When you are ready to attempt notarizing your Mac app here are the terminal commands that are working for me:
xattr -cr (takes stuff out of the app that can’t be there for code signing)
codesign -vv --deep --strict --force --timestamp --option=runtime --sign “Developer ID Application: Scott Manders (XXXXXXXXXXX)”
Then make a signed (codesign -v --force --strict --timestamp --options=runtime --sign “Developer ID Application: Scott Manders (XXXXXXXXXXX)” ) dmg with this app and submit for notarization:
xcrun altool -t osx -f --primary-bundle-id com.. --notarize-app --username email@example.com
This command takes a long time to complete depending on the size of the dmg that’s uploaded to Apple.
You will have to give your Apple ID password a couple times along the way.
It will not notarize — 31 errors for me — but when you go to the error log url you get when you give the below command, it will have all the paths that had an error. My errors for this first run were all due to No Timestamp, Not Runtime Hardened or Not/Not Adequately Signed; your app may be different. Note: the terminal manual for the --deep option for the codesign command says that often you have to give the command recursively to get everything in an app bundle signed; I think Xcode does this recursive signing automatically.
xcrun altool --notarization-info -u firstname.lastname@example.org
Then you give multiple terminal commands the same as the codesign command above except you substitute the failed path names given you in the url’s webpage (copy this webpage into a separate document because it doesn’t persist long). Multiple commands can be strung together separated by “;” and “&&” without the quotes. && waits for the preceding command to complete before running the next command and ; does not wait. You can use both in the same command string. Or you can write a shell script with all the commands. I did not bother with the shell script.
That still did not notarize for me. There was one more signing error that was easily taken care of by adding to the terminal command string. However, two errors due to the internet commands bundle not being compiled against a recent enough version of Xcode I could not fix.
That was all with 17.1 and 17.2 and I got down to 2 errors as noted. I am going to try with 17R5 soon. Hopefully it will work but there may be additional errors due to the changes in 17R5 or other factors.
As per Thomas Maul’s postings above, I don’t think we can be certain everything will work right until the final version of Catalina comes out.