notarization: ".pkg could not be extracted."

Hi, after a software update of our previously successfully notarizated installion .pkg we now receive a cryptic notarization issue refusing the entire .pkg:

{
  "logFormatVersion": 1,
  "jobId": "5cff2d71-7228-4fb4-a39d-329084cd2713",
  "status": "Invalid",
  "statusSummary": "Archive contains critical validation errors",
  "statusCode": 4000,
  "archiveFilename": "my_installer.pkg.zip",
  "uploadDate": "2024-12-04T23:17:14.016Z",
  "sha256": "2f26d0376506abe130ac904d7cb0d0cd5428666624428da9f44da7756352844f",
  "ticketContents": null,
  "issues": [
    {
      "severity": "error",
      "code": null,
      "path": "my_installer.pkg.zip",
      "message": "Package my_installer.pkg.zip has no signed executables or bundles. No tickets can be generated.",
      "docUrl": null,
      "architecture": null
    },
    {
      "severity": "warning",
      "code": null,
      "path": "my_installer.pkg.zip/my_installer.pkg",
      "message": "The contents of the package at my_installer.pkg.zip/my_installer.pkg could not be extracted.",
      "docUrl": null,
      "architecture": null
    }
  ]
}

What could be the reason for that? We've also submitted the .pkg (not zipped) with the same result. We build it on different macOS versions, including Sonoma 14.7 with latest developer tools installed, without any change in outcome.

But when extracting it via the undocumented:

pkgutil --expand-full

and .zipping the raw contents (without re-packaging it as .pkg) and sending it again, notarization succeeds for all components.

However the installation for the .pkg still fails with the notarization dialog. I was under the assumption that it is sufficient to notarize the .pkg contents but this does not seem to be true, or?

Any hints or help is highly appreciated, Thanks!