Gets stuck on notarization with `renconstruct build`

[furudean]

I have generated certificates using renotize provision, but I can't seem to run notarization successfully.

> renconstruct build hellogirl/ out
Clearing output directory
Building other packages.
Scanning project files...
[S_API FAIL] SteamAPI_Init() failed; ipcserver init failed .
[S_API] SteamAPI_Init(): SteamAPI_IsSteamRunning() did not locate a running instance of Steam.
[S_API] SteamAPI_Init(): Could not determine Steam client install directory.
Scanning Ren'Py files...
Writing the pc zip package. - 2166 of 2166
Writing the pc rpu package. - 2165 of 2165
Writing the mac app-zip package. - 2152 of 2152
Writing the mac rpu package. - 2154 of 2154
Finishing the mac rpu package. - 1995 of 1994All packages have been built.

Due to the presence of permission information, unpacking and repacking the Linux and Macintosh distributions on Windows is not supported.
[Post] Running task: notarize
Unpacking app to "out/hello_girl-1.2.1-mac"
Signing app at "out/hello_girl-1.2.1-mac/hello_girl.app"
Inferred team ID: WRSA45Z5WG
Signing bundle at "out/hello_girl-1.2.1-mac/hello_girl.app"
Notarizing app at "out/hello_girl-1.2.1-mac/hello_girl.app"
Uploading file to notarization service

my config looks like this

[tasks.notarize] # required if matching task is enabled
type = "notarize"
enabled = true
priorities = { post_build = 10 }
on_builds = ["mac"]
bundle_id = "love.maillard.hellogirl"                  # the bundle ID of your came, typically in reverse domain notation
key_file = "certificates/private-key.pem"              # the path to the private key file generated during the provisioning process
cert_file = "certificates/developerID_application.cer" # the path to the Apple-generated certificate file generated during the provisioning process
app_store_key_file = "certificates/app-store-key.json" # the path to the combined App Store key file generated during the provisioning process

[build]
pc = true           # Windows + Linux
win = false         # Windows
linux = false       # Linux
mac = true          # macOS
web = false         # Web
steam = false       # Steam
market = false      # Multiple Markets (i.e. Itch.io)
android_apk = false # Android Universal APK
android_aab = false # Android Play Store Bundle

[options]
clear_output_dir = true # whether to clear the output directory on startup

[renutil]
version = "8.2.0"  # the Ren'Py version to use (required)
registry = "cache" # the directory to store installation files in

let me know if i can help debug this in any way!

[kobaltcore]

Do note that notarization can take a while, so waiting for up to half an hour is not unexpected. This is largely governed by the size of the game as well how occupied Apple's notarization servers are at that moment. renotize ships with a default max wait time of 1800s which works out to 30 minutes. How long did you wait on this attempt?

[furudean]

I actually got very impatient and quit after just a few minutes. I'll leave it on for a bit longer and report back if it works.

Maybe this message could be improved to reflect that it will take a while, or at the very least not just say "uploading" if it's done uploading and just waiting for Apple to do its thing.

ctrl+c/ctrl+d seems to not be functional to cancel the program in this state. i actually had to kill the process manually, so that's maybe something to look out for too

[kobaltcore]

Yeah, it could definitely stand a bit more output just to inform the user of what's happening. The library I'm using that enables this makes this relatively difficult, but I'll see what I can do. That should then also resolve the 'not being able to quit properly' thing at the same time.

[kobaltcore]

I've release 4.0.3 which comes with better output when notarizing. For now, I opted to display a progress bar that counts down the 30 minute maximum wait window, but most likely processes will finish before that. It provides evidence that the process is still running though, at least.

[furudean]

I'm having bad luck.

[Post] Running task: notarize
Unpacking app to "out/hello_girl-1.2.1-mac"
Signing app at "out/hello_girl-1.2.1-mac/hello_girl.app"
Inferred team ID: WRSA45Z5WG
Signing bundle at "out/hello_girl-1.2.1-mac/hello_girl.app"
Notarizing app at "out/hello_girl-1.2.1-mac/hello_girl.app"
Uploading file to notarization service
Error: reached time limit waiting for notarization to complete

[kobaltcore]

Could you try this with the latest release? It will also print some debug output in case the notarization fails. It's odd that the entire duration just passes by though, for sure...

[furudean]

[Post] Running task: notarize
Unpacking app to "out/hello_girl-1.2.1-mac"
Signing app at "out/hello_girl-1.2.1-mac/hello_girl.app"
Inferred team ID: WRSA45Z5WG
Signing bundle at "out/hello_girl-1.2.1-mac/hello_girl.app"
Notarizing app at "out/hello_girl-1.2.1-mac/hello_girl.app"
Uploading file to notarization service
Upload complete
Notarization UUID: 125444c1-f2d9-40cd-8197-2122733c9a04
Waiting for notarization to complete
━━━━━━━━━━━━━━╴─────────────────────────────────   531/1,800 0.9387/s eta 23m

hitting this uuid with notarytool, i can see that it is indeed in progress

> xcrun notarytool info 125444c1-f2d9-40cd-8197-2122733c9a04
Successfully received submission info
  createdDate: 2024-03-11T17:23:21.326Z
  id: 125444c1-f2d9-40cd-8197-2122733c9a04
  name: hello_girl.app.zip
  status: In Progress

i'll report back in a while...? this definitely doesnt seem to be a problem on the renconstruct side of things, unless there's something about the submission that is badly formed that causes it to hang

[kobaltcore]

renotize uses what should be the exact same way of checking status that notarytool does, so the output between the two should always match. As such, it indeed looks like it's going, just taking a while. It's weird cause I notarized things a couple of times while testing and it finished within a few minutes each time. However, I am in Germany so maybe they have local servers that are less busy. Definitely let me know once this finishes!

[furudean]

it seems that all is well, it ended up working this time around.

[Post] Running task: notarize
Unpacking app to "out/hello_girl-1.2.1-mac"
Signing app at "out/hello_girl-1.2.1-mac/hello_girl.app"
Inferred team ID: WRSA45Z5WG
Signing bundle at "out/hello_girl-1.2.1-mac/hello_girl.app"
Notarizing app at "out/hello_girl-1.2.1-mac/hello_girl.app"
Uploading file to notarization service
Upload complete
Notarization UUID: 125444c1-f2d9-40cd-8197-2122733c9a04
Waiting for notarization to complete
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 1,800/1,800 2.086/s eta 0s                                                                         Notarization accepted
Stapling notarization to file
Packing DMG to "out/hello_girl-1.2.1-mac/hello_girl.dmg"
Name: hello_girl
..................................................................................................................................
created: /Users/meri/Code/hello-girl/out/hello_girl-1.2.1-mac/hello_girl.dmg
Signing DMG at "out/hello_girl-1.2.1-mac/hello_girl.dmg"
Automatically setting team ID from signing certificate: WRSA45Z5WG
Notarizing DMG at "out/hello_girl-1.2.1-mac/hello_girl.dmg"
Uploading file to notarization service
Upload complete
Notarization UUID: e159ff51-c31e-41c4-bc44-91c0da77d513
Waiting for notarization to complete
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 1,800/1,800 15.1424/s eta 0s                                                                       Notarization accepted
Stapling notarization to file
Done!

> spctl -a -t exec -vv out/hello_girl-1.2.1-mac/hello_girl.app
out/hello_girl-1.2.1-mac/hello_girl.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: IMO TEAM LLC (WRSA45Z5WG)
> spctl -a -t open -vvv --context context:primary-signature out/hello_girl-1.2.1-mac/hello_girl.dmg
out/hello_girl-1.2.1-mac/hello_girl.dmg: accepted
source=Notarized Developer ID
origin=Developer ID Application: IMO TEAM LLC (WRSA45Z5WG)

[kobaltcore]

Ah, good to hear! I guess Apple's notarization servers were a little finicky today. I'll close this issue in that case, feel free to open another one if other issues pop up with the build system.