MacOS installer appears rejected after successful notarization

Question

Created 10h

Replies 1

Boosts 0

Participants 2

Hi! I am encountering an issue with the notarization process. I'll leave here the outputs of a few command that I think might be useful.


user@AndreisMac % pkgutil --check-signature mypkg.pkg

Package "mypkg.pkg":
   Status: signed by a developer certificate issued by Apple for distribution
   Notarization: trusted by the Apple notary service
   Signed with a trusted timestamp on: 2026-02-18 18:46:16 +0000
   Certificate Chain:
...

user@AndreisMac  %  spctl -a -vv --type install mypkg.pkg

mypkg.pkg: rejected
origin=Developer ID Installer: MyComp LLC (ABCD)

user@AndreisMac  % xcrun notarytool submit  mypkg.pkg --keychain-profile "notary-profile" --wait

Conducting pre-submission checks for mypkg.pkg and initiating connection to the Apple notary service...
Submission ID received
  id: e76f34b3-7c91-451c-a539-8fb39809a5bd
Upload progress: 100,00% (13,3 MB of 13,3 MB)
Successfully uploaded file
  id: e76f34b3-7c91-451c-a539-8fb39809a5bd
  path: /path/to/mypkg.pkg
Waiting for processing to complete.
Current status: Accepted...............
Processing complete
  id: e76f34b3-7c91-451c-a539-8fb39809a5bd
  status: Accepted

user@AndreisMac % spctl -a -vv --type install mypkg.pkg

mypkg.pkg: rejected
origin=Developer ID Installer: MyComp LLC (ABCD)

As you can see:

the installer is signed with a Developer ID Installer (the contents are signed and notarized as well)
the first spctl check is failing(even if the installer was already notarized on our build server)
trying to notarize again seems to work
checking again still shows the installer as rejected

I can run the installer locally by removing the quarantine flag, but this is not what I am expecting from a signed&notarized installer.

Interestingly enough, trying this installer on a different MacOS machine works as expected(no quarantine) and spctl shows it as notarized(Accepted).

Any idea what's wrong with my machine?

Boost

Answer 1

ssmith_c OP

2h

have you checked the Privacy & Security section of System Settings? I haven't had this problem with installers, but I have seen app launches blocked here during development. In the normal flow, the user sees a dialog asking for permission, but under some circumstances that dialog won't appear - but the permission is still requested, it is just lurking unseen in System Settings.

You could also request the detailed notarization log from the server, which tells you more than the mere result of the command.

spctl tells you what you already know - that the packet is rejected on your machine. Check the system log to see if there are any further details on the reasons why. I usually dump the last minute into an archive and search that - log --last 1m , because working with the active log is frustrating, it is populated very quickly.

0