[I'm starting a separate thread, so as to not convolute this one.]
My app notarizes fine, but with warnings about embedded binaries using an older SDK. But if I place my app within a .PKG and then try to notarize that, all those same warnings get turned into errors and the notarization fails. I have entered a bug for this -- FB7457705. For the record, the .PKG eventually needs to go into a .DMG, which will be the item I ultimately notarize. But I'm trying this as an intermediate step.
If it matters, the embedded binaries in question are a Java 8 JRE from Azul Systems, which they built with the 10.8 SDKs. We do have plans to move to a more recent Java JRE. Their Java 11 JRE is built with the 10.9 SDK and their Java 12 JRE is built with the 10.13 SDK. But the architectural changes required to move to a later Java are too great for us to roll out just yet. And it is not feasible for us to wait to notarize our app until we can switch Javas.
