The first notarized submission came back Invalid: xcodebuild build injects
com.apple.security.get-task-allow into the signature, which archive would
have stripped and which notarization and App Store review both reject.
build_signed.sh now passes CODE_SIGN_INJECT_BASE_ENTITLEMENTS=NO and
refuses an app still signed with it, before any upload.
notarytool exits 0 on Invalid, and the step learned the result only when
stapling failed with an unrelated-looking CloudKit error. It now reads the
status, and on anything but Accepted prints Apple's log and names the
submission.
jwinterm
d0f4e20b29