A summary for folks who are hitting this issue:
The first time you submit a new app for notarization, the existence of certain code in your submission (perhaps Electron, or accessibility APIs, or something else Apple deems sensitive from a security perspective) can flag your account for "additional analysis".
Once you've been flagged for additional analysis, your notarytool submissions will just spin on "In Progress" for roughly 2-10 days, waiting for human review by Apple.
There does not appear to be a way to be notified when this human review completes and you can resubmit. The least-bad option is to just retry from time to time, vibrating with anticipation about when you can share your new product with testers.
There does not seem to be a way to tell the difference between a notarization that is actually in progress (wait until it completes) vs. one that is still blocked on human review (you should just cancel the submission and try another day). Given this, setting a timeout of 10 or 20 minutes on your script may be helpful in preserving one's sanity and/or CI budget.
It would be helpful for developers if Apple would reject these requests with something like "Pending Manual Review".
Topic:
Code Signing
SubTopic:
Notarization
Tags: