2019年10月23日更新
评论区有小伙伴说：
苹果在Mac AppStore 发布了transporter 来代替Application Loeader，可视化上传更方便
本文内容可忽略。
Xcode 11 Release Notes
从Xcode11开始，Application Loader不再集成在Xcode中，需要使用xcodebuild或者xcrun altool命令上传应用。
Xcode supports uploading apps from the Organizer window or from the command line with xcodebuild or xcrun altool. Application Loader is no longer included with Xcode. (29008875)
使用旧版 Application Loader
如果是觉得使用命令行的方式麻烦，也可以复制旧版Application Loader到Xcode对应路径下，重启Xcode即可使用。
../Applications/Xcode.app/Contents/Applications/
这个是Xcode10.3下的
链接:https://pan.baidu.com/s/1BZVkXhZW83zF_jCCRlu53A 密码:y6ib
使用 xcrun altool
Xcode11以下的命令是这样的：
$ xcrun altool
Copyright (c) 2009-2018, Apple Inc. Version 1.1.1138
Usage: altool --validate-app -f -t -u [-p ]
altool --upload-app -f -t -u [-p ]
altool --notarize-app -f --primary-bundle-id -u [-p ] [--asc-provider ]
altool --notarization-info -u [-p ]
altool --notarization-history -u [-p ] [--asc-provider ]
-f, --file specifies the path to the file to process.
-t, --type {osx | ios | appletvos} Specify the platform of the file.
-u, --username Username. Required to connect for validation, upload, and notarization.
-p, --password Password. Required if username specified.
If this argument is not supplied on the command line, it will be read from stdin.
Alternatively to entering in plaintext, it may also be specified using a '@keychain:'
or '@env:' prefix followed by a keychain password item name or environment variable name.
Example: '-p @keychain:' uses the password stored in the keychain password item named
and whose Account value matches the user name specified
Example: '-p @env:' uses the value in the environment variable named
--primary-bundle-id Used with --notarize-app to uniquely identify a package.
--asc-provider Required with --notarize-app and --notarization-history when a user account is associated with multiple
providers.
-v, --validate-app Validates an app archive for the App Store. The username, password, and file path to the app archive are required.
--upload-app Uploads the given app archive to the App Store. The username, password, and file path to the app archive are required.
--notarize-app Uploads the given app package, dmg or zip file for notarization. The file path to the package, user name,
password, and --primary-bundle-id are required. --asc-provider is required for an account associated with multiple providers.
If successful, the UUID associated with the upload is returned.
--notarization-info Returns the status and log file URL of a package previously uploaded for notarization with the specified uuid.
The user name and password are required. The log file can be retrieved with 'curl '.
--notarization-history Returns a list of all uploads submitted for notarization. specifies a range of entries where 0
returns the most recent number of entries. A new page value will be returned which can be used as the
value to the next use of --notarization-history and so forth until no more items are returned. The user name
and password are required. --asc-provider is required for an account associated with multiple providers.
--output-format {xml | normal} Specifies how the output is formatted. 'xml' displays the output in a structured format; 'normal' displays in
an unstructured format (default).
-h, --help Display this output.
账号密码的方式上传包体，如下：
- 先验证
xcrun altool --validate-app -f 包体绝对路径.ipa -t iOS -u 用户名 -p 密码
- 再上传
xcrun altool --upload-app -f 包体绝对路径.ipa -t iOS -u 用户名 -p 密码
如果出错：
*** Error: Unable to validate archive '/Users/jingyin/Desktop/***.ipa': ( "Error Domain=ITunesSoftwareServiceErrorDomain Code=-22020 "We are unable to create an authentication session." UserInfo={NSLocalizedDescription=We are unable to create an authentication session., NSLocalizedFailureReason=Unable to validate your application.}"
有可能是密码需要使用动态密码。而不是原来账号的密码。需要先登录账号，获取到动态密码，再用在此处。官方文档
如果验证成功：
No errors validating archive at '/Users/jingyin/Desktop/***.ipa'
上传成功：
No errors uploading '/Users/jingyin/Desktop/***.ipa'
Xcode11更新了命令
$ xcrun altool
Copyright (c) 2009-2019, Apple Inc. Version 4.00.1181
Usage: altool --validate-app -f -t -u {[-p ] | --apiKey --apiIssuer }
altool --upload-app -f -t -u {[-p ] | --apiKey --apiIssuer }
altool --notarize-app -f --primary-bundle-id -u {[-p ] | --apiKey --apiIssuer } [--asc-provider ]
altool --notarization-info -u {[-p ] | --apiKey --apiIssuer }
altool --notarization-history -u {[-p ] | --apiKey --apiIssuer } [--asc-provider ]
altool --list-apps -u {[-p ] | --apiKey --apiIssuer }
altool --store-password-in-keychain-item -u -p
Authentication: Most commands require authorization.
There are two methods available: user name with password, and apiKey with apiIssuer.
-u, --username Username. Required to connect for validation, upload, and notarization.
-p, --password Password. Required if username specified and apiKey/apiIssuer are not.
If this argument is not supplied on the command line, it will be read from stdin.
Alternatively to entering in plaintext, it may also be specified using a '@keychain:'
or '@env:' prefix followed by a keychain password item name or environment variable name.
Example: '-p @keychain:' uses the password stored in the keychain password item named .
You can create and update keychain items with the
--store-password-in-keychain-item command.
Example: '-p @env:' uses the value in the environment variable named
--apiKey apiKey. Required for JWT authentication while using validation, upload, and notarization.
This option will search the following directories in sequence for a private key file
with the name of 'AuthKey_.p8': './private_keys', '~/private_keys', '~/.private_keys',
and '~/.appstoreconnect/private_keys'.
--apiIssuer Issuer ID. Required if --apiKey is specified.
-f, --file specifies the path to the file to process.
-t, --type {osx | ios | appletvos} Specify the platform of the file.
--primary-bundle-id Used with --notarize-app to uniquely identify a package.
--asc-provider Required with --notarize-app and --notarization-history when a user account is associated with multiple
providers.
-v, --validate-app Validates an app archive for the App Store. Authentication and -f are required.
--upload-app Uploads the given app archive to the App Store. Authentication and -f are required.
--list-apps Display all apps associated with your account(s).
--notarize-app Uploads the given app package, dmg or zip file for notarization. Authentication, -f,
and --primary-bundle-id are required. --asc-provider is required for an account associated with multiple providers.
If successful, the UUID associated with the upload is returned.
--notarization-info Returns the status and log file URL of a package previously uploaded for notarization with the specified .
Authentication is required. The log file can be retrieved with 'curl '.
--notarization-history Returns a list of all uploads submitted for notarization. specifies a range of entries where 0
returns the most recent number of entries. A new page value will be returned which can be used as the
value to the next use of --notarization-history and so forth until no more items are returned.
Authentication is required. --asc-provider is required for an account associated with multiple providers.
--store-password-in-keychain-item -u -p
Stores the password in the keychain item named associated with the account .
If an item with that name and account already exists in the keychain, its password will be updated. Otherwise a new item
is created with that name. You can use this keychain item with the -p option to mask your password with other commands.
Example: altool --store-password-in-keychain-item MY_SECRET -u [email protected] -p "MyP@ssw0rd!@78"
altool --notarize-app -u [email protected] -p @keychain:MY_SECRET [...]
--output-format {xml | normal} Specifies how the output is formatted. 'xml' displays the output in a structured format; 'normal' displays in
an unstructured format (default).
--verbose Enable logging output.
-h, --help Display this output.
除了可以用账号密码的方式，还可以通过这种方式Creating API Keys for App Store Connect API
注意到新的参数如下：
--apiKey --apiIssuer
未实测，有兴趣可以研究下。大概意思应该跟配置git的秘钥差不多。