Wade Tregaskis:

In short: if you have any file in your app (or whatever it is you’re trying to get Apple to sign) that is over 4 GiB, you must use a disk image (DMG) to package it for notarytool, not a zip file.

This is because support for files larger than 4 GiB requires using the “Zip64” zip file format, which would be fine except Apple’s notary servers can’t handle them.

Previously:

• altool Update and notarytool

Update (2026-07-22): Rosyna Keller:

It’s recommended to notarized exactly what you’re going to ship to users and shipping zips is extremely risky because you never know what tool the user will use to decompress the file.

Multiple unzipping tools will strip necessary extended attributes that could cause the code signature to fail to validate. This is especially true if you put non-code files in “code places” and they have to be signed with an extended attribute.