macOS runner: notarytool status "Invalid" notarization in CI
notarytool accepted the submission but the notary service finished with status "Invalid". The artifact was scanned and failed: typically a binary is unsigned, lacks the hardened runtime, or has a bad timestamp. The detailed reasons are in the notary log.
What this error means
A notarytool submit --wait step completes but prints "status: Invalid", and the job should fail. The reasons require fetching the log.
status: Invalid
...
Conducting pre-submission checks for app.zip and initiating connection to the Apple notary service...Common causes
A binary is unsigned or missing the hardened runtime
Notarization requires every executable to be signed with the hardened runtime (--options runtime). A missing signature or option fails the scan.
A secure timestamp is missing
Signatures must include a secure timestamp; signing offline or with --timestamp=none produces artifacts the notary rejects.
How to fix it
Read the notary log to see exact issues
- Capture the submission id from the submit output.
- Fetch the log with
notarytool log. - Fix each path it lists, then resubmit.
xcrun notarytool log "$SUBMISSION_ID" \
--key AuthKey.p8 --key-id "$KEY_ID" --issuer "$ISSUER_ID" notary.logSign with hardened runtime and a timestamp
Re-sign every component with the hardened runtime enabled and a secure timestamp before notarizing.
codesign --force --options runtime --timestamp --sign "$IDENTITY" MyApp.appHow to prevent it
- Sign with
--options runtime --timestampfor every component. - Always fetch the notary log to diagnose Invalid results.
- Verify signing locally before submitting in CI.