Notarization log reader
When Apple's notary service says Invalid, the reasons are in a JSON log with one line per file and architecture. Paste it here to see the problems grouped, in the order to fix them, each with Apple's explanation, the fix, and a command to check it on your Mac. When it is Accepted, you get the staple and Gatekeeper commands for what you uploaded. Nothing is uploaded.
Explanations follow Apple's “Resolving common notarization issues”. Messages and log fields were checked against real logs from Apple's notary service on 2026-10-31.
Get the log for a submission:
xcrun notarytool log <submission-id> --keychain-profile "notary" notary-log.json
Or drop the .json file here
How it works
- •It reads the log that xcrun notarytool log saves, even with notarytool's own lines pasted before it. If you paste only the summary notarytool printed, it gives you the command to download the full log.
- •Issues are grouped by problem: the same message for the arm64 and x86_64 slices of one file becomes one line, so a list of 13 issues reads as 4 things to fix.
- •Problems are sorted so that the fix for one does not hide another: a missing or wrong signature first, then entitlements, hardened runtime and timestamp.
- •It looks at patterns across issues, for example a Mac App Store package sent for notarization, or a ZIP that cannot be stapled.
- •Every message and field was checked against real logs from Apple's notary service, including one that says “The binary is not signed.”, which Apple's article does not list.
What it does not do
- •It does not talk to Apple. Download the log yourself with notarytool, using your own key or keychain profile.
- •It cannot see your files. The check commands run on your Mac; paths from the log are put in quotes.
- •Messages outside Apple's list of common issues are shown as they are, with the link the log gives.
Questions
- How do I get the notarization log?
- Run xcrun notarytool log <submission-id> --keychain-profile "<profile>" notary-log.json (or with --key, --key-id and --issuer for an API key). The submission id is printed when you submit, and xcrun notarytool history lists past ones.
- What does “The signature does not include a secure timestamp” mean?
- The code was signed without --timestamp, so there is no timestamp from Apple's server in the signature. Sign again with --timestamp while the Mac can reach timestamp.apple.com. Xcode adds it when you archive and export.
- Why does notarization say my app is not signed with a valid Developer ID certificate?
- It was signed with another certificate, such as Apple Development or Mac App Distribution, or ad hoc. Only Developer ID Application (and Developer ID Installer for packages) can be notarized.
- Do Mac App Store apps need notarization?
- No. Notarization is for software distributed outside the Mac App Store. App Store builds go to App Store Connect; sending an App Store package to the notary service fails with Developer ID errors.
- Can I staple a ticket to a ZIP file?
- No. Apple says you can staple to apps, disk images and flat installer packages, not ZIPs or standalone binaries. Staple the app, then zip it again.
- How long does notarization take?
- Apple says most software finishes within 5 minutes and 98 percent within 15 minutes.