notarytool Can’t Handle Zip64 Files
In short: if you have any file in your app (or whatever it is you’re trying to get Apple to sign) that is over 4 GiB, you must use a disk image (DMG) to package it for notarytool, not a zip file.
This is because support for files larger than 4 GiB requires using the “Zip64” zip file format, which would be fine except Apple’s notary servers can’t handle them.
Previously:
Update (2026-07-22): Rosyna Keller:
It’s recommended to notarized exactly what you’re going to ship to users and shipping zips is extremely risky because you never know what tool the user will use to decompress the file.
Multiple unzipping tools will strip necessary extended attributes that could cause the code signature to fail to validate. This is especially true if you put non-code files in “code places” and they have to be signed with an extended attribute.
1 Comment RSS · Twitter · Mastodon
The author is wrong assuming that you need the zip64 format for zips > 4 GB or even files > 4 GB. Try zipping such a large file in Finder - you'll get a classic zip, not a zip64, and Finder can unzip it again too.
That works because there is redundant information in the zip file that allows an unzipper to determine the full size even if overflows the 32bit limit of the old format.
What remains to be checked, though, is whether Apple's server side tools can handle those files as well.
