title: Notarizing Mac OS app built with Corona SDK no longer working. Fails validation
body: <p>These are the commands I'm running.  This used to work for me every time but now it's failing.</p>
  
  <p><code>codesign -s "Developer ID Application: &lt;YOUR NAME&gt;" --timestamp --options runtime -f --entitlements entitlements.plist --deep &lt;APP NAME&gt;.app</code></p>
  
  <p><code>/usr/bin/ditto -c -k --keepParent &lt;APP NAME&gt;.app &lt;APPNAME&gt;.zip</code></p>
  
  <p><code>xcrun altool --notarize-app --primary-bundle-id "&lt;BUNDLE ID&gt;" -u "&lt;YOUR EMAIL&gt;" -p "&lt;APP SPECIFIC PASSWORD&gt;" --file &lt;YOURAPP&gt;.zip</code></p>
  
  <p>I get an email with "your app has failed notarization" or whatnot.</p>
  
  <p>These are the errors I'm getting.</p>
  
  <pre><code>{
  "logFormatVersion": 1,
  "jobId": "69910cca-87c0-44f6-a8ec-a0c8a6a7b614",
  "status": "Invalid",
  "statusSummary": "Archive contains critical validation errors",
  "statusCode": 4000,
  "archiveFilename": "MegaHasan.zip",
  "uploadDate": "2020-02-05T19:07:48Z",
  "sha256": "b6b7c75a0e50a9ec9f238360c674f9345ef6a97d27a21a69e793b7938927eb42",
  "ticketContents": null,
  "issues": [
  {
  "severity": "error",
  "code": null,
  "path": "MegaHasan.zip/Mega Hasan.app/Contents/Plugins/plugin_bit.dylib",
  "message": "The binary is not signed with a valid Developer ID certificate.",
  "docUrl": null,
  "architecture": "x86_64"
  },
  {
  "severity": "error",
  "code": null,
  "path": "MegaHasan.zip/Mega Hasan.app/Contents/Plugins/plugin_bit.dylib",
  "message": "The signature does not include a secure timestamp.",
  "docUrl": null,
  "architecture": "x86_64"
  },
  {
  "severity": "error",
  "code": null,
  "path": "MegaHasan.zip/Mega Hasan.app/Contents/Plugins/plugin_bit.dylib",
  "message": "The binary uses an SDK older than the 10.9 SDK.",
  "docUrl": null,
  "architecture": "x86_64"
  },
  {
  "severity": "error",
  "code": null,
  "path": "MegaHasan.zip/Mega Hasan.app/Contents/Plugins/libsteam_api.dylib",
  "message": "The binary is not signed with a valid Developer ID certificate.",
  "docUrl": null,
  "architecture": "x86_64"
  },
  {
  "severity": "error",
  "code": null,
  "path": "MegaHasan.zip/Mega Hasan.app/Contents/Plugins/libsteam_api.dylib",
  "message": "The signature does not include a secure timestamp.",
  "docUrl": null,
  "architecture": "x86_64"
  },
  {
  "severity": "error",
  "code": null,
  "path": "MegaHasan.zip/Mega Hasan.app/Contents/Plugins/plugin_steamworks.dylib",
  "message": "The binary is not signed with a valid Developer ID certificate.",
  "docUrl": null,
  "architecture": "x86_64"
  },
  {
  "severity": "error",
  "code": null,
  "path": "MegaHasan.zip/Mega Hasan.app/Contents/Plugins/plugin_steamworks.dylib",
  "message": "The signature does not include a secure timestamp.",
  "docUrl": null,
  "architecture": "x86_64"
  },
  {
  "severity": "error",
  "code": null,
  "path": "MegaHasan.zip/Mega Hasan.app/Contents/Frameworks/CoronaCards.framework/Versions/A/Frameworks/gameNetwork.dylib",
  "message": "The binary uses an SDK older than the 10.9 SDK.",
  "docUrl": null,
  "architecture": "x86_64"
  },
  {
  "severity": "error",
  "code": null,
  "path": "MegaHasan.zip/Mega Hasan.app/Contents/Frameworks/CoronaCards.framework/Versions/A/Frameworks/licensing.dylib",
  "message": "The binary uses an SDK older than the 10.9 SDK.",
  "docUrl": null,
  "architecture": "x86_64"
  }
  ]
  }
  </code></pre>