Getting codesigning error while doing Notarization due to lz4-java library.

[ashirvadgupta]

While doing notarization, I am getting below error for dylib files which are part of lz4-java-1.11.0.jar

{
"severity": "error",
"code": null,
"path": "devtest_osx_x64.dmg/DevTest Solutions Installer.app/Contents/Resources/app/15004.dat/.i4j_external_15002/lib/dradis/lz4-java-1.11.0.jar/net/jpountz/util/darwin/aarch64/liblz4-java.dylib",
"message": "The binary is not signed with a valid Developer ID certificate.",
"docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087721",
"architecture": "arm64"
},
{
"severity": "error",
"code": null,
"path": "abc.dmg/abc.app/Contents/Resources/app/15004.dat/.i4j_external_15002/lib/def/lz4-java-1.11.0.jar/net/jpountz/util/darwin/aarch64/liblz4-java.dylib",
"message": "The signature does not include a secure timestamp.",
"docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087733",
"architecture": "arm64"
},
{
"severity": "error",
"code": null,
"path": "abc.dmg/abcapp/Contents/Resources/app/15004.dat/.i4j_external_15002/lib/def/lz4-java-1.11.0.jar/net/jpountz/util/darwin/x86_64/liblz4-java.dylib",
"message": "The binary is not signed.",
"docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087721",
"architecture": "x86_64"
},
{
"severity": "error",
"code": null,
"path": "abc.dmg/abc.app/Contents/Resources/app/15004.dat/.i4j_external_15002/lib/def/lz4-java-1.11.0.jar/net/jpountz/util/darwin/x86_64/liblz4-java.dylib",
"message": "The signature does not include a secure timestamp.",
"docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087733",
"architecture": "x86_64"

[yawkat]

I don't use the apple ecosystem, I won't get a dev certificate. If someone has an alternative solution I'm open to it

[HTHou]

Netty project also ships macOS native libraries in its native artifacts, and those do not appear to be Developer ID signed either. That suggests this may be something better handled at the application packaging layer rather than by every library maintainer.