New Developer ID team: clean, previously accepted app held for hours on every notarization

Code Signing Notarization
developer1243 OP
Created
Replies 1
Boosts 1
Views 211
Participants 2

My macOS app notarized in 22-24 seconds on every release for months under my
previous Developer ID team. I often shipped several releases a day, even with minor changes. Since
moving to a new Developer ID team (FPRW433858) on Oct 25, every submission of
the same app is held for hours:

  • 85da38d3-1874-458a-9bb5-e4656c770037 (Oct 25 19:09 UTC): still In Progress
    when my CI job hit its 6-hour limit; accepted later.
  • e4bf6e71-58dc-4710-abc0-ba0b459b099f (Oct 29 17:02 UTC): Accepted after
    1h56m. Log: "issues": null, "Ready for distribution". Useless because GitHub CI crashed on it.
  • 0c21d8be-cd60-45c0-b990-f7ebb616201a (Oct 29 19:02 UTC): In Progress, 1.5+
    hours and counting.

Same source, same build pipeline, same Sparkle framework, hardened runtime,
inside-out signing. The only change is the team. The build is clean, and you
have accepted it twice.

I've read the "some uploads are held for in-depth analysis" answers. That is
not an answer I can work with. A bugfix release now takes hours or fails
outright on CI time limits (6h on github), for an app you have already accepted twice under the new Dev ID and countless times under the old Dev ID.

I need concrete answers:

  1. Is team FPRW433858 flagged for in-depth analysis, and why?
  2. When does that end? After how many accepted submissions, or on what date?
  3. Is there anything I must do on my side? If so, what exactly?

If nothing on my side causes this, please clear the team or escalate it to
someone who can. I cannot accept to wait hours/days on app releases that are straightforward otherwise.

Replies  1
Boosts 1
Views  211
Participants  2
DTS Engineer OP
Apple
Written by developer1243 in 854326021

I've read the "some uploads are held for in-depth analysis" answers.

Right. That’s my standard answer to reports like this. I’ve included a copy below for your reference.

Written by developer1243 in 854326021

1- Is team FPRW433858 flagged for in-depth analysis … ?

Well, it’s not the team per se, but rather the submissions. But once a submission goes down the additional analysis path, other submissions from that team will typically wait behind it.

Written by developer1243 in 854326021

1- … and why?

I can’t say, both in the sense that “I don’t know” but also in the sense of “I’m not allowed to talk about those aspects of the notary service”.

Written by developer1243 in 854326021

2- When does that end?

This is not documented, and is unlikely to be documented.

My experience is that these additional analysis delays become less common as the notary service learns more about your submissions. However, I’ve also seen cases where someone has been notarising for years and some change in their software triggers additional analysis.

Written by developer1243 in 854326021
  1. Is there anything I must do on my side?

No.

Well, you could read the Q&A that I referenced below, but it addresses this issue specifically.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

You can expect that most uploads will be notarised quickly. Occasionally, some uploads are held for additional analysis and may take longer to complete. As you notarise your apps, the system will learn how to recognise them, and you should see fewer delays.

For lots of additional info about notarisation, see Notarisation Resources. Specifically, it links to a Q&A with the notary service team that’s quite instructive.