Original Problem We use codesign and notarytool in a scripted environment to build and distribute binaries daily. We also do manual builds by logging into the build server using SSH. This has been working for many years, but after updating to a new "Developer ID Application" certificate, codesign was failing with errSecInternalComponent and the console logs showed errSecInteractionNotAllowed. Summary of Resolution Attempting to fix the problem resulted in multiple copies of the same Certificate which were NOT shown by Keychain Access. I had to run security delete-identity multiple times to clear out the redundant Identities and then imported the certificate using the security CLI tool. Details I originally followed these instructions for requesting and installing a new certificate: https://developer.apple.com/help/account/certificates/create-developer-id-certificates/ Tip: Use the security tool intead These instructions fail to mention two critical points: 1) they assume the machine you generate the request on is the same machine you will be using to perform signatures, and 2) KeyChain Access does not allow you to set permissions for applications like codesign. I made the mistake of following the instructions on my workstation, and then tried to import the certificate to the build machine by double clicking on the .cer file. When that did not work, I followed various forum suggestions and eventually realized I need to export the private key as a .p12 file from the workstation, and import it into the build machine. Tip: The term "Certificate" often refers to a public certificate by itself, while "Identity" to refers to the combination of a public certificate and private key. At this point, I could use codesign, but only within Terminal.app while logged into the build machine's console. I tried various security commands to reimport the Identity, set a key partition list, and unlock the keychain, but none of them allowed codesign to work from within SSH or cron scripts. Eventually I stumbled upon this: sudo security find-identity -v Password: 1) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 2) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 3) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 4) EA377…96DD "Developer ID Application: Data Expedition, Inc. (VK…8X)" 5) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 6) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 7) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 8) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 9) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 10) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 10 valid identities found Keychain Access only showed one copy of the Identity in each keychain, but with security I could see there were actually 9. Tip: Keychain Access does not accurately display keychain contents. If it shows no contents at all, type a letter in the search box. Identities are distinguished from lone Certificates by a drop-down caret to the left of the certificate name. Clicking that shows the key. To fix the redundant Identities, I had to run this command four times to delete the nine copies: security delete-identity -Z 3C255…1560 I repeated this until the identity (I used the SHA1 hash of the certificate) no longer showed up in security find-identity -v. I then re-imported the certificate and key using security import, which is what I should have done from the begininng. The Correct Way Here are the commands I used to get things going after I deleted all the problem certificates: security import mycertificate.cer -k /Library/Keychains/System.keychain -T /usr/bin/codesign This next command I ran in Terminal.app on the console so it could display a password prompt: security import ImportThisKey.p12 -k /Library/Keychains/System.keychain -T /usr/bin/codesign After this, I used security find-identity -v to verify that there was only one copy of the Identity. I then verified that codesign could be used from SSH and cron-scripts even while logged out of the console. I suspect that a lot of mysterious certificate problems might be caused by duplicate certificates, each with different permissions. As far as I can tell, there is no way to uniquely identify a certificate/identity or the permissions attached to them. The system just searches based on hash, or team-id, or other non-unique property and seems to just arbitrarily pick one. I hope this helps someone else stuck with errSecInternalComponent errors!

Hi everyone, I am attempting to generate an Ad Hoc provisioning profile for my iOS app that includes MusicKit capabilities, but the generated .mobileprovision file consistently lacks the required entitlement, despite the configuration appearing correct in the developer portal. The Issue: I have enabled MusicKit under the "App Services" tab for my App ID. I have saved this configuration, verified it is checked in the UI, and then regenerated and downloaded my provisioning profile. However, when I inspect the internal contents of the .mobileprovision file, the Entitlements dictionary does not contain the com.apple.developer.music-kit key. It only contains the standard keys (Team ID, App ID, etc.). Steps Taken: Created a brand new App ID to rule out legacy data issues. Explicitly enabled "MusicKit" under the App Services tab for this new identifier. Created a fresh Ad Hoc Distribution profile linked to this new ID. Downloaded the profile and inspected the file structure: the MusicKit entitlement is completely absent. Attempted toggling the service off and on, saving, and regenerating the profile multiple times. Has anyone experienced a specific bug where "App Services" (like MusicKit) fail to propagate to the Provisioning Profile generator? Is there a secondary "Capability" (e.g., Media Library) that must also be enabled to trigger the inclusion of the MusicKit entitlement? Any guidance would be appreciated.

Certificate Details Certificate Name Expro International Group Ltd Certificate Type iOS Distribution Expiration Date 2029/02/11 Created By Thavaseelan Kudarsamy Enabled Capabilities iCloud, In-App Purchase, Personal VPN, Push Notifications App ID ESTSMobile (com.exprogroup.estsmobile) This profile is not installing.

One of our apps (built with Xcode 26.1.1 and distributed via TestFlight) crashes upon launch on iOS 17 with Exception Type: EXC_BAD_ACCESS (SIGKILL) and Termination Reason: CODESIGNING 2 Invalid Page. I have never seen this before. Any pointers? On iOS 18 & 26 this does not happen btw.

My provisioning profile isn't installing when I double-click it on my MacBook. Also no profile on this path ~/Library/MobileDevice/Provisioning Profiles. just empty folder

I am trying to notarize my app but it rejected with this error after 5 days of being in progress. { "logFormatVersion": 1, "jobId": "8291ad9e-4c8e-4974-8753-af1a78e5a4a2", "status": "Rejected", "statusSummary": "Team is not yet configured for notarization. Please contact Developer Programs Support at developer.apple.com under the topic Development and Technical / Other Development or Technical Questions.", "statusCode": 7000, "archiveFilename": "SkanVirtualAssistant-1.0.0.dmg", "uploadDate": "2026-02-05T03:13:41.280Z", "sha256": "eb95cc25a382e5ce36fc2b7e195c20a1a09cfbfb71a057e754306ad400300d38", "ticketContents": null, "issues": null } Can anyone help with this? I have an urgent product launch deadline in a week! I have contacted developer program support but have received no response.

I am trying to sign my Mac app to use Network Extensions capability. But every time I create a profile it displays that to me: on the other hand on the website it displays this to me:

Not accepted yet (all are still processing, none are rejected) 387af103-42d3-4d95-ae22-0289f90a8559 — In Progress 2d836594-9fb2-41a5-990c-7ea4e0870af0 — In Progress e61ba9e3-5ff1-4856-8e9d-39c08445ff63 — In Progress 1defdeec-50b4-45c5-b32d-53ca6e4538bb — In Progress 34e60b80-20c3-4ea7-93a7-2bb9e7c6f05c — In Progress 09222b71-eae1-4c5c-aca4-368f697b2a39 — In Progress eb5327e8-161e-4185-9920-3facf60b7b4b — In Progress 784fc210-d0bf-4924-b0a6-eb8bbac0f2c8 — In Progress 74bc8f31-b1b0-4bed-9142-0c03100a062a — In Progress 4739620c-894a-4283-a43b-df57b29a1771 — In Progress have created new certificate as well same result. waiting for apple support to give any answers.

When completing signing on Xcode, it shows the following error message "No certificate for team '' matching 'Developer ID Application' found" I have already followed the steps to generate a certificate from keychain and made a new certificate on developer portal, along with its associated provisioning profile. Viewing "Manage Certificate" window shows the newly created certificate, but Xcode seems to not be able to locate it.

I have been updating some NSXPCConnection code in my macOS 26 app (not sandboxed) to use XPCSession and friends instead. And it is working well and the experience has been generally good. But I have run into a problem when using XPCSession.setPeerRequirement() which I really want to use. It works well when I use something simple like XPCPeerRequirement.isFromSameTeam() but I want to check some more requirements and also use the code from multiple apps (but same team). That is, I want to check for multiple identifiers and team ID and version (and perhaps also in the future that the certificate is a Developer ID). And previously I would use SecRequirementCreateWithString with an entitlement string conceptually like this: var entitlement = "anchor apple generic and (" entitlement += "identifier idA" entitlement += " or identifier idB" entitlement += ")" entitlement += " and certificate leaf[subject.OU] = TeamID" entitlement += #" and info [CFBundleShortVersionString] >= "1.0""# and it works just as it should when creating and using that SecRequirement so I don't think that there is anything particularly wrong with the entitlement. And I had hoped that I could use the same string with XPCPeerRequirement.hasEntitlement(entitlement) but it doesn't work (I get a general "Peer forbidden" error). So I think that I don't really understand what sort of entitlement that hasEntitlement() wants. And also I don't really understand the other ways available to create a XPCPeerRequirement. I have also tried to use a XPCDictionary with XPCPeerRequirement(lightweightCodeRequirements:) but I can't get that to work either (and it seems a bit wrong to have to drop down to use e.g. xpc_object_t with new modern API:s). So my question is: is it possible to create a XPCPeerRequirement with an entitlement like above and, in that case, how? Or is there some other work-around to use XPCSession.setPeerRequirement() with a more complex requirement, e.g. is there a way to combine multiple XPCPeerRequirements into one? Thank you for reading this. /Peter

Notarization submission has been stuck in "In Progress" status for over 15 hours with no resolution. Hi there, I am trying to roll out distribution to paid users who are unable to receive anything from me for quite some time now, and I've read that notarization is quick. But I've found myself to be under quite a delay. Wondering if I could please get some help. Submission Details: ID: e3dff14c-16ab-41a7-a81c-0d1774c66588 Submitted: 2026-02-08T16:42:07.377Z File: Resonant-0.1.0-arm64.dmg (~200MB) Status: In Progress (stuck) Evidence: Upload completed successfully within minutes Delay is entirely server-side processing Same app structure notarized successfully on Feb 5 (submission f5f4c241) Multiple other submissions stuck since Feb 5 (see history below) Stuck Submissions (all "In Progress" for days): e3dff14c (Feb 8, 16:42 UTC) - 15+ hours 3e6bdcb5 (Feb 8, 16:11 UTC) - 16+ hours 37fd1b9f (Feb 8, 12:53 UTC) - 20+ hours f21a1d9b (Feb 8, 12:31 UTC) - 20+ hours (different app, Clippa.zip) 417244e8 (Feb 8, 06:18 UTC) - 26+ hours 891f370f (Feb 7, 11:44 UTC) - 2+ days 1debba51 (Feb 7, 05:44 UTC) - 2+ days 6a06b87f (Feb 6, 14:16 UTC) - 3+ days 9867261c (Feb 6, 13:44 UTC) - 3+ days 1a7c3967 (Feb 6, 12:58 UTC) - 3+ days Last Successful Notarization: f5f4c241 (Feb 5, 18:24 UTC) - Accepted in normal timeframe Impact: Unable to distribute production release. This is blocking critical bug fixes from reaching users. Expected Behavior: Notarization should complete within 2-10 minutes as documented and as experienced prior to Feb 5. Request: Please investigate why submissions are not being processed and either: Clear the backlog and process pending submissions Provide guidance on how to proceed with distribution

I'm experiencing a persistent issue where all my notarization submissions remain stuck in "In Progress" indefinitely. This is my first time notarizing an app. Environment: macOS 26.2 (Tahoe) Using xcrun notarytool submit Team ID: Y7T24GD249 App: Electron-based desktop application (~400MB) Stuck submissions (oldest to newest): 51412777-848c-4be1-a952-5ff32d6653f9 - Feb 4, 4:39 PM UTC (48+ hours) 9c4f94a1-d59a-4607-adf1-94c82fb4254b - Feb 4, 11:23 PM UTC 1c593512-ef55-4801-ba60-8b1bbc5a6f66 - Feb 4, 11:30 PM UTC de66e5cf-143c-40ec-ba62-2f07609044b4 - Feb 5, 1:39 PM UTC 964b2196-ad2e-4503-b15f-dc7f6a996ef0 - Feb 5, 2:25 PM UTC c8fdcccf-46cd-4609-bc33-faaa8fad696f - Feb 6, 5:11 PM UTC What I've tried: Verified Developer ID Application certificate is valid Checked code signatures with codesign -vvv --deep --strict Submitted both .zip and .dmg formats Checked Apple System Status (shows operational) notarytool log returns "Record not found" for all submissions Is there a known issue affecting first-time notarization, or could my account be flagged? Any help would be greatly appreciated.

Okay, I just pushed a release and notarized. Works great on my test laptop (macOS 26.2) and my test desktop (macOS 14.x) But it seems to fail for a friend who's running macOS 15. I've been using the same GitHub actions successfully for months. How can notarization work for macOS 14 and 26, but not for macOS 15? I think everything looks okay as far as the signing? I've checked codesign -dvv Executable=/Applications/Avogadro2.app/Contents/MacOS/Avogadro2 Identifier=cc.avogadro Format=app bundle with Mach-O thin (arm64) CodeDirectory v=20500 size=11607 flags=0x10000(runtime) hashes=352+7 location=embedded Signature size=8986 Authority=Developer ID Application: Geoffrey Hutchison (…..) Authority=Developer ID Certification Authority Authority=Apple Root CA Timestamp=Feb 5, 2026 at 8:47:21 PM Info.plist entries=24 TeamIdentifier=….. Runtime Version=15.5.0 Sealed Resources version=2 rules=13 files=3306 Internal requirements count=1 size=172 And from spctl -a -vv /Applications/Avogadro2.app: accepted source=Notarized Developer ID origin=Developer ID Application: Geoffrey Hutchison (….)

I'm submitting my first macOS app (a native SwiftUI menu bar app, signed with Developer ID Application certificate, Hardened Runtime enabled) for notarization using xcrun notarytool submit with keychain profile authentication. All 9 of my submissions have been stuck at "In Progress" for up to 16 hours. None have transitioned to "Accepted" or "Invalid." Logs are unavailable for all of them (notarytool log returns "Submission log is not yet available"). Environment macOS: 26.2 (25C56) Xcode: 26.1.1 (17B100) notarytool: 1.1.0 (39) App: Native SwiftUI, universal binary (x86_64 + arm64), ~2.2 MB DMG Bundle ID: com.gro.ask Team ID: 4KT56S2BX6 What I've verified Code signing is valid: $ codesign --verify --deep --strict GroAsk.app passes with no errors $ codesign -dvvv GroAsk.app Authority=Developer ID Application: Jack Wu (4KT56S2BX6) Authority=Developer ID Certification Authority Authority=Apple Root CA CodeDirectory flags=0x10000(runtime) # Hardened Runtime enabled Runtime Version=26.1.0 Format=app bundle with Mach-O universal (x86_64 arm64) Entitlements are minimal: com.apple.security.app-sandbox com.apple.security.network.client Uploads succeed — each submission receives a valid submission ID and the file uploads to Apple's servers without error. Submission history Created (UTC): 04:40 ID: eeb12389-... File: GroAsk-1.6.0.dmg Status: Invalid (Hardened Runtime missing — since fixed) ──────────────────────────────────────── Created (UTC): 04:42 ID: 6e537a32-... File: GroAsk-1.6.0.dmg Status: In Progress (16+ hrs) ──────────────────────────────────────── Created (UTC): 07:52 ID: 5ee41736-... File: GroAsk-1.6.0.dmg Status: In Progress ──────────────────────────────────────── Created (UTC): 08:19 ID: f5c6b9a5-... File: GroAsk-1.6.0.dmg Status: In Progress ──────────────────────────────────────── Created (UTC): 08:27 ID: 0f1c8333-... File: GroAsk-1.6.0.dmg Status: In Progress ──────────────────────────────────────── Created (UTC): 08:29 ID: 77fd9cd4-... File: GroAsk-1.6.0.dmg Status: In Progress ──────────────────────────────────────── Created (UTC): 08:51 ID: db9da93e-... File: GroAsk-1.6.1.dmg Status: In Progress ──────────────────────────────────────── Created (UTC): 09:05 ID: 3c43c09f-... File: GroAsk.zip Status: In Progress ──────────────────────────────────────── Created (UTC): 12:01 ID: b2267a74-... File: GroAsk-1.6.3.dmg Status: In Progress ──────────────────────────────────────── Created (UTC): 12:15 ID: ae41e45c-... File: GroAsk.zip Status: In Progress The very first submission (eeb12389) came back as Invalid within minutes because Hardened Runtime wasn't enabled on the binary. I fixed the build configuration and confirmed flags=0x10000(runtime) is present on all subsequent builds. However, every submission after that fix has been stuck at "In Progress" with no state transition. What I've tried Submitting both .dmg and .zip formats — same result Verified notarytool log — returns "Submission log is not yet available" for all stuck submissions Apple Developer System Status page shows the Notary Service as "Available" I've also emailed Apple Developer Support but have not received a response yet Questions Is this the expected behavior for a first-time notarization account? I've seen other threads mentioning that new accounts may be held for "in-depth analysis," but 16+ hours with zero feedback seems excessive. 2. Is there any manual configuration Apple needs to do on their end to unblock my team for notarization? 3. Should I stop submitting and wait, or is there something else I can try? Any guidance from DTS would be greatly appreciated. This is blocking the release of my app.

Hi guys, I am new to the Apple Developer Program (enrolled a few days ago) and this is my first app notarization attempt. I've been experiencing significant delays - all submissions have been stuck at "In Progress" for over 24 hours. Details: macOS app signed with Developer ID Application certificate Using xcrun notarytool with app-specific password Hardened runtime enabled codesign --verify --deep --strict passes Team ID: QVHM976XC5 Submission IDs (all stuck "In Progress"): 5f494a89-0db0-4cc6-944f-ca2fe399e870 (latest - 8+ hours) 938f6b8d-0d00-45f5-861d-68fe470df6c2 d0edcbfe-8464-455f-b077-bebaa5b9aab7 I understand new developers may experience longer initial processing, but 24+ hours seems excessive. Is there anything I should check or any additional steps required for new accounts? Any guidance appreciated.

We are experiencing notarization submissions that remain in the “In Progress” state for an extended period (over 24 hours), with no status transition and no submission log available. This is occurring in an automated CI environment using the Notary REST API (non-interactive submission and polling). Re-submitting the same package only results in additional submissions also stuck in “In Progress”. There does not appear to be any API mechanism to cancel, clear, or expire these submissions once they are created. We have already opened an Apple Developer Support case regarding this issue (Case ID: 102818066745 & 102819008943), but have not yet received clarification on what is causing these long-running “In Progress” states. This issue is impacting our production release pipeline, as we are unable to reliably complete notarization for signed packages within an expected timeframe. Based on other reports in this forum (including thread 811968), this behavior appears similar to cases where notarization requests were delayed due to backend backlog or in-depth analysis. We would appreciate clarification on the following: Is it expected behavior for notarization submissions to remain in “In Progress” for such a long period without logs? Is client-side timeout and re-submission the recommended handling for CI workflows? Are there known service-side conditions (e.g. analysis backlog) that could explain this behavior? Any guidance from Apple DTS or others who have encountered this would be greatly appreciated.

I'm submitting my first macOS app (an Electron app, signed with Developer ID Application certificate and hardened runtime) for notarization using xcrun notarytool submit with App Store Connect API key authentication. All 6 of my submissions have been stuck at "In Progress" for over 24 hours now. The oldest submission is 27+ hours old. None have transitioned to Accepted or Invalid. Here's what I've verified: Code signing is valid: codesign --verify --deep --strict passes Hardened runtime is enabled Uploads succeed: Each submission receives a valid submission ID and the file uploads successfully to Apple's servers API key auth is working: Using App Store Connect API key (.p8 file), Key ID, and Issuer ID Tried both locally and via GitHub Actions CI — same result Polling Apple's status endpoint eventually times out with NSURLErrorDomain Code=-1001 "The request timed out" when checking https://appstoreconnect.apple.com/notary/v2/submissions/<id> Logs are not available (notarytool log returns "not yet available" for all submissions) Apple Developer System Status shows "Developer ID Notary Service" as Available Submission history: createdDate: 2026-02-04T20:27:16Z — status: In Progress createdDate: 2026-02-04T16:45:18Z — status: In Progress createdDate: 2026-02-04T13:40:23Z — status: In Progress createdDate: 2026-02-04T12:29:52Z — status: In Progress createdDate: 2026-02-04T11:26:36Z — status: In Progress createdDate: 2026-02-04T11:21:39Z — status: In Progress Entitlements used: com.apple.security.cs.allow-jit com.apple.security.cs.allow-unsigned-executable-memory com.apple.security.cs.disable-library-validation com.apple.security.network.client com.apple.security.files.user-selected.read-write This is my first time notarizing any app on this developer account. I've seen other threads mentioning that first-time submissions can be "held for in-depth analysis," but 24+ hours with no feedback at all seems excessive. Is anyone else currently experiencing this? Is there anything I can do to unblock my account's notarization queue, or do I just need to wait? Any guidance from DTS would be greatly appreciated. I've also emailed Apple Developer Support but haven't received a response yet.

Hi Apple Developer Relations / Notary Service Team, CRITICAL: All notarization submissions stuck "In Progress" since Feb 1, 2026 (5+ days). Blocking product release. Latest (PRIORITY): 9bf1e3ca-33ed-4185-816c-2e06ff539f25 Stuck submissions: a9f1abf6-04a1-462c-b7d1-91e834b44c1a 94a172f8-4aa6-475c-a7ec-fd83c8cfc49a e2c033da-a1d0-480c-a3b5-5401a8dd3d03 eecefd87-8bf9-496c-86c8-c6f0d6a550e0 b1d27d30-7111-4cc7-9f0e-3f44aac43a97 Details: Team ID: JA8C8B5W34 App: 323MB DMG (codesign verified) notarytool log: "not available" (In Progress) Status page: Green Requests: Process 9bf1e3ca-33ed-4185-816c-2e06ff539f25 Queue status / ETA? @Quinn or Notary team - production blocker!

I'm trying to enable Music Kit for my key however I keep seeing this message "There are no identifiers available that can be associated with the key" even though my identifier has music kit enabled. Can someone help out with this?

Hi, we are sending MacOS apps packaged in a ZIP archive or DMG disk image to the Notary Service. Before we send the app for notarization, we check the code signature via command codesign -vvv --deep --strict /path/to/app_or_bundle The result is positive and it does not provide any gaps. (And yes, we are following the inside out code signing approach, mentioned at Using the codesign Tool's --deep Option Correctly) Unfortunately, the result of the Notary service provided that one file has no signature, which was not detected by the signature verification command. The path of the binary was in <app_name>.app.zip/<app_name>.app/Contents/Resources/inst/<binary> How I can be verify like a the Notary service does it on our side? Best regards, Stefan