Demystify code signing and its importance in app development. Get help troubleshooting code signing issues and ensure your app is properly signed for distribution.

All subtopics
Posts under Code Signing topic

Post

Replies

Boosts

Views

Created

How to get url-filter-provider entitlement approved for App Store distribution?
I'm building a content filtering app using NEURLFilterManager and NEURLFilterControlProvider (introduced in iOS 26). The app uses a PIR server for privacy-preserving URL filtering. Everything works with development-signed builds, but App Store export validation rejects: Entitlement value "url-filter-provider" for com.apple.developer.networking.networkextension — "not supported on iOS" I have "Network Extensions" enabled on my App IDs in the developer portal, but the provisioning profiles don't seem to include url-filter-provider, and I don't see a URL filter option in the Capability Requests tab. What I've tried: Entitlement values: url-filter-provider, url-filter — both rejected at export Extension points: com.apple.networkextension.url-filter, com.apple.networkextension.url-filter-control — both rejected Regenerating provisioning profiles after enabling Network Extensions capability My setup: iOS 26, Xcode 26 Main app bundle: com.pledgelock.app URL filter extension bundle: com.pledgelock.app.url-filter PIR server deployed and functional Is there a specific request or approval process needed for the url-filter-provider entitlement? The WWDC25 session "Filter and tunnel network traffic with NetworkExtension" mentions this entitlement but I can't find documentation on how to get it approved for distribution. Any guidance appreciated. Thanks!
1
0
285
Feb ’26
Unable to submit a Capability Request
In the Developer portal, I'm attempting to add the "DriverKit UserClient Access" to an App ID that is assigned to a DEXT that we are developing. Once I have filled out the form and clicked "Submit" the screen goes bank and stays blank even after a long delay. The original Capability Request tab's entry for "DriverKit UserClient Access" never changes from "No Requests". I have tried this on two successive days, with the same result.
1
0
94
Feb ’26
Locked Camera Capture Extension: provisioning profile for ExtensionKit appex missing com.apple.developer.locked-camera-capture entitlement (paid team)
I’m attempting to use a Locked Camera Capture Extension (created from Xcode’s template / following Apple’s “Creating a camera experience for the Lock Screen” guidance). The extension builds, embeds, and installs on a physical device, but I cannot get it provisioned with the required entitlement com.apple.developer.locked-camera-capture. Environment Xcode: 26.0.1 (17A400) iOS: 26.2.1 (device) Apple Developer Program: paid Individual (Team ID: FT55UW9363) Key issue: provisioning profile for the ExtensionKit appex lacks the locked-camera entitlement The locked camera capture target is embedded as an ExtensionKit extension: .../DirectionalCamera.app/Extensions/LockedCapture.appex I decoded the embedded provisioning profile inside that .appex and printed its Entitlements dictionary: security cms -D -i ".../DirectionalCamera.app/Extensions/LockedCapture.appex/embedded.mobileprovision" > /tmp/locked_profile.plist /usr/libexec/PlistBuddy -c "Print:Entitlements" /tmp/locked_profile.plist Entitlements present in the embedded profile: Dict { com.apple.developer.avfoundation.multitasking-camera-access = true application-identifier = FT55UW9363.arp.geocam.LockedCapture keychain-access-groups = Array { FT55UW9363.* com.apple.token } get-task-allow = true com.apple.security.application-groups = Array { group.arp.geocam } com.apple.developer.team-identifier = FT55UW9363 } Critically, the required entitlement is absent: /usr/libexec/PlistBuddy -c "Print:Entitlements:com.apple.developer.locked-camera-capture" /tmp/locked_profile.plist Print: Entry, ":Entitlements:com.apple.developer.locked-camera-capture", Does Not Exist Build behavior If I manually add com.apple.developer.locked-camera-capture to the extension’s .entitlements, Xcode refuses to sign with: “Provisioning profile failed qualification: Profile doesn't include the com.apple.developer.locked-camera-capture entitlement.” Notes The only other embedded extension is a widget/control extension under .../DirectionalCamera.app/PlugIns/... with a separate profile (expected). Question Has anyone successfully provisioned a Locked Camera Capture Extension on a standard paid developer account? Is com.apple.developer.locked-camera-capture gated/restricted (requiring Apple to enable it for a specific Team ID / App ID), or is there a specific capability in the Developer portal that maps to it? If it’s restricted, what is the official process to request enablement for a team/app-id? Any pointers appreciated.
2
0
184
Feb ’26
Duplicate Certificates Cause codesign errSecInternalComponent failures
Original Problem We use codesign and notarytool in a scripted environment to build and distribute binaries daily. We also do manual builds by logging into the build server using SSH. This has been working for many years, but after updating to a new "Developer ID Application" certificate, codesign was failing with errSecInternalComponent and the console logs showed errSecInteractionNotAllowed. Summary of Resolution Attempting to fix the problem resulted in multiple copies of the same Certificate which were NOT shown by Keychain Access. I had to run security delete-identity multiple times to clear out the redundant Identities and then imported the certificate using the security CLI tool. Details I originally followed these instructions for requesting and installing a new certificate: https://developer.apple.com/help/account/certificates/create-developer-id-certificates/ Tip: Use the security tool intead These instructions fail to mention two critical points: 1) they assume the machine you generate the request on is the same machine you will be using to perform signatures, and 2) KeyChain Access does not allow you to set permissions for applications like codesign. I made the mistake of following the instructions on my workstation, and then tried to import the certificate to the build machine by double clicking on the .cer file. When that did not work, I followed various forum suggestions and eventually realized I need to export the private key as a .p12 file from the workstation, and import it into the build machine. Tip: The term "Certificate" often refers to a public certificate by itself, while "Identity" to refers to the combination of a public certificate and private key. At this point, I could use codesign, but only within Terminal.app while logged into the build machine's console. I tried various security commands to reimport the Identity, set a key partition list, and unlock the keychain, but none of them allowed codesign to work from within SSH or cron scripts. Eventually I stumbled upon this: sudo security find-identity -v Password: 1) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 2) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 3) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 4) EA377…96DD "Developer ID Application: Data Expedition, Inc. (VK…8X)" 5) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 6) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 7) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 8) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 9) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 10) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 10 valid identities found Keychain Access only showed one copy of the Identity in each keychain, but with security I could see there were actually 9. Tip: Keychain Access does not accurately display keychain contents. If it shows no contents at all, type a letter in the search box. Identities are distinguished from lone Certificates by a drop-down caret to the left of the certificate name. Clicking that shows the key. To fix the redundant Identities, I had to run this command four times to delete the nine copies: security delete-identity -Z 3C255…1560 I repeated this until the identity (I used the SHA1 hash of the certificate) no longer showed up in security find-identity -v. I then re-imported the certificate and key using security import, which is what I should have done from the begininng. The Correct Way Here are the commands I used to get things going after I deleted all the problem certificates: security import mycertificate.cer -k /Library/Keychains/System.keychain -T /usr/bin/codesign This next command I ran in Terminal.app on the console so it could display a password prompt: security import ImportThisKey.p12 -k /Library/Keychains/System.keychain -T /usr/bin/codesign After this, I used security find-identity -v to verify that there was only one copy of the Identity. I then verified that codesign could be used from SSH and cron-scripts even while logged out of the console. I suspect that a lot of mysterious certificate problems might be caused by duplicate certificates, each with different permissions. As far as I can tell, there is no way to uniquely identify a certificate/identity or the permissions attached to them. The system just searches based on hash, or team-id, or other non-unique property and seems to just arbitrarily pick one. I hope this helps someone else stuck with errSecInternalComponent errors!
1
0
151
Feb ’26
MusicKit entitlement consistently missing from generated Ad Hoc Profile despite App Services configuration
Hi everyone, I am attempting to generate an Ad Hoc provisioning profile for my iOS app that includes MusicKit capabilities, but the generated .mobileprovision file consistently lacks the required entitlement, despite the configuration appearing correct in the developer portal. The Issue: I have enabled MusicKit under the "App Services" tab for my App ID. I have saved this configuration, verified it is checked in the UI, and then regenerated and downloaded my provisioning profile. However, when I inspect the internal contents of the .mobileprovision file, the Entitlements dictionary does not contain the com.apple.developer.music-kit key. It only contains the standard keys (Team ID, App ID, etc.). Steps Taken: Created a brand new App ID to rule out legacy data issues. Explicitly enabled "MusicKit" under the App Services tab for this new identifier. Created a fresh Ad Hoc Distribution profile linked to this new ID. Downloaded the profile and inspected the file structure: the MusicKit entitlement is completely absent. Attempted toggling the service off and on, saving, and regenerating the profile multiple times. Has anyone experienced a specific bug where "App Services" (like MusicKit) fail to propagate to the Provisioning Profile generator? Is there a secondary "Capability" (e.g., Media Library) that must also be enabled to trigger the inclusion of the MusicKit entitlement? Any guidance would be appreciated.
2
1
229
Feb ’26
Notarization rejected after in progress for 5 days
I am trying to notarize my app but it rejected with this error after 5 days of being in progress. { "logFormatVersion": 1, "jobId": "8291ad9e-4c8e-4974-8753-af1a78e5a4a2", "status": "Rejected", "statusSummary": "Team is not yet configured for notarization. Please contact Developer Programs Support at developer.apple.com under the topic Development and Technical / Other Development or Technical Questions.", "statusCode": 7000, "archiveFilename": "SkanVirtualAssistant-1.0.0.dmg", "uploadDate": "2026-02-05T03:13:41.280Z", "sha256": "eb95cc25a382e5ce36fc2b7e195c20a1a09cfbfb71a057e754306ad400300d38", "ticketContents": null, "issues": null } Can anyone help with this? I have an urgent product launch deadline in a week! I have contacted developer program support but have received no response.
1
0
149
Feb ’26
3 days almost now stuck in progress no logs generated
Not accepted yet (all are still processing, none are rejected) 387af103-42d3-4d95-ae22-0289f90a8559 — In Progress 2d836594-9fb2-41a5-990c-7ea4e0870af0 — In Progress e61ba9e3-5ff1-4856-8e9d-39c08445ff63 — In Progress 1defdeec-50b4-45c5-b32d-53ca6e4538bb — In Progress 34e60b80-20c3-4ea7-93a7-2bb9e7c6f05c — In Progress 09222b71-eae1-4c5c-aca4-368f697b2a39 — In Progress eb5327e8-161e-4185-9920-3facf60b7b4b — In Progress 784fc210-d0bf-4924-b0a6-eb8bbac0f2c8 — In Progress 74bc8f31-b1b0-4bed-9142-0c03100a062a — In Progress 4739620c-894a-4283-a43b-df57b29a1771 — In Progress have created new certificate as well same result. waiting for apple support to give any answers.
1
0
327
Feb ’26
No certificate for team '' matching 'Developer ID Application' found
When completing signing on Xcode, it shows the following error message "No certificate for team '' matching 'Developer ID Application' found" I have already followed the steps to generate a certificate from keychain and made a new certificate on developer portal, along with its associated provisioning profile. Viewing "Manage Certificate" window shows the newly created certificate, but Xcode seems to not be able to locate it.
1
0
255
Feb ’26
How can I create a more complex XPCPeerRequirement?
I have been updating some NSXPCConnection code in my macOS 26 app (not sandboxed) to use XPCSession and friends instead. And it is working well and the experience has been generally good. But I have run into a problem when using XPCSession.setPeerRequirement() which I really want to use. It works well when I use something simple like XPCPeerRequirement.isFromSameTeam() but I want to check some more requirements and also use the code from multiple apps (but same team). That is, I want to check for multiple identifiers and team ID and version (and perhaps also in the future that the certificate is a Developer ID). And previously I would use SecRequirementCreateWithString with an entitlement string conceptually like this: var entitlement = "anchor apple generic and (" entitlement += "identifier idA" entitlement += " or identifier idB" entitlement += ")" entitlement += " and certificate leaf[subject.OU] = TeamID" entitlement += #" and info [CFBundleShortVersionString] >= "1.0""# and it works just as it should when creating and using that SecRequirement so I don't think that there is anything particularly wrong with the entitlement. And I had hoped that I could use the same string with XPCPeerRequirement.hasEntitlement(entitlement) but it doesn't work (I get a general "Peer forbidden" error). So I think that I don't really understand what sort of entitlement that hasEntitlement() wants. And also I don't really understand the other ways available to create a XPCPeerRequirement. I have also tried to use a XPCDictionary with XPCPeerRequirement(lightweightCodeRequirements:) but I can't get that to work either (and it seems a bit wrong to have to drop down to use e.g. xpc_object_t with new modern API:s). So my question is: is it possible to create a XPCPeerRequirement with an entitlement like above and, in that case, how? Or is there some other work-around to use XPCSession.setPeerRequirement() with a more complex requirement, e.g. is there a way to combine multiple XPCPeerRequirements into one? Thank you for reading this. /Peter
1
0
342
Feb ’26
"Notarization stuck in 'In Progress' for 15+ hours - submission e3dff14c-16ab-41a7-a81c-0d1774c66588"
Notarization submission has been stuck in "In Progress" status for over 15 hours with no resolution. Hi there, I am trying to roll out distribution to paid users who are unable to receive anything from me for quite some time now, and I've read that notarization is quick. But I've found myself to be under quite a delay. Wondering if I could please get some help. Submission Details: ID: e3dff14c-16ab-41a7-a81c-0d1774c66588 Submitted: 2026-02-08T16:42:07.377Z File: Resonant-0.1.0-arm64.dmg (~200MB) Status: In Progress (stuck) Evidence: Upload completed successfully within minutes Delay is entirely server-side processing Same app structure notarized successfully on Feb 5 (submission f5f4c241) Multiple other submissions stuck since Feb 5 (see history below) Stuck Submissions (all "In Progress" for days): e3dff14c (Feb 8, 16:42 UTC) - 15+ hours 3e6bdcb5 (Feb 8, 16:11 UTC) - 16+ hours 37fd1b9f (Feb 8, 12:53 UTC) - 20+ hours f21a1d9b (Feb 8, 12:31 UTC) - 20+ hours (different app, Clippa.zip) 417244e8 (Feb 8, 06:18 UTC) - 26+ hours 891f370f (Feb 7, 11:44 UTC) - 2+ days 1debba51 (Feb 7, 05:44 UTC) - 2+ days 6a06b87f (Feb 6, 14:16 UTC) - 3+ days 9867261c (Feb 6, 13:44 UTC) - 3+ days 1a7c3967 (Feb 6, 12:58 UTC) - 3+ days Last Successful Notarization: f5f4c241 (Feb 5, 18:24 UTC) - Accepted in normal timeframe Impact: Unable to distribute production release. This is blocking critical bug fixes from reaching users. Expected Behavior: Notarization should complete within 2-10 minutes as documented and as experienced prior to Feb 5. Request: Please investigate why submissions are not being processed and either: Clear the backlog and process pending submissions Provide guidance on how to proceed with distribution
1
0
337
Feb ’26
Notarization stuck "In Progress" for 48+ hours - 6 submissions (Team ID: Y7T24GD249)
I'm experiencing a persistent issue where all my notarization submissions remain stuck in "In Progress" indefinitely. This is my first time notarizing an app. Environment: macOS 26.2 (Tahoe) Using xcrun notarytool submit Team ID: Y7T24GD249 App: Electron-based desktop application (~400MB) Stuck submissions (oldest to newest): 51412777-848c-4be1-a952-5ff32d6653f9 - Feb 4, 4:39 PM UTC (48+ hours) 9c4f94a1-d59a-4607-adf1-94c82fb4254b - Feb 4, 11:23 PM UTC 1c593512-ef55-4801-ba60-8b1bbc5a6f66 - Feb 4, 11:30 PM UTC de66e5cf-143c-40ec-ba62-2f07609044b4 - Feb 5, 1:39 PM UTC 964b2196-ad2e-4503-b15f-dc7f6a996ef0 - Feb 5, 2:25 PM UTC c8fdcccf-46cd-4609-bc33-faaa8fad696f - Feb 6, 5:11 PM UTC What I've tried: Verified Developer ID Application certificate is valid Checked code signatures with codesign -vvv --deep --strict Submitted both .zip and .dmg formats Checked Apple System Status (shows operational) notarytool log returns "Record not found" for all submissions Is there a known issue affecting first-time notarization, or could my account be flagged? Any help would be greatly appreciated.
4
0
171
Feb ’26
Notarized but Gatekeeper fails macOS 15 only?
Okay, I just pushed a release and notarized. Works great on my test laptop (macOS 26.2) and my test desktop (macOS 14.x) But it seems to fail for a friend who's running macOS 15. I've been using the same GitHub actions successfully for months. How can notarization work for macOS 14 and 26, but not for macOS 15? I think everything looks okay as far as the signing? I've checked codesign -dvv Executable=/Applications/Avogadro2.app/Contents/MacOS/Avogadro2 Identifier=cc.avogadro Format=app bundle with Mach-O thin (arm64) CodeDirectory v=20500 size=11607 flags=0x10000(runtime) hashes=352+7 location=embedded Signature size=8986 Authority=Developer ID Application: Geoffrey Hutchison (…..) Authority=Developer ID Certification Authority Authority=Apple Root CA Timestamp=Feb 5, 2026 at 8:47:21 PM Info.plist entries=24 TeamIdentifier=….. Runtime Version=15.5.0 Sealed Resources version=2 rules=13 files=3306 Internal requirements count=1 size=172 And from spctl -a -vv /Applications/Avogadro2.app: accepted source=Notarized Developer ID origin=Developer ID Application: Geoffrey Hutchison (….)
1
0
425
Feb ’26
All notarization submissions stuck "In Progress" — first-time notarization, 9 submissions over 16+ hours
I'm submitting my first macOS app (a native SwiftUI menu bar app, signed with Developer ID Application certificate, Hardened Runtime enabled) for notarization using xcrun notarytool submit with keychain profile authentication. All 9 of my submissions have been stuck at "In Progress" for up to 16 hours. None have transitioned to "Accepted" or "Invalid." Logs are unavailable for all of them (notarytool log returns "Submission log is not yet available"). Environment macOS: 26.2 (25C56) Xcode: 26.1.1 (17B100) notarytool: 1.1.0 (39) App: Native SwiftUI, universal binary (x86_64 + arm64), ~2.2 MB DMG Bundle ID: com.gro.ask Team ID: 4KT56S2BX6 What I've verified Code signing is valid: $ codesign --verify --deep --strict GroAsk.app passes with no errors $ codesign -dvvv GroAsk.app Authority=Developer ID Application: Jack Wu (4KT56S2BX6) Authority=Developer ID Certification Authority Authority=Apple Root CA CodeDirectory flags=0x10000(runtime) # Hardened Runtime enabled Runtime Version=26.1.0 Format=app bundle with Mach-O universal (x86_64 arm64) Entitlements are minimal: com.apple.security.app-sandbox com.apple.security.network.client Uploads succeed — each submission receives a valid submission ID and the file uploads to Apple's servers without error. Submission history Created (UTC): 04:40 ID: eeb12389-... File: GroAsk-1.6.0.dmg Status: Invalid (Hardened Runtime missing — since fixed) ──────────────────────────────────────── Created (UTC): 04:42 ID: 6e537a32-... File: GroAsk-1.6.0.dmg Status: In Progress (16+ hrs) ──────────────────────────────────────── Created (UTC): 07:52 ID: 5ee41736-... File: GroAsk-1.6.0.dmg Status: In Progress ──────────────────────────────────────── Created (UTC): 08:19 ID: f5c6b9a5-... File: GroAsk-1.6.0.dmg Status: In Progress ──────────────────────────────────────── Created (UTC): 08:27 ID: 0f1c8333-... File: GroAsk-1.6.0.dmg Status: In Progress ──────────────────────────────────────── Created (UTC): 08:29 ID: 77fd9cd4-... File: GroAsk-1.6.0.dmg Status: In Progress ──────────────────────────────────────── Created (UTC): 08:51 ID: db9da93e-... File: GroAsk-1.6.1.dmg Status: In Progress ──────────────────────────────────────── Created (UTC): 09:05 ID: 3c43c09f-... File: GroAsk.zip Status: In Progress ──────────────────────────────────────── Created (UTC): 12:01 ID: b2267a74-... File: GroAsk-1.6.3.dmg Status: In Progress ──────────────────────────────────────── Created (UTC): 12:15 ID: ae41e45c-... File: GroAsk.zip Status: In Progress The very first submission (eeb12389) came back as Invalid within minutes because Hardened Runtime wasn't enabled on the binary. I fixed the build configuration and confirmed flags=0x10000(runtime) is present on all subsequent builds. However, every submission after that fix has been stuck at "In Progress" with no state transition. What I've tried Submitting both .dmg and .zip formats — same result Verified notarytool log — returns "Submission log is not yet available" for all stuck submissions Apple Developer System Status page shows the Notary Service as "Available" I've also emailed Apple Developer Support but have not received a response yet Questions Is this the expected behavior for a first-time notarization account? I've seen other threads mentioning that new accounts may be held for "in-depth analysis," but 16+ hours with zero feedback seems excessive. 2. Is there any manual configuration Apple needs to do on their end to unblock my team for notarization? 3. Should I stop submitting and wait, or is there something else I can try? Any guidance from DTS would be greatly appreciated. This is blocking the release of my app.
2
0
240
Feb ’26
notarization stuck in progress > 24hrs
Hi guys, I am new to the Apple Developer Program (enrolled a few days ago) and this is my first app notarization attempt. I've been experiencing significant delays - all submissions have been stuck at "In Progress" for over 24 hours. Details: macOS app signed with Developer ID Application certificate Using xcrun notarytool with app-specific password Hardened runtime enabled codesign --verify --deep --strict passes Team ID: QVHM976XC5 Submission IDs (all stuck "In Progress"): 5f494a89-0db0-4cc6-944f-ca2fe399e870 (latest - 8+ hours) 938f6b8d-0d00-45f5-861d-68fe470df6c2 d0edcbfe-8464-455f-b077-bebaa5b9aab7 I understand new developers may experience longer initial processing, but 24+ hours seems excessive. Is there anything I should check or any additional steps required for new accounts? Any guidance appreciated.
6
1
596
Feb ’26
Notarization submissions stuck in “In Progress” for >24 hours (CI / REST API) – production impact
We are experiencing notarization submissions that remain in the “In Progress” state for an extended period (over 24 hours), with no status transition and no submission log available. This is occurring in an automated CI environment using the Notary REST API (non-interactive submission and polling). Re-submitting the same package only results in additional submissions also stuck in “In Progress”. There does not appear to be any API mechanism to cancel, clear, or expire these submissions once they are created. We have already opened an Apple Developer Support case regarding this issue (Case ID: 102818066745 & 102819008943), but have not yet received clarification on what is causing these long-running “In Progress” states. This issue is impacting our production release pipeline, as we are unable to reliably complete notarization for signed packages within an expected timeframe. Based on other reports in this forum (including thread 811968), this behavior appears similar to cases where notarization requests were delayed due to backend backlog or in-depth analysis. We would appreciate clarification on the following: Is it expected behavior for notarization submissions to remain in “In Progress” for such a long period without logs? Is client-side timeout and re-submission the recommended handling for CI workflows? Are there known service-side conditions (e.g. analysis backlog) that could explain this behavior? Any guidance from Apple DTS or others who have encountered this would be greatly appreciated.
5
1
531
Feb ’26
All notarization submissions stuck "In Progress" for 24+ hours — first-time Electron app
I'm submitting my first macOS app (an Electron app, signed with Developer ID Application certificate and hardened runtime) for notarization using xcrun notarytool submit with App Store Connect API key authentication. All 6 of my submissions have been stuck at "In Progress" for over 24 hours now. The oldest submission is 27+ hours old. None have transitioned to Accepted or Invalid. Here's what I've verified: Code signing is valid: codesign --verify --deep --strict passes Hardened runtime is enabled Uploads succeed: Each submission receives a valid submission ID and the file uploads successfully to Apple's servers API key auth is working: Using App Store Connect API key (.p8 file), Key ID, and Issuer ID Tried both locally and via GitHub Actions CI — same result Polling Apple's status endpoint eventually times out with NSURLErrorDomain Code=-1001 "The request timed out" when checking https://appstoreconnect.apple.com/notary/v2/submissions/<id> Logs are not available (notarytool log returns "not yet available" for all submissions) Apple Developer System Status shows "Developer ID Notary Service" as Available Submission history: createdDate: 2026-02-04T20:27:16Z — status: In Progress createdDate: 2026-02-04T16:45:18Z — status: In Progress createdDate: 2026-02-04T13:40:23Z — status: In Progress createdDate: 2026-02-04T12:29:52Z — status: In Progress createdDate: 2026-02-04T11:26:36Z — status: In Progress createdDate: 2026-02-04T11:21:39Z — status: In Progress Entitlements used: com.apple.security.cs.allow-jit com.apple.security.cs.allow-unsigned-executable-memory com.apple.security.cs.disable-library-validation com.apple.security.network.client com.apple.security.files.user-selected.read-write This is my first time notarizing any app on this developer account. I've seen other threads mentioning that first-time submissions can be "held for in-depth analysis," but 24+ hours with no feedback at all seems excessive. Is anyone else currently experiencing this? Is there anything I can do to unblock my account's notarization queue, or do I just need to wait? Any guidance from DTS would be greatly appreciated. I've also emailed Apple Developer Support but haven't received a response yet.
17
4
1.5k
Feb ’26
How to get url-filter-provider entitlement approved for App Store distribution?
I'm building a content filtering app using NEURLFilterManager and NEURLFilterControlProvider (introduced in iOS 26). The app uses a PIR server for privacy-preserving URL filtering. Everything works with development-signed builds, but App Store export validation rejects: Entitlement value "url-filter-provider" for com.apple.developer.networking.networkextension — "not supported on iOS" I have "Network Extensions" enabled on my App IDs in the developer portal, but the provisioning profiles don't seem to include url-filter-provider, and I don't see a URL filter option in the Capability Requests tab. What I've tried: Entitlement values: url-filter-provider, url-filter — both rejected at export Extension points: com.apple.networkextension.url-filter, com.apple.networkextension.url-filter-control — both rejected Regenerating provisioning profiles after enabling Network Extensions capability My setup: iOS 26, Xcode 26 Main app bundle: com.pledgelock.app URL filter extension bundle: com.pledgelock.app.url-filter PIR server deployed and functional Is there a specific request or approval process needed for the url-filter-provider entitlement? The WWDC25 session "Filter and tunnel network traffic with NetworkExtension" mentions this entitlement but I can't find documentation on how to get it approved for distribution. Any guidance appreciated. Thanks!
Replies
1
Boosts
0
Views
285
Activity
Feb ’26
Unable to submit a Capability Request
In the Developer portal, I'm attempting to add the "DriverKit UserClient Access" to an App ID that is assigned to a DEXT that we are developing. Once I have filled out the form and clicked "Submit" the screen goes bank and stays blank even after a long delay. The original Capability Request tab's entry for "DriverKit UserClient Access" never changes from "No Requests". I have tried this on two successive days, with the same result.
Replies
1
Boosts
0
Views
94
Activity
Feb ’26
Locked Camera Capture Extension: provisioning profile for ExtensionKit appex missing com.apple.developer.locked-camera-capture entitlement (paid team)
I’m attempting to use a Locked Camera Capture Extension (created from Xcode’s template / following Apple’s “Creating a camera experience for the Lock Screen” guidance). The extension builds, embeds, and installs on a physical device, but I cannot get it provisioned with the required entitlement com.apple.developer.locked-camera-capture. Environment Xcode: 26.0.1 (17A400) iOS: 26.2.1 (device) Apple Developer Program: paid Individual (Team ID: FT55UW9363) Key issue: provisioning profile for the ExtensionKit appex lacks the locked-camera entitlement The locked camera capture target is embedded as an ExtensionKit extension: .../DirectionalCamera.app/Extensions/LockedCapture.appex I decoded the embedded provisioning profile inside that .appex and printed its Entitlements dictionary: security cms -D -i ".../DirectionalCamera.app/Extensions/LockedCapture.appex/embedded.mobileprovision" > /tmp/locked_profile.plist /usr/libexec/PlistBuddy -c "Print:Entitlements" /tmp/locked_profile.plist Entitlements present in the embedded profile: Dict { com.apple.developer.avfoundation.multitasking-camera-access = true application-identifier = FT55UW9363.arp.geocam.LockedCapture keychain-access-groups = Array { FT55UW9363.* com.apple.token } get-task-allow = true com.apple.security.application-groups = Array { group.arp.geocam } com.apple.developer.team-identifier = FT55UW9363 } Critically, the required entitlement is absent: /usr/libexec/PlistBuddy -c "Print:Entitlements:com.apple.developer.locked-camera-capture" /tmp/locked_profile.plist Print: Entry, ":Entitlements:com.apple.developer.locked-camera-capture", Does Not Exist Build behavior If I manually add com.apple.developer.locked-camera-capture to the extension’s .entitlements, Xcode refuses to sign with: “Provisioning profile failed qualification: Profile doesn't include the com.apple.developer.locked-camera-capture entitlement.” Notes The only other embedded extension is a widget/control extension under .../DirectionalCamera.app/PlugIns/... with a separate profile (expected). Question Has anyone successfully provisioned a Locked Camera Capture Extension on a standard paid developer account? Is com.apple.developer.locked-camera-capture gated/restricted (requiring Apple to enable it for a specific Team ID / App ID), or is there a specific capability in the Developer portal that maps to it? If it’s restricted, what is the official process to request enablement for a team/app-id? Any pointers appreciated.
Replies
2
Boosts
0
Views
184
Activity
Feb ’26
Duplicate Certificates Cause codesign errSecInternalComponent failures
Original Problem We use codesign and notarytool in a scripted environment to build and distribute binaries daily. We also do manual builds by logging into the build server using SSH. This has been working for many years, but after updating to a new "Developer ID Application" certificate, codesign was failing with errSecInternalComponent and the console logs showed errSecInteractionNotAllowed. Summary of Resolution Attempting to fix the problem resulted in multiple copies of the same Certificate which were NOT shown by Keychain Access. I had to run security delete-identity multiple times to clear out the redundant Identities and then imported the certificate using the security CLI tool. Details I originally followed these instructions for requesting and installing a new certificate: https://developer.apple.com/help/account/certificates/create-developer-id-certificates/ Tip: Use the security tool intead These instructions fail to mention two critical points: 1) they assume the machine you generate the request on is the same machine you will be using to perform signatures, and 2) KeyChain Access does not allow you to set permissions for applications like codesign. I made the mistake of following the instructions on my workstation, and then tried to import the certificate to the build machine by double clicking on the .cer file. When that did not work, I followed various forum suggestions and eventually realized I need to export the private key as a .p12 file from the workstation, and import it into the build machine. Tip: The term "Certificate" often refers to a public certificate by itself, while "Identity" to refers to the combination of a public certificate and private key. At this point, I could use codesign, but only within Terminal.app while logged into the build machine's console. I tried various security commands to reimport the Identity, set a key partition list, and unlock the keychain, but none of them allowed codesign to work from within SSH or cron scripts. Eventually I stumbled upon this: sudo security find-identity -v Password: 1) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 2) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 3) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 4) EA377…96DD "Developer ID Application: Data Expedition, Inc. (VK…8X)" 5) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 6) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 7) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 8) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 9) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 10) 3C255…1560 "Developer ID Application: Data Expedition, Inc. (VK…8X)" 10 valid identities found Keychain Access only showed one copy of the Identity in each keychain, but with security I could see there were actually 9. Tip: Keychain Access does not accurately display keychain contents. If it shows no contents at all, type a letter in the search box. Identities are distinguished from lone Certificates by a drop-down caret to the left of the certificate name. Clicking that shows the key. To fix the redundant Identities, I had to run this command four times to delete the nine copies: security delete-identity -Z 3C255…1560 I repeated this until the identity (I used the SHA1 hash of the certificate) no longer showed up in security find-identity -v. I then re-imported the certificate and key using security import, which is what I should have done from the begininng. The Correct Way Here are the commands I used to get things going after I deleted all the problem certificates: security import mycertificate.cer -k /Library/Keychains/System.keychain -T /usr/bin/codesign This next command I ran in Terminal.app on the console so it could display a password prompt: security import ImportThisKey.p12 -k /Library/Keychains/System.keychain -T /usr/bin/codesign After this, I used security find-identity -v to verify that there was only one copy of the Identity. I then verified that codesign could be used from SSH and cron-scripts even while logged out of the console. I suspect that a lot of mysterious certificate problems might be caused by duplicate certificates, each with different permissions. As far as I can tell, there is no way to uniquely identify a certificate/identity or the permissions attached to them. The system just searches based on hash, or team-id, or other non-unique property and seems to just arbitrarily pick one. I hope this helps someone else stuck with errSecInternalComponent errors!
Replies
1
Boosts
0
Views
151
Activity
Feb ’26
MusicKit entitlement consistently missing from generated Ad Hoc Profile despite App Services configuration
Hi everyone, I am attempting to generate an Ad Hoc provisioning profile for my iOS app that includes MusicKit capabilities, but the generated .mobileprovision file consistently lacks the required entitlement, despite the configuration appearing correct in the developer portal. The Issue: I have enabled MusicKit under the "App Services" tab for my App ID. I have saved this configuration, verified it is checked in the UI, and then regenerated and downloaded my provisioning profile. However, when I inspect the internal contents of the .mobileprovision file, the Entitlements dictionary does not contain the com.apple.developer.music-kit key. It only contains the standard keys (Team ID, App ID, etc.). Steps Taken: Created a brand new App ID to rule out legacy data issues. Explicitly enabled "MusicKit" under the App Services tab for this new identifier. Created a fresh Ad Hoc Distribution profile linked to this new ID. Downloaded the profile and inspected the file structure: the MusicKit entitlement is completely absent. Attempted toggling the service off and on, saving, and regenerating the profile multiple times. Has anyone experienced a specific bug where "App Services" (like MusicKit) fail to propagate to the Provisioning Profile generator? Is there a secondary "Capability" (e.g., Media Library) that must also be enabled to trigger the inclusion of the MusicKit entitlement? Any guidance would be appreciated.
Replies
2
Boosts
1
Views
229
Activity
Feb ’26
Expro International Group Ltd - Profile issues
Certificate Details Certificate Name Expro International Group Ltd Certificate Type iOS Distribution Expiration Date 2029/02/11 Created By Thavaseelan Kudarsamy Enabled Capabilities iCloud, In-App Purchase, Personal VPN, Push Notifications App ID ESTSMobile (com.exprogroup.estsmobile) This profile is not installing.
Replies
1
Boosts
0
Views
125
Activity
Feb ’26
iOS app from TestFlight cannot be opened due to Code signing
One of our apps (built with Xcode 26.1.1 and distributed via TestFlight) crashes upon launch on iOS 17 with Exception Type: EXC_BAD_ACCESS (SIGKILL) and Termination Reason: CODESIGNING 2 Invalid Page. I have never seen this before. Any pointers? On iOS 18 & 26 this does not happen btw.
Replies
3
Boosts
0
Views
223
Activity
Feb ’26
Provision profile is not installing
My provisioning profile isn't installing when I double-click it on my MacBook. Also no profile on this path ~/Library/MobileDevice/Provisioning Profiles. just empty folder
Replies
1
Boosts
0
Views
126
Activity
Feb ’26
Notarization rejected after in progress for 5 days
I am trying to notarize my app but it rejected with this error after 5 days of being in progress. { "logFormatVersion": 1, "jobId": "8291ad9e-4c8e-4974-8753-af1a78e5a4a2", "status": "Rejected", "statusSummary": "Team is not yet configured for notarization. Please contact Developer Programs Support at developer.apple.com under the topic Development and Technical / Other Development or Technical Questions.", "statusCode": 7000, "archiveFilename": "SkanVirtualAssistant-1.0.0.dmg", "uploadDate": "2026-02-05T03:13:41.280Z", "sha256": "eb95cc25a382e5ce36fc2b7e195c20a1a09cfbfb71a057e754306ad400300d38", "ticketContents": null, "issues": null } Can anyone help with this? I have an urgent product launch deadline in a week! I have contacted developer program support but have received no response.
Replies
1
Boosts
0
Views
149
Activity
Feb ’26
Mac App signing
I am trying to sign my Mac app to use Network Extensions capability. But every time I create a profile it displays that to me: on the other hand on the website it displays this to me:
Replies
3
Boosts
0
Views
140
Activity
Feb ’26
3 days almost now stuck in progress no logs generated
Not accepted yet (all are still processing, none are rejected) 387af103-42d3-4d95-ae22-0289f90a8559 — In Progress 2d836594-9fb2-41a5-990c-7ea4e0870af0 — In Progress e61ba9e3-5ff1-4856-8e9d-39c08445ff63 — In Progress 1defdeec-50b4-45c5-b32d-53ca6e4538bb — In Progress 34e60b80-20c3-4ea7-93a7-2bb9e7c6f05c — In Progress 09222b71-eae1-4c5c-aca4-368f697b2a39 — In Progress eb5327e8-161e-4185-9920-3facf60b7b4b — In Progress 784fc210-d0bf-4924-b0a6-eb8bbac0f2c8 — In Progress 74bc8f31-b1b0-4bed-9142-0c03100a062a — In Progress 4739620c-894a-4283-a43b-df57b29a1771 — In Progress have created new certificate as well same result. waiting for apple support to give any answers.
Replies
1
Boosts
0
Views
327
Activity
Feb ’26
No certificate for team '' matching 'Developer ID Application' found
When completing signing on Xcode, it shows the following error message "No certificate for team '' matching 'Developer ID Application' found" I have already followed the steps to generate a certificate from keychain and made a new certificate on developer portal, along with its associated provisioning profile. Viewing "Manage Certificate" window shows the newly created certificate, but Xcode seems to not be able to locate it.
Replies
1
Boosts
0
Views
255
Activity
Feb ’26
How can I create a more complex XPCPeerRequirement?
I have been updating some NSXPCConnection code in my macOS 26 app (not sandboxed) to use XPCSession and friends instead. And it is working well and the experience has been generally good. But I have run into a problem when using XPCSession.setPeerRequirement() which I really want to use. It works well when I use something simple like XPCPeerRequirement.isFromSameTeam() but I want to check some more requirements and also use the code from multiple apps (but same team). That is, I want to check for multiple identifiers and team ID and version (and perhaps also in the future that the certificate is a Developer ID). And previously I would use SecRequirementCreateWithString with an entitlement string conceptually like this: var entitlement = "anchor apple generic and (" entitlement += "identifier idA" entitlement += " or identifier idB" entitlement += ")" entitlement += " and certificate leaf[subject.OU] = TeamID" entitlement += #" and info [CFBundleShortVersionString] >= "1.0""# and it works just as it should when creating and using that SecRequirement so I don't think that there is anything particularly wrong with the entitlement. And I had hoped that I could use the same string with XPCPeerRequirement.hasEntitlement(entitlement) but it doesn't work (I get a general "Peer forbidden" error). So I think that I don't really understand what sort of entitlement that hasEntitlement() wants. And also I don't really understand the other ways available to create a XPCPeerRequirement. I have also tried to use a XPCDictionary with XPCPeerRequirement(lightweightCodeRequirements:) but I can't get that to work either (and it seems a bit wrong to have to drop down to use e.g. xpc_object_t with new modern API:s). So my question is: is it possible to create a XPCPeerRequirement with an entitlement like above and, in that case, how? Or is there some other work-around to use XPCSession.setPeerRequirement() with a more complex requirement, e.g. is there a way to combine multiple XPCPeerRequirements into one? Thank you for reading this. /Peter
Replies
1
Boosts
0
Views
342
Activity
Feb ’26
"Notarization stuck in 'In Progress' for 15+ hours - submission e3dff14c-16ab-41a7-a81c-0d1774c66588"
Notarization submission has been stuck in "In Progress" status for over 15 hours with no resolution. Hi there, I am trying to roll out distribution to paid users who are unable to receive anything from me for quite some time now, and I've read that notarization is quick. But I've found myself to be under quite a delay. Wondering if I could please get some help. Submission Details: ID: e3dff14c-16ab-41a7-a81c-0d1774c66588 Submitted: 2026-02-08T16:42:07.377Z File: Resonant-0.1.0-arm64.dmg (~200MB) Status: In Progress (stuck) Evidence: Upload completed successfully within minutes Delay is entirely server-side processing Same app structure notarized successfully on Feb 5 (submission f5f4c241) Multiple other submissions stuck since Feb 5 (see history below) Stuck Submissions (all "In Progress" for days): e3dff14c (Feb 8, 16:42 UTC) - 15+ hours 3e6bdcb5 (Feb 8, 16:11 UTC) - 16+ hours 37fd1b9f (Feb 8, 12:53 UTC) - 20+ hours f21a1d9b (Feb 8, 12:31 UTC) - 20+ hours (different app, Clippa.zip) 417244e8 (Feb 8, 06:18 UTC) - 26+ hours 891f370f (Feb 7, 11:44 UTC) - 2+ days 1debba51 (Feb 7, 05:44 UTC) - 2+ days 6a06b87f (Feb 6, 14:16 UTC) - 3+ days 9867261c (Feb 6, 13:44 UTC) - 3+ days 1a7c3967 (Feb 6, 12:58 UTC) - 3+ days Last Successful Notarization: f5f4c241 (Feb 5, 18:24 UTC) - Accepted in normal timeframe Impact: Unable to distribute production release. This is blocking critical bug fixes from reaching users. Expected Behavior: Notarization should complete within 2-10 minutes as documented and as experienced prior to Feb 5. Request: Please investigate why submissions are not being processed and either: Clear the backlog and process pending submissions Provide guidance on how to proceed with distribution
Replies
1
Boosts
0
Views
337
Activity
Feb ’26
Notarization stuck "In Progress" for 48+ hours - 6 submissions (Team ID: Y7T24GD249)
I'm experiencing a persistent issue where all my notarization submissions remain stuck in "In Progress" indefinitely. This is my first time notarizing an app. Environment: macOS 26.2 (Tahoe) Using xcrun notarytool submit Team ID: Y7T24GD249 App: Electron-based desktop application (~400MB) Stuck submissions (oldest to newest): 51412777-848c-4be1-a952-5ff32d6653f9 - Feb 4, 4:39 PM UTC (48+ hours) 9c4f94a1-d59a-4607-adf1-94c82fb4254b - Feb 4, 11:23 PM UTC 1c593512-ef55-4801-ba60-8b1bbc5a6f66 - Feb 4, 11:30 PM UTC de66e5cf-143c-40ec-ba62-2f07609044b4 - Feb 5, 1:39 PM UTC 964b2196-ad2e-4503-b15f-dc7f6a996ef0 - Feb 5, 2:25 PM UTC c8fdcccf-46cd-4609-bc33-faaa8fad696f - Feb 6, 5:11 PM UTC What I've tried: Verified Developer ID Application certificate is valid Checked code signatures with codesign -vvv --deep --strict Submitted both .zip and .dmg formats Checked Apple System Status (shows operational) notarytool log returns "Record not found" for all submissions Is there a known issue affecting first-time notarization, or could my account be flagged? Any help would be greatly appreciated.
Replies
4
Boosts
0
Views
171
Activity
Feb ’26
Notarized but Gatekeeper fails macOS 15 only?
Okay, I just pushed a release and notarized. Works great on my test laptop (macOS 26.2) and my test desktop (macOS 14.x) But it seems to fail for a friend who's running macOS 15. I've been using the same GitHub actions successfully for months. How can notarization work for macOS 14 and 26, but not for macOS 15? I think everything looks okay as far as the signing? I've checked codesign -dvv Executable=/Applications/Avogadro2.app/Contents/MacOS/Avogadro2 Identifier=cc.avogadro Format=app bundle with Mach-O thin (arm64) CodeDirectory v=20500 size=11607 flags=0x10000(runtime) hashes=352+7 location=embedded Signature size=8986 Authority=Developer ID Application: Geoffrey Hutchison (…..) Authority=Developer ID Certification Authority Authority=Apple Root CA Timestamp=Feb 5, 2026 at 8:47:21 PM Info.plist entries=24 TeamIdentifier=….. Runtime Version=15.5.0 Sealed Resources version=2 rules=13 files=3306 Internal requirements count=1 size=172 And from spctl -a -vv /Applications/Avogadro2.app: accepted source=Notarized Developer ID origin=Developer ID Application: Geoffrey Hutchison (….)
Replies
1
Boosts
0
Views
425
Activity
Feb ’26
All notarization submissions stuck "In Progress" — first-time notarization, 9 submissions over 16+ hours
I'm submitting my first macOS app (a native SwiftUI menu bar app, signed with Developer ID Application certificate, Hardened Runtime enabled) for notarization using xcrun notarytool submit with keychain profile authentication. All 9 of my submissions have been stuck at "In Progress" for up to 16 hours. None have transitioned to "Accepted" or "Invalid." Logs are unavailable for all of them (notarytool log returns "Submission log is not yet available"). Environment macOS: 26.2 (25C56) Xcode: 26.1.1 (17B100) notarytool: 1.1.0 (39) App: Native SwiftUI, universal binary (x86_64 + arm64), ~2.2 MB DMG Bundle ID: com.gro.ask Team ID: 4KT56S2BX6 What I've verified Code signing is valid: $ codesign --verify --deep --strict GroAsk.app passes with no errors $ codesign -dvvv GroAsk.app Authority=Developer ID Application: Jack Wu (4KT56S2BX6) Authority=Developer ID Certification Authority Authority=Apple Root CA CodeDirectory flags=0x10000(runtime) # Hardened Runtime enabled Runtime Version=26.1.0 Format=app bundle with Mach-O universal (x86_64 arm64) Entitlements are minimal: com.apple.security.app-sandbox com.apple.security.network.client Uploads succeed — each submission receives a valid submission ID and the file uploads to Apple's servers without error. Submission history Created (UTC): 04:40 ID: eeb12389-... File: GroAsk-1.6.0.dmg Status: Invalid (Hardened Runtime missing — since fixed) ──────────────────────────────────────── Created (UTC): 04:42 ID: 6e537a32-... File: GroAsk-1.6.0.dmg Status: In Progress (16+ hrs) ──────────────────────────────────────── Created (UTC): 07:52 ID: 5ee41736-... File: GroAsk-1.6.0.dmg Status: In Progress ──────────────────────────────────────── Created (UTC): 08:19 ID: f5c6b9a5-... File: GroAsk-1.6.0.dmg Status: In Progress ──────────────────────────────────────── Created (UTC): 08:27 ID: 0f1c8333-... File: GroAsk-1.6.0.dmg Status: In Progress ──────────────────────────────────────── Created (UTC): 08:29 ID: 77fd9cd4-... File: GroAsk-1.6.0.dmg Status: In Progress ──────────────────────────────────────── Created (UTC): 08:51 ID: db9da93e-... File: GroAsk-1.6.1.dmg Status: In Progress ──────────────────────────────────────── Created (UTC): 09:05 ID: 3c43c09f-... File: GroAsk.zip Status: In Progress ──────────────────────────────────────── Created (UTC): 12:01 ID: b2267a74-... File: GroAsk-1.6.3.dmg Status: In Progress ──────────────────────────────────────── Created (UTC): 12:15 ID: ae41e45c-... File: GroAsk.zip Status: In Progress The very first submission (eeb12389) came back as Invalid within minutes because Hardened Runtime wasn't enabled on the binary. I fixed the build configuration and confirmed flags=0x10000(runtime) is present on all subsequent builds. However, every submission after that fix has been stuck at "In Progress" with no state transition. What I've tried Submitting both .dmg and .zip formats — same result Verified notarytool log — returns "Submission log is not yet available" for all stuck submissions Apple Developer System Status page shows the Notary Service as "Available" I've also emailed Apple Developer Support but have not received a response yet Questions Is this the expected behavior for a first-time notarization account? I've seen other threads mentioning that new accounts may be held for "in-depth analysis," but 16+ hours with zero feedback seems excessive. 2. Is there any manual configuration Apple needs to do on their end to unblock my team for notarization? 3. Should I stop submitting and wait, or is there something else I can try? Any guidance from DTS would be greatly appreciated. This is blocking the release of my app.
Replies
2
Boosts
0
Views
240
Activity
Feb ’26
notarization stuck in progress > 24hrs
Hi guys, I am new to the Apple Developer Program (enrolled a few days ago) and this is my first app notarization attempt. I've been experiencing significant delays - all submissions have been stuck at "In Progress" for over 24 hours. Details: macOS app signed with Developer ID Application certificate Using xcrun notarytool with app-specific password Hardened runtime enabled codesign --verify --deep --strict passes Team ID: QVHM976XC5 Submission IDs (all stuck "In Progress"): 5f494a89-0db0-4cc6-944f-ca2fe399e870 (latest - 8+ hours) 938f6b8d-0d00-45f5-861d-68fe470df6c2 d0edcbfe-8464-455f-b077-bebaa5b9aab7 I understand new developers may experience longer initial processing, but 24+ hours seems excessive. Is there anything I should check or any additional steps required for new accounts? Any guidance appreciated.
Replies
6
Boosts
1
Views
596
Activity
Feb ’26
Notarization submissions stuck in “In Progress” for >24 hours (CI / REST API) – production impact
We are experiencing notarization submissions that remain in the “In Progress” state for an extended period (over 24 hours), with no status transition and no submission log available. This is occurring in an automated CI environment using the Notary REST API (non-interactive submission and polling). Re-submitting the same package only results in additional submissions also stuck in “In Progress”. There does not appear to be any API mechanism to cancel, clear, or expire these submissions once they are created. We have already opened an Apple Developer Support case regarding this issue (Case ID: 102818066745 & 102819008943), but have not yet received clarification on what is causing these long-running “In Progress” states. This issue is impacting our production release pipeline, as we are unable to reliably complete notarization for signed packages within an expected timeframe. Based on other reports in this forum (including thread 811968), this behavior appears similar to cases where notarization requests were delayed due to backend backlog or in-depth analysis. We would appreciate clarification on the following: Is it expected behavior for notarization submissions to remain in “In Progress” for such a long period without logs? Is client-side timeout and re-submission the recommended handling for CI workflows? Are there known service-side conditions (e.g. analysis backlog) that could explain this behavior? Any guidance from Apple DTS or others who have encountered this would be greatly appreciated.
Replies
5
Boosts
1
Views
531
Activity
Feb ’26
All notarization submissions stuck "In Progress" for 24+ hours — first-time Electron app
I'm submitting my first macOS app (an Electron app, signed with Developer ID Application certificate and hardened runtime) for notarization using xcrun notarytool submit with App Store Connect API key authentication. All 6 of my submissions have been stuck at "In Progress" for over 24 hours now. The oldest submission is 27+ hours old. None have transitioned to Accepted or Invalid. Here's what I've verified: Code signing is valid: codesign --verify --deep --strict passes Hardened runtime is enabled Uploads succeed: Each submission receives a valid submission ID and the file uploads successfully to Apple's servers API key auth is working: Using App Store Connect API key (.p8 file), Key ID, and Issuer ID Tried both locally and via GitHub Actions CI — same result Polling Apple's status endpoint eventually times out with NSURLErrorDomain Code=-1001 "The request timed out" when checking https://appstoreconnect.apple.com/notary/v2/submissions/<id> Logs are not available (notarytool log returns "not yet available" for all submissions) Apple Developer System Status shows "Developer ID Notary Service" as Available Submission history: createdDate: 2026-02-04T20:27:16Z — status: In Progress createdDate: 2026-02-04T16:45:18Z — status: In Progress createdDate: 2026-02-04T13:40:23Z — status: In Progress createdDate: 2026-02-04T12:29:52Z — status: In Progress createdDate: 2026-02-04T11:26:36Z — status: In Progress createdDate: 2026-02-04T11:21:39Z — status: In Progress Entitlements used: com.apple.security.cs.allow-jit com.apple.security.cs.allow-unsigned-executable-memory com.apple.security.cs.disable-library-validation com.apple.security.network.client com.apple.security.files.user-selected.read-write This is my first time notarizing any app on this developer account. I've seen other threads mentioning that first-time submissions can be "held for in-depth analysis," but 24+ hours with no feedback at all seems excessive. Is anyone else currently experiencing this? Is there anything I can do to unblock my account's notarization queue, or do I just need to wait? Any guidance from DTS would be greatly appreciated. I've also emailed Apple Developer Support but haven't received a response yet.
Replies
17
Boosts
4
Views
1.5k
Activity
Feb ’26