Notarization failed : Mac Build failure

[swetayadav1]

echo ">>> Building the release package"
${PYTHON_VENV} -m PyInstaller ndrive.spec --clean --noconfirm

---

We are also using this approach ---> https://github.com/pyinstaller/pyinstaller/wiki/Recipe-OSX-Code-Signing-Qt
But getting " !! Notarization failed" error.

Report downloading from https://osxapps-ssl.itunes.apple.com/itunes-assets/Enigma122/v4/78/86/b9/7886b945-031f-b3fe-86be-bcc6298d78d7/developer_log.json?accessKey=1661532347_1384255467888432470_GsmZh87O%2B8NcfLf7iPq%2BRi6NeNIJdcv6M%2BVnmHLCTyaNhkRIiH7%2Bf2nhv6SaxvATPtdEf%2FFv2C9YU6%2FQxmfJlEr%2B2I0%2Fwpc82VWtB2G5umfaxuIAWj1uSJsHeECRLCTrguGj6ZLL3R1FVO18x%2ByctJCuuNdjiNgG5oQ5N7RCcwA%3D

Any suggestion how to solve this issue?

[rokm]

The QML component directories tend to be suffixed with .2, which is incompatible with the codesign's expectations.

One way to work around this is to (manually) move Nuxeo Drive.app/Contents/MacOS/PyQt5/Qt5/qml to Nuxeo Drive.app/Contents/Resources/PyQt5/Qt5/qml, and then symlink it back to the original location (EDIT: and then manually re-sign the bundle again).

You could probably also hunt down all instances of problematic directories (Nuxeo Drive.app/Contents/MacOS/PyQt5/Qt5/qml/QtQml/Models.2, Nuxeo Drive.app/Contents/MacOS/PyQt5/Qt5/qml/QtQml/WorkerScript.2, Nuxeo Drive.app/Contents/MacOS/PyQt5/Qt5/qml/QtQuick.2, Nuxeo Drive.app/Contents/MacOS/PyQt5/Qt5/qml/QtQuick/Particles.2, etc.) and rename them by replacing dot with underscore (Models.2 to Models_2) and then symlinking back (Models.2 -> Models_2).

---

We are also using this approach ---> https://github.com/pyinstaller/pyinstaller/wiki/Recipe-OSX-Code-Signing-Qt
But getting " !! Notarization failed" error.

As the remainder of that error message says, you should check the report for details. As a side note, the recipe is community maintained and has not been updated since end of 2019, so it may not be applicable anymore...

[swetayadav1]

@rokm Thank you for your help.

As per the Notarization logs, we were getting "The signature of the binary is invalid" and "The signature does not include a secure timestamp" error message for few DLL.

https://osxapps-ssl.itunes.apple.com/itunes-assets/Enigma122/v4/13/be/5d/13be5d5d-d948-cf62-3a0b-2b883fba0fb5/developer_log.json?accessKey=1661626605_2512837922918896482_ItaiWRfIQmFH%2Bv5d80L3IDwpsD0H2erWD0l%2BcxKRApPncjXCram6z%2FsgOzjf%2BRbpkVmgnCiVZXMOj1Be10dzBdfepRZTfntVxz2uJG5vISnEYB818xdalYTzX44z%2BGTQMIiQPIfOhAtb4mCBOSAQart3QEh59qLNTANozYS8HyY%3D

While in Release logs it shows "dll is already signed".

So, we added --force command in codesign to sign file again whenever new release workflow trigger. Also, added --timestamp.
Build is stable now.

[shipyourpythonapp-png]

For anyone landing here from Google — after shipping a PySide6 app through notarization, the three failure causes I hit were, in order:

1. security find-identity returns "0 valid identities" even with the cert and key correctly installed → Apple's Developer ID G2 intermediate is missing from the keychain. Import https://www.apple.com/certificateauthority/DeveloperIDG2CA.cer then check codesign -d -vvv shows all 3 authorities.

2. Extensionless Mach-O binaries (QtCore.framework/Versions/A/QtCore, Python.framework/.../Python) skipped by extension-based signing loops → sign by real type (file -b = Mach-O*) via find -exec.

3. notarytool submit --wait exiting 0 on rejection — parse status: Accepted from the text output, never rely on the exit code, and read xcrun notarytool log <id> for the actual per-file errors.

Full write-up with the scripts: https://dev.to/shipyourpythonapp/shipping-a-python-desktop-app-to-real-users-everything-that-breaks-after-pyinstaller-succeeds-118f