Packaging and notarizing a macOS app only works exporting through Xcode first

[LucasVanDongen]

I have a macOS app that I distribute as an installer package outside of the Mac App Store.

I have a manual flow that works, where I archive then export MyApp.app, followed by executing the following scripts manually:

pkgbuild --root "MyApp.app" \
           --identifier "com.myapp.MyApp" \
           --version "0.6.0" \
           --install-location "/Applications/MyApp.app" \
           --sign "Developer ID Installer: MyApp Inc (12345678EE)" \
           --scripts scripts \
           MyAppInstaller.pkg

xcrun notarytool submit MyAppInstaller.pkg \
                   --keychain-profile "Mac Installer" \
                   --wait

xcrun stapler staple MyAppInstaller.pkg

All fine, but I would like to automate everything with a single line of code, updating the version number and so on. Fastlane is the most logical choice. My configuration looks something like this:

platform :mac do
  lane :release do
    build_number = get_build_number(xcodeproj: project)
    identity = "Developer ID Installer: MyApp Inc (123456789EE)"

    # I don't know how else to do it, otherwise it will reset to the version number known in the App Store which we don't use
    version_number = get_version_number(xcodeproj: project, target: scheme)
    increment_build_number(xcodeproj: project, build_number: version_number.to_i + 1)

    build_app(
      workspace: workspace, 
      scheme: scheme, 
      export_method: "mac-application"
    )

    # Now try to package and notarize
    installer_dir = "../Builds/#{version_number}-#{build_number}"
    sh "
    cd ..
    mkdir -p #{installer_dir}
    pkgbuild --root \"MyApp.app\" \\
           --identifier \"com.myApp.MyApp\" \\
           --version \"#{version_number}\" \\
           --install-location \"/Applications/MyApp.app\" \\
           --sign \"#{identity}\" \\
           --scripts scripts \\
           #{installer_dir}/MyAppInstaller.pkg

xcrun notarytool submit #{installer_dir}/MyAppInstaller.pkg \\
                   --keychain-profile \"Mac Installer\" \\
                   --wait
    "
  end
end

It all executes, but the notarytool step fails. When I inspect the error, it complains that none of the binaries are signed, no timestamp, etcetera.

When I use codesign -d -vvv ClockAssist.app on the .app that doesn't work, I see the following

Authority=Apple Development: Main Developer (12345678EE)

When I use the same command on the .app that I use in the manual flow, I see the following:

Authority=Developer ID Application: MyApp Inc (12345678EE)

When I add codesigning_identity: "Developer ID Application: MyApp Inc (12345678EE)" to build_app I get a plethora of different errors, like:

error: MyAppSharedObjects has conflicting provisioning settings. MyAppSharedObjects is automatically signed, but code signing identity Developer ID Application: MyApp Inc (12345678EE) has been manually specified.

Also it doesn't have the key in the Keychain.

So I must be missing something really simple here, but I don't know what?