You need to use the App-Specific password in combination with your Apple ID email and the Team ID that signed the application with the command I provided above. It is okay to re-use the Xojo or AppWrapper password for this test.
I’m dumb, I forget to delete the {} when I replaced your text by my AppleID, password and TeamID.
The Terminal answers:
Successfully received submission info
createdDate: 2025-01-04T17:24:52.141Z
id: 5387c72d-7b89-413f-89e1-d2c6f5dcbadc
name: ToroMind 1.6.9.zip
status: In Progress
I created another specific-key (the one with 4letters-4letters-4letters-4letters ) for AppWrapper. But how does Apple know one is for Xojo and the other for AppWrapper?
Edit: Maybe Apple put my account in sleep because I made many attempts?
You created your Apple Developer Account some days ago, right?
Just a guess: Did you log in at https://developer.apple.com and sign all neccessary contracts?
I created my Apple account many years ago but I paid to become a authentified developper 2 days ago. But I don’t see any contracts to sign?
Did you try to notarize a fresh, empty Xojo-project?
I tried to notarize a fresh, empty Xojo-project with Xojo but not with AppWrapper. I will do it.
I made a project named “TestNotarize” but the answer of the command line tool “xcrun notarytool info” is still the same with my application ToroMind. I suppose Apple wait for the first Notarization finish before scan the 2nde one?
My wife is calling me to eat. Thank you very very much for your help. I will do another test tomorrow.
Well according to that status, Apple really is still reviewing your app. There isn’t much else to do but wait and continually check on it.
Ok, maybe Apple checks the first apps from a new Apple-ID manually…
I think if you haven’t, then the notarisation fails immediately.
I verified my contracts’s page and it seems ok:
Contrats
- Apple Developer Program License AgreementÉmis le 6 décembre 2024. Accepté le 2 janvier 2025.
- Apple Developer AgreementÉmis le 8 juin 2015. Accepté le 3 janvier 2020.
I turned off m Mac yesterday evenning while AppWrapper was waiting for Apple response. This morning I didn’t do anything except enter in the Terminal “xcrun notarytool info 5387c72d-7b89-413f-89e1-d2c6f5dcbadc --apple-id etc.” (I don’t relaunch Xojo notarization neither AppWrapper). The answer is still “status: In Progress”. Does this command ask for Apple server or is it something inside the Mac?
There isn’t anyway to kill an Apple process? As I made many attempts, how can I know if it is processing my last attempt or still the first one?
Yesterday I entered again in the Terminal the command line: “xcrun notarytool info 5387c72d-7b89-413f-89e1-d2c6f5dcbadc --apple-id etc.” and it returned that still in progress. This morning it returned:
Successfully received submission info
createdDate: 2025-01-04T17:24:52.141Z
id: 5387c72d-7b89-413f-89e1-d2c6f5dcbadc
name: ToroMind 1.6.9.zip
status: Invalid
A friend sent me a sample Xcode project to make test, he asked me to send one of my application not notarized to try to notarize it himself. And I tried again to notarized it and it seems to work this time. I entered in the Terminal:
spctl -a -v {PathToApplication}
and it returned:
/Volumes/MBtom-HD2/MesDocuments/5 Programmes/Xojo Perso/MemoDate_src/Builds - MemoDate 1.6.2/macOS ARM 64 bit/MemoDate.app: accepted
source=Notarized Developer ID
But if I enter again “xcrun notarytool info 5387c72d-7b89-413f-89e1-d2c6f5dcbadc --apple-id etc.” the answer is still about ToroMind (my first attempt). Then I suppose the number 5387c72d-7b89-413f-89e1-d2c6f5dcbadc point to my application ToroMind. How do you get it Tim?
My application which seems to be accepted MemoDate-Notarized-01.zip (it read birthdate in AddressBook).
The description page of my application: MemoDate_Page (the version on this page is not notarized).
A sample game I played when I was young on a peace of paper and a pen. I developed it as a chalenge to make the computer find the solution (the Preferences allow computer to show you which cell to fill in order to win).
SquareBid-Notarized-01.zip
For those who test my applications, they only create a folder named “fr.Toroco.MyApplicationName” in the “Application Support” folder.
This command checks in with the Apple servers.
Nope, you just let Apple clean it up. If you make a new build, you can just forget about previous notarization requests.
It came from your App Wrapper log. It’s the ID Apple gave the App Wrapper attempt. I do not know how to recover the ID for a Xojo Notarization attempt. If you were to run the notarization command manually, the ID is what you are given when you submit the request. You must then check up on it using the info command you have been using.
You can use this neat tool called Whats Your Sign to check signature and notarization status directly in the Finder, by the way.
2 Likes
Thank you Tim and the other for your help. Some of my project are downloadable on my website. Myself I sometimes downloaded some project to learn how to develop with Xojo. I openned one on my project with a TextEditor (BBEdit) and my Developper ID code is in clear. Then I won’t be able to share my project. And if one day I submit a bug and post one of my project, I may forget to remove this Developper ID code.
I think I may submit a report to Xojo in order to ask them to do a different way. I see my Apple account I entered in Notarization setup appears in all my project without I have to fill them, and I can’t find my Apple ID in the project opened with BBEdit, then I think Xojo save those settings somewhere else.
If you follow @Tim_Parnell 's suggestion for looking at the signing info, you will find your developer ID there too - I just did it for my app.
Ahh ok, then we don’t have to keep our developer ID secret? But you hide it in the screencapture you posted 5 days ago. You prefer to hide it but it’s not absolutely necessary right?
We only have to keep secret the password for application if I well understand.
Nope, it’s available on anything you code sign and share. I always chuckle when people hide it in screenshots. 
Correct. Remember, that App-Specific password is access to your Apple ID account.
Thanks again Tim and Tim, then Xojo made the right things (as usual 
). The developer ID is in clear and the App password is hidden.
One more question, Xojo has a cell for the developper ID and another one for the Team ID. I entered the same as you all explained me. I suppose it as useful for company, the company has a TeamID for all the developper and each developer has his/her own ID?
A sign of our incomplete understanding, which you have helped clarify. One less thing to obscure with Photoshop Elements for next time.
Just for clarification, the expected value in the Developer ID field (Build Settings > macOS > Sign) is the full developer ID string from the certificate. For example (without the quotes):
“Developer ID Application: your-name-goes-here (the-team-id-goes-here)”
3 Likes