asc-notarization

Use this skill when you need to notarize a macOS app for distribution outside the App Store. Before archiving, confirm a valid Developer ID Application identity exists: If no identity is found, create one at (the App Store Connect API does not support creating Developer ID certificates). If codesign or xcodebuild fails with "Invalid trust settings" or "errSecInternalComponent", the certificate may have custom trust overrides that break the chain: After fixing trust settings, verify the chain is intact: The signing must show the chain: Developer ID Application → Developer ID Certification Authority → Apple Root CA. Create an ExportOptions plist for Developer ID distribution: Export the archive: This produces a .app bundle signed with Developer ID Application and a secure timestamp. Confirm: Fetch the log URL to see detailed issues: After notarization succeeds, staple the ticket so the app works offline: For DMG or PKG distribution, staple after creating the container: To notarize .pkg files, you need a Developer ID Installer certificate (separate from Developer ID Application). This certificate type is not available through the App Store Connect API — create it at . Sign the package: Then submit: The Developer ID certificate has custom trust overrides. See the Preflight section above to remove them.