I have a misterous problem with checking DMG notarization.
It fails:
bash-3.2$ spctl -a -t open --context context:primary-signature -v MyApp.dmg
MyApp: rejected
source=no usable signature
However this DMG installs fine on Big Sur 11.2.2, macOS allows to run this app, and checking of notarization for installed app was passed:
bash-3.2$ spctl -a -v '/Applications/MyApp.app'
/Applications/MyApp.app: accepted
source=Notarized Developer ID
I checked other downloaded apps (Intel or Universal). Some DMG files pass DMG notarization (for example, Audacity), and some fails (PerfectTablePlan). Why?
For my app (Universal) I use the following code to codesign and notarize:
codesign --timestamp --options runtime --force --deep -s "Developer ID Application: MYCOMPANY" "My.app"
// Creating DMG with EULA license
xcrun altool --notarize-app --primary-bundle-id MyApp -u "my@email.com" -p "abc123" --file MyApp.dmg
xcrun stapler staple MyApp.dmg
Notarization
RSS for tagNotarization is the process of scanning Developer ID-signed software for malicious components before distribution outside of the Mac App Store.
Selecting any option will automatically load the page
Post
Replies
Boosts
Views
Activity
Hi there, this is the first time I submitted a Mac app for notarization but looks like all my submissions are stuck in in progress for like one day at the moment. Can anyone help take a look?
This is my submission history:
Successfully received submission history.
history
--------------------------------------------------
createdDate: 2025-01-16T00:23:18.445Z
id: 0581680c-9cfe-4e5b-9cc9-3ba101c9fd52
name: MiniCalendar.zip
status: In Progress
--------------------------------------------------
createdDate: 2025-01-15T05:12:13.480Z
id: 55a03297-491b-4d30-8126-45d488a6beb9
name: MiniCalendar.zip
status: In Progress
--------------------------------------------------
createdDate: 2025-01-15T04:27:40.510Z
id: 092f558f-01d0-48e5-9761-58dda54de23c
name: MiniCalendar.zip
status: In Progress
--------------------------------------------------
createdDate: 2025-01-15T01:12:55.923Z
id: 3aa74a6f-bcb8-4911-9d18-fcbb3e9a6c11
name: MiniCalendar.zip
status: In Progress
A few hours ago, it took 3 minutes to get the notarization phase of our build done... now I've got one that's been running for 25 minutes and hasn't finished yet. The last time this happened, the waits got up to multiple hours, and the status page didn't get updated.
Hi Apple team,
I have a recently created dev account and submitted two different 20-30 mb .apps for notary through the notary tool. I have read that this should only take minutes at this size of an app but both have been stuck in progress for almost 24+ hours.
Below are the UUIDs of the notary submissions. Also I tried re-submitting but these are also stuck in progress.
Successfully received submission history.
history
--------------------------------------------------
createdDate: 2025-09-26T11:46:32.643Z
id: 9714758e-e216-496d-80f8-422f77011ebe
name: <>.zip
status: In Progress
--------------------------------------------------
createdDate: 2025-09-25T21:48:46.161Z
id: c2a81300-c903-4277-8ef3-70205a690c76
name: <>.zip
status: In Progress
--------------------------------------------------
createdDate: 2025-09-25T18:24:36.205Z
id: 42742be1-c7e5-4483-a2c5-95e89086d070
name: <>.zip
status: In Progress
--------------------------------------------------
createdDate: 2025-09-25T16:35:09.059Z
id: a404256e-40c2-4dca-97fc-983e70ea4b7b
name: <>.zip
status: In Progress
Keys can vary; an account is not necessary, as only Team Keys are suitable for notarization.
It seems that Developer role is sufficient for notarization.
We have tried both keys and roles of Developer and Account Manager - the behavior is the same.
Multiline
There are two types of API keys:
Team
Access to all apps, with varying levels of access based on selected roles.
Individual
Access and roles of the associated user. Individual kevs aren't able to use Provisioning endpoints, access Sales and
Finance, or notaryTool.
BlockQuote
Here are the parameters used for notarization via API key:
`-k, --key key-path
App Store Connect API key. File system path to the private key.
-d, --key-id key-id
App Store Connect API Key ID. For most teams this will be a 10 character alphanumeric string.
-i, --issuer issuer
App Store Connect API Issuer ID. The issuer ID is a UUID format string.`
The notarization result shows as successful, and on the same machine, the package appears as notarized.
However, when the package is transferred to another system, it is displayed as not notarized.
Normally I get a response from a submit via notarytool within 30 seconds. Today - with a process that worked a few days ago - I don't get any answer, although the system status claims that the service is up and work.
Anybody else, or is it only me?
Hello,
For my macOS app,
on Xcode version 15.4 (15F31d)
on macOS 14.5 (23F79)
I follow
Organizer > Distribute App > Direct Distribution, and I get a Notary Error "The operation couldn't be completed. (SotoS3.S3ErrorType.multipart error 1.)"
It's been happening since 3 days.
In the IDEDistribution.verbose.log file I see:
https://gist.github.com/atacan/5dec7a5e26dde0ec06a5bc4eb3607461
This has been going on for at least a couple of hours for us: notarizing doesn't complete. Our last job ran for over 90 minutes before CircleCI timed it out. We're using xcrun notarytool submit with the --wait option; it contined to say "Current status: In Progress" for, as I said, 90 minutes or so. (Normally it takes about 70 seconds.)
https://developer.apple.com/system-status/ says everything is normal. This does not seem to be the case for us. 😄
Hi, overnight I'm getting "HTTP status code: 403. Invalid or inaccessible developer team ID for the provided Apple ID. Ensure the Team ID is correct and that you are a member of that team." in my pipeline running notarytool store-credentials. I'm getting --apple-id, --team-id and --password from CI variables. Double checked the values (even though they shouldn't change). Tried a new app specific password
I did not change anything to cause this and my apple developer account is active. Really scratching my head what's going on here. Some assistance would be greatly appreciated!
Topic:
Code Signing
SubTopic:
Notarization
Hello,
I am trying without luck to create a .dmg or .pkg for my electron app that can be opened by any user on a mac. Every time I fail. All is happening by the same pattern. Here is the last try with creating a .pkg instead of .dmg.
The app is built and it is signed correctly (I suppose)
codesign --verify --verbose=1 dist/mac-universal/VIVIDTIME.app
dist/mac-universal/VIVIDTIME.app: valid on disk
dist/mac-universal/VIVIDTIME.app: satisfies its Designated Requirement
I created a .pkg
pkgbuild --root "dist/mac-universal/VIVIDTIME.app" \
--install-location "/Applications/VIVIDTIME.app" \
--identifier "app.vividtime.mac" \
--version "1.1.0" \
--sign "Developer ID Installer: Pavel Bochkov-Rastopchin (2QKDCTR5Y3)" \
dist/VIVIDTIME.pkg
pkgbuild: Inferring bundle components from contents of dist/mac-universal/VIVIDTIME.app
pkgbuild: Adding component at Contents/Frameworks/Mantle.framework
pkgbuild: Adding component at Contents/Frameworks/VIVIDTIME Helper.app
pkgbuild: Adding component at Contents/Frameworks/VIVIDTIME Helper (GPU).app
pkgbuild: Adding component at Contents/Frameworks/Electron Framework.framework
pkgbuild: Adding component at Contents/Frameworks/Squirrel.framework
pkgbuild: Adding component at Contents/Frameworks/VIVIDTIME Helper (Renderer).app
pkgbuild: Adding component at Contents/Frameworks/VIVIDTIME Helper (Plugin).app
pkgbuild: Adding component at Contents/Frameworks/ReactiveObjC.framework
pkgbuild: Using timestamp authority for signature
pkgbuild: Signing package with identity "Developer ID Installer: Pavel Bochkov-Rastopchin (2QKDCTR5Y3)" from keychain /Users/innrvoice/Library/Keychains/login.keychain-db
pkgbuild: Adding certificate "Developer ID Certification Authority"
pkgbuild: Adding certificate "Apple Root CA"
pkgbuild: Wrote package to dist/VIVIDTIME.pkg
Topic:
Code Signing
SubTopic:
Notarization
I've tried to notarize my app recently and got the error:{
"logFormatVersion": 1,
"jobId": "...",
"status": "Rejected",
"statusSummary": "Team is not yet configured for notarization",
"statusCode": 7000,
"archiveFilename": "myapp.dmg",
"uploadDate": "2019-06-20T06:24:53Z",
"sha256": "...",
"ticketContents": null,
"issues": null
}I've never heard about "team configuration for notarization" previously. What are the steps to resolve that issue?Thanks in advance.