(
source and
source)
Don't you need to sign the bundle first before submitting it to the notarize service (I've never done this, but was just curious)?
From StackOverflow;
codesign --force --verbose=9 -s "Developer ID Application: XXXXXXX" --options runtime --deep --entitlements ./entitlements Myapp.app
where "--options runtime" seems to be a critical option to add.