Submission UUID: 99192f0b-a0b2-488b-8443-6a6535c300b7
Created: 2026-07-31T09:18:41.522Z
Team ID: FNUWX59L8T
Artifact: Omitly_2.3.2-beta.2_aarch64.dmg
Current status: In Progress (51+ hours)
This submission has been In Progress continuously since it was created. I am not asking for it to be rushed — I would like to know whether it is genuinely still being processed, or whether it has failed in a way that will never reach a terminal state, because I cannot tell the difference from the client side and notarytool log is unavailable while it is pending.
Before posting I ruled out the causes I could test myself.
┌──────────────────────┬──────────────────────┬─────────────────────┐
│ Created (UTC) │ Artifact │ Result │
├──────────────────────┼──────────────────────┼─────────────────────┤
│ 2026-07-31T09:18:41Z │ Omitly_…_aarch64.dmg │ In Progress, 51h │
├──────────────────────┼──────────────────────┼─────────────────────┤
│ 2026-07-31T12:22:38Z │ Probe.zip │ Accepted in ~55 min │
├──────────────────────┼──────────────────────┼─────────────────────┤
│ 2026-08-02T10:32:37Z │ Probe2.zip │ Accepted in ~41 min │
└──────────────────────┴──────────────────────┴─────────────────────┘
Both probes were a minimal hello-world .app (single arm64 Mach-O, no dependencies), Developer ID signed with hardened runtime using the same identity and same API key. Both returned Accepted / "Ready for distribution" / issues: null.
That establishes: the team is configured for notarization (not a 7000 case); certificate and key work end to end; submissions are not serialised behind the stuck one (Probe.zip was submitted three hours later and finished first); and it isn't a weekend effect (Probe2.zip went through on a Sunday morning Pacific in 41 minutes).
About the stuck artifact: a Tauri 2 app, arm64, distributed as a DMG. CI verified before submission that the app and every nested Mach-O report Authority=Developer ID Application: with TeamIdentifier=FNUWX59L8T, and that the hardened runtime flag is set. The bundle embeds a qpdf sidecar plus three dylibs (libqpdf.30, libjpeg.8, libcrypto.3) copied from Homebrew, install names rewritten with install_name_tool, then re-signed as part of the bundle. It also ships compressed OCR model data.
I appreciate that unfamiliar uploads can be held for additional analysis, and that this is more common for new accounts — this is a recently approved organisation and this was its first submission. My question is whether 51 hours is still within the expected range for that path, or whether this submission is stuck and should be resubmitted.
Topic:
Code Signing
SubTopic:
Notarization
0
0
219