This is my notary script for a DMG: https://gist.github.com/lunixbochs/0ceeb23be5c3d5c6748165e61...

   ./notary.sh notarize app.dmg
   ./notary.sh staple app.dmg

I store a password as a keychain entry named AC_PASSWORD. If you're running this in headless CI you should run a notarize command once interactively so you can tell keychain to always allow altool to access the password.