructions for electron-builder from here: https://kilianvalkhof.com/2019/electron/notarizing-your-electron-application/ I'm sure I made a stupid little mistake, but after hours of arguing with ChatGPT we are going in circles and after clicking on almost every link in Google, I'm kindda lost.