Skip to content

fix(notarize): auto-retrieve notarytool log on status: Invalid #1251

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ErikBjare merged 2 commits into from
Apr 9, 2026
+21 −3
Merged

fix(notarize): auto-retrieve notarytool log on status: Invalid #1251

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
37f25eb
fix(notarize): auto-retrieve notarytool log on status: Invalid
TimeToBuildBob Apr 9, 2026
bbece57
fix(notarize): stream notarytool output in real-time via tee
TimeToBuildBob Apr 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 21 additions & 3 deletions scripts/notarize.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,15 +8,33 @@ bundleid=net.activitywatch.ActivityWatch # Match aw.spec
app=dist/ActivityWatch.app
dmg=dist/ActivityWatch.dmg

# XCode >= 13
# XCode >= 13
run_notarytool() {
dist=$1
# Setup the credentials for notarization
xcrun notarytool store-credentials $keychain_profile --apple-id $applemail --team-id $teamid --password $password
# Notarize and wait
# Notarize and wait; tee to a temp file so output streams in real-time
# while we can still inspect it afterward for failure details.
echo "Notarization: starting for $dist"
echo "Notarization: in progress for $dist"
xcrun notarytool submit $dist --keychain-profile $keychain_profile --wait
tmpfile=$(mktemp)
xcrun notarytool submit $dist --keychain-profile $keychain_profile --wait 2>&1 | tee "$tmpfile"
submission_exit=${PIPESTATUS[0]}
submission_output=$(cat "$tmpfile")
rm -f "$tmpfile"
# On failure, retrieve the detailed rejection log from Apple's server.
# This avoids having to run 'notarytool log' manually after the fact.
if echo "$submission_output" | grep -q "status: Invalid"; then
uuid=$(echo "$submission_output" | grep '^[[:space:]]*id:' | head -1 | awk '{print $NF}')
if [ -n "$uuid" ]; then
echo ""
echo "=== Notarization rejected (status: Invalid) — fetching rejection log for $uuid ==="
xcrun notarytool log "$uuid" --keychain-profile $keychain_profile 2>&1 || true
Copy link
Copy Markdown

@greptile-apps greptile-apps bot Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Silent failure on log fetch gives no diagnostic hint

|| true suppresses the exit code, so if notarytool log fails (network error, expired credentials, rate-limit, etc.) the CI log will show only the empty section markers with no indication of what went wrong. Since this fetch is specifically meant to aid debugging, a small notice on failure is more useful:

Suggested change
xcrun notarytool log "$uuid" --keychain-profile $keychain_profile 2>&1 || true
xcrun notarytool log "$uuid" --keychain-profile $keychain_profile 2>&1 || echo "Warning: 'notarytool log' failed — log may be unavailable"

echo "=== End of rejection log ==="
fi
return 1
fi
return $submission_exit
}

# XCode < 13
Expand Down
Loading