Submit to the notary service

Notarization is Apple’s automated malware scan for software distributed outside the Mac App Store. You upload a signed artifact, Apple’s service scans it, and on success it issues a ticket recording that this exact software passed. Gatekeeper looks for that ticket at first launch.

Understand what it is not. Notarization is not App Review. No human looks at your app, nobody judges the UI, and acceptance doesn’t prove the app works. It proves Apple scanned these bytes and found no known malware.

The command-line tool is notarytool, bundled with Xcode. The older altool upload path is dead — Apple no longer accepts it. Xcode’s Organizer can also notarize for you, but a scripted workflow gives you the same steps reproducibly.

First, store credentials once in a Keychain profile. Use your Apple ID with an app-specific password, plus your team ID:

xcrun notarytool store-credentials "notes-notary" \
  --apple-id "[email protected]" \
  --team-id ABCDE12345

Then submit a ZIP, DMG, or installer package and wait for the verdict:

xcrun notarytool submit Notes-1.2.0.zip \
  --keychain-profile "notes-notary" \
  --wait

With --wait, the command polls until processing finishes and prints the result. status: Accepted is what you want. Typical waits are a few minutes.

When you get status: Invalid instead, don’t guess. Every submission has an identifier, and the service keeps a detailed log. Fetch it:

xcrun notarytool log 2efe2717-52ef-43a5-96dc-0797e4ca1041 \
  --keychain-profile "notes-notary"

The JSON lists each issue with the offending file path. The usual suspects: an executable without the hardened runtime, a binary signed without a secure timestamp, or an unsigned helper buried inside a framework you embedded.

Two habits for automation. Capture the submission identifier in your build logs so failures stay diagnosable later. And never print your Apple ID password or API keys — that’s what the Keychain profile is for.