ios – How do I signal and notarize my pkg appropriately with notarytool?

ios – How do I signal and notarize my pkg appropriately with notarytool?


I’ve a pkg that has been constructed with pkgbuild like this:

pkgbuild --root $STUFF --component-plist myApp.plist 
     --identifier com.my.app --scripts ./myScripts myApp.pkg

I then run productbuild on it so I can embrace my customized set up steps:

productbuild --distribution product.dist --package-path myApp.pkg myApp-unsigned.pkg

Then I run productsign on it to signal the pkg:

productsign --sign "Developer ID Installer: MY_INSTALLER_CERT" 
    myApp-unsigned.pkg myApp-signed.pkg

After I run the pkgutil --check-signature utility on the signed pkg the outcome appears like this:

   Standing: signed by a developer certificates issued by Apple for distribution
   Signed with a trusted timestamp on: 2025-01-31 21:55:57 +0000
   Certificates Chain:
    1. Developer ID Installer: MY_INSTALLER_CERT
       Expires: 2030-01-28 17:31:40 +0000
       SHA256 Fingerprint:
           ***
       ------------------------------------------------------------------------
    2. Developer ID Certification Authority
       Expires: 2031-09-17 00:00:00 +0000
       SHA256 Fingerprint:
           ***
       ------------------------------------------------------------------------
    3. Apple Root CA
       Expires: 2035-02-09 21:40:36 +0000
       SHA256 Fingerprint:
           ***

The problem comes after I run notarytool to notarize the pkg for advert hoc distribution. The command I name is:

xcrun notarytool submit myApp-signed.pkg --apple-id <APPLE_ID> --password <APP_SPECIFIC_PASSWORD> --team-id <TEAM_ID> --wait

When it concludes I get the next output:

Submission ID obtained
  id: <NOTARY_ID>
Add progress: 100.00% (13.5 KB of 13.5 KB)   
Efficiently uploaded file
  id: <NOTARY_ID>
  path: /path/to/myApp-signed.pkg
Ready for processing to finish.
Present standing: Invalid........
Processing full
  id: <NOTARY_ID>
  standing: Invalid

After I have a look at the notarytool log it outputs the next:

{
  "logFormatVersion": 1,
  "jobId": "<JOB_ID>",
  "standing": "Invalid",
  "statusSummary": "Archive incorporates important validation errors",
  "statusCode": 4000,
  "archiveFilename": "myApp-signed.pkg",
  "uploadDate": "2025-01-31T21:38:02.536Z",
  "sha256": "***",
  "ticketContents": null,
  "points": [
    {
      "severity": "error",
      "code": null,
      "path": "myApp-signed.pkg",
      "message": "Package myApp-signed.pkg has no signed executables or bundles. No tickets can be generated.",
      "docUrl": null,
      "architecture": null
    },
    {
      "severity": "warning",
      "code": null,
      "path": "myApp-signed.pkg",
      "message": "The contents of the package at myApp-signed.pkg could not be extracted.",
      "docUrl": null,
      "architecture": null
    }
  ]
}

I can not make sense of why I might be getting this error output when the pkg has been signed and I’ve checked and verified the signature. What step or element may I be lacking?

author avatar
roosho Senior Engineer (Technical Services)
I am Rakib Raihan RooSho, Jack of all IT Trades. You got it right. Good for nothing. I try a lot of things and fail more than that. That's how I learn. Whenever I succeed, I note that in my cookbook. Eventually, that became my blog. 
rooshohttps://www.roosho.com
I am Rakib Raihan RooSho, Jack of all IT Trades. You got it right. Good for nothing. I try a lot of things and fail more than that. That's how I learn. Whenever I succeed, I note that in my cookbook. Eventually, that became my blog. 

Related Articles

LEAVE A REPLY

Please enter your comment!
Please enter your name here


Latest Articles

author avatar
roosho Senior Engineer (Technical Services)
I am Rakib Raihan RooSho, Jack of all IT Trades. You got it right. Good for nothing. I try a lot of things and fail more than that. That's how I learn. Whenever I succeed, I note that in my cookbook. Eventually, that became my blog.