Oops. Sorry. I hate that when people only answer part of a question and here I am doing that. But that sucker is gone - so many attempts, to few moments in life.
Here is a fresh one:
In target folder prior DropDMG (used for quick experimentation, I later bash a script for the QA builds):
% spctl -a -vvv emWave\ Pro.app
emWave Pro.app: accepted
source=Developer ID
origin=Developer ID Application: HeartMath LLC (GMZ3FT78RD)
Build DMG and sign, mount, and check signature on it:
% spctl -a -vvv emWave\ Pro.app
emWave Pro.app: accepted
source=Developer ID
origin=Developer ID Application: HeartMath LLC (GMZ3FT78RD)```
Send off to notarization:
https://osxapps-ssl.itunes.apple.com/itunes-assets/Enigma112/v4/68/cd/cc/68cdcc9c-0579-6c35-0d12-e39db9a94e5c/developer_log.json?accessKey=1659643471_4931801388376640712_m64RSh33h2i77lk0c2I0Gnoo%2BBssMltizD7ye7Qdh4BL9n4k6%2BtNEjergyK7I5c5jD%2FSd%2FZzpRxhXhuWv9d11bHUFwSMNuYBijbhQUeqOywgbJkVehljacihBej%2Bc6D6qe0iQgGO877nzBVDx6tuetRH9y8XeJpJV0Kr9y6ZFdE%3D
RequestUUID: 256cc0c2-7eb2-4b8d-b54f-94b52b2a05f6
{
"logFormatVersion": 1,
"jobId": "256cc0c2-7eb2-4b8d-b54f-94b52b2a05f6",
"status": "Invalid",
"statusSummary": "Archive contains critical validation errors",
"statusCode": 4000,
"archiveFilename": "emWave+Pro.dmg",
"uploadDate": "2022-08-02T13:59:15Z",
"sha256": "d0240c577486929536bb8c4f72b0749023d4c2978fdca525ab03214c85ce9a08",
"ticketContents": null,
"issues": [
{
"severity": "error",
"code": null,
"path": "emWave+Pro.dmg/emWave Pro.app/Contents/MacOS/emWaveMac",
"message": "The signature of the binary is invalid.",
"docUrl": null,
"architecture": "x86_64"
},
{
"severity": "error",
"code": null,
"path": "emWave+Pro.dmg/emWave Pro.app/Contents/MacOS/emWaveMac",
"message": "The signature of the binary is invalid.",
"docUrl": null,
"architecture": "arm64"
}
]
}
Remount DMG and check, because ... superstition:
% spctl -a -vvv emWave\ Pro.app
emWave Pro.app: accepted
source=Developer ID
origin=Developer ID Application: HeartMath LLC (GMZ3FT78RD)
Notarize the app by itself from the source folder, since the DMG is RO. My script returns:
[...] Downloaded ticket has been stored at file:///var/folders/1z/zdzqgk4s22s2wjy7ds9d21qm0000gn/T/93dc7955-57cf-4749-ae1c-14662a4fd3dd.ticket.
The validate action worked!
As I wrote, if I drop a signed installer into the same folder, it works.
All this is using altool. I am converting scripts to notarize, but that should not make a difference.
