Thank you for confirming that things continue to change on the back end of the notarization checks - I've found a workaround for now (for any other java devs scratching their heads - if you build the runtime using a separate call to jlink, instead of letting jpackage call it for you then it all works - will debug behaviours of jpackage signing when time permits). There have been many "well this was ok last week" moments in the notarization journey - not least of which was now checking deep inside JAR files for executables - that caused so much hassle as 3rd party open source providers don't sign much, and rarely with apple sigs. Thanks for the page of links, useful indeed. I didn't see any link to a release or change log for back end notarization checks, is there a way to see these as they happen to help with when something no longer works as it used to? Thanks!