You must wait until the notarization is complete before stapling. You can do that either by watching your email, or you can automate it in a makefile. Here's one way to automate the wait.
myRequestID=$(shell xcrun altool \
--notarize-app \
--primary-bundle-id $(BUNDLE_ID) \
--username $(DEV_USERNAME) \
--password $(DEV_PASSWORD) \
--asc-provider $(DEV_PROVIDER) \
--file my.pkg; \
\
while ! xcrun altool \
--notarization-info $$myRequestID \
--username $(DEV_USERNAME) \
--password $(DEV_PASSWORD) \
--asc-provider $(DEV_PROVIDER) \
--output-format xml \
| grep -q 'https://osxapps-ssl.itunes.apple.com/itunes-assets' ;\
do sleep 5 ;\
echo "." ;\
done ;\
After waiting, you can staple.
xcrun stapler staple my.pkg
If this is still failing then it's a different issue. My first hunch would be that some component of the package is itself not signed and notarized. You need to notarize everything from the inside out.
You want to follow Apple's notarization instructions, but pass the installer package to the --file
argument.