Apple’s notarytool can’t handle ZIP64 files

In short: if you have any file in your app (or whatever it is you’re trying to get Apple to sign) that is over 4 GiB, you must use a disk image (DMG) to package it for notarytool, not a zip file.

This is because support for files larger than 4 GiB requires using the “ZIP64” zip file format, which would be fine except Apple’s notary servers can’t handle them. If you give them such a zip file, you’ll see notarytool fail something like this:

$ xcrun notarytool submit "MyScreenSaver.saver.zip" --apple-id user-id --team-id team-id --verbose --wait --password lovesecretgod
[02:33:46.871Z] Debug [MAIN] Running notarytool version: 1.1.0 (39), date: 2026-07-13T02:33:46Z, command: /Applications/Xcode.app/Contents/Developer/usr/bin/notarytool submit MyScreenSaver.saver.zip --apple-id user-id --team-id team-id --verbose --wait --password private
Conducting pre-submission checks for MyScreenSaver.saver.zip and initiating connection to the Apple notary service...
[02:33:46.943Z] Info [PREFLIGHT] Confirmed that MyScreenSaver.saver.zip (4.61 GB) is likely a PKZip file.
[02:33:46.943Z] Debug [PREFLIGHT] Finished completing determination of file type for MyScreenSaver.saver.zip. Operation took 71ms.
…
[05:09:56.690Z] Info [API] Preparing GET request to URL: https://appstoreconnect.apple.com/notary/v2/submissions/some-uuid?, Parameters: [:], Custom Headers: private>
[05:09:56.690Z] Debug [AUTHENTICATION] Using cached token value for app-specific password request: team-id:user-id
[05:09:56.691Z] Debug [AUTHENTICATION] Authenticating request to '/notary/v2/submissions/some-uuid' with WebServices Token. AppleID: user-id, Team ID: team-id, Token: private
[05:09:56.692Z] Debug [TASKMANAGER] Starting Task Manager loop to wait for asynchronous HTTP calls.
[05:09:57.115Z] Debug [API] Received response status code: 200, message: no error, URL: https://appstoreconnect.apple.com/notary/v2/submissions/some-uuid?, Correlation Key: some-key
[05:09:57.115Z] Debug…