I’ve a pkg that has been constructed with pkgbuild like this:
pkgbuild --root $STUFF --component-plist myApp.plist
--identifier com.my.app --scripts ./myScripts myApp.pkg
I then run productbuild on it so I can embrace my customized set up steps:
productbuild --distribution product.dist --package-path myApp.pkg myApp-unsigned.pkg
Then I run productsign on it to signal the pkg:
productsign --sign "Developer ID Installer: MY_INSTALLER_CERT"
myApp-unsigned.pkg myApp-signed.pkg
After I run the pkgutil --check-signature
utility on the signed pkg the outcome appears like this:
Standing: signed by a developer certificates issued by Apple for distribution
Signed with a trusted timestamp on: 2025-01-31 21:55:57 +0000
Certificates Chain:
1. Developer ID Installer: MY_INSTALLER_CERT
Expires: 2030-01-28 17:31:40 +0000
SHA256 Fingerprint:
***
------------------------------------------------------------------------
2. Developer ID Certification Authority
Expires: 2031-09-17 00:00:00 +0000
SHA256 Fingerprint:
***
------------------------------------------------------------------------
3. Apple Root CA
Expires: 2035-02-09 21:40:36 +0000
SHA256 Fingerprint:
***
The problem comes after I run notarytool to notarize the pkg for advert hoc distribution. The command I name is:
xcrun notarytool submit myApp-signed.pkg --apple-id <APPLE_ID> --password <APP_SPECIFIC_PASSWORD> --team-id <TEAM_ID> --wait
When it concludes I get the next output:
Submission ID obtained
id: <NOTARY_ID>
Add progress: 100.00% (13.5 KB of 13.5 KB)
Efficiently uploaded file
id: <NOTARY_ID>
path: /path/to/myApp-signed.pkg
Ready for processing to finish.
Present standing: Invalid........
Processing full
id: <NOTARY_ID>
standing: Invalid
After I have a look at the notarytool log it outputs the next:
{
"logFormatVersion": 1,
"jobId": "<JOB_ID>",
"standing": "Invalid",
"statusSummary": "Archive incorporates important validation errors",
"statusCode": 4000,
"archiveFilename": "myApp-signed.pkg",
"uploadDate": "2025-01-31T21:38:02.536Z",
"sha256": "***",
"ticketContents": null,
"points": [
{
"severity": "error",
"code": null,
"path": "myApp-signed.pkg",
"message": "Package myApp-signed.pkg has no signed executables or bundles. No tickets can be generated.",
"docUrl": null,
"architecture": null
},
{
"severity": "warning",
"code": null,
"path": "myApp-signed.pkg",
"message": "The contents of the package at myApp-signed.pkg could not be extracted.",
"docUrl": null,
"architecture": null
}
]
}
I can not make sense of why I might be getting this error output when the pkg has been signed and I’ve checked and verified the signature. What step or element may I be lacking?