Repository navigation
ci: import Apple's Developer ID intermediate before signing on macOS - #1384
Merged
Merged
Conversation
The first Desktop App CI run on Xcode 27.1 failed in build-macos: "No Developer ID Application identity found", 0 valid identities. Blacksmith's macOS 27 image does not install Apple's Developer ID Certification Authority (G2); a diagnostic run found no Developer ID CA in its System keychain. GitHub's images install it, which is why the Agent's signing passed on GitHub's xcode-27 image, also macOS 27, in the same push. Without the intermediate, the identity's chain does not validate. The signing keychain now imports Apple's G2 intermediate, vendored from www.apple.com/certificateauthority/DeveloperIDG2CA.cer (SHA-256 F16CD3C5...43D2DF3A, the issuer of our Developer ID Application certificate), and joins the user search list, which identity validation and codesign use to resolve the chain, as the Agent's signing script already does. On failure, the identities are listed without -v so the log shows why one is invalid. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
Maple development preview: https://34d619b9.maple-ca8.pages.dev Commit: Uses development API, billing, flags and PCR configuration. Cloudflare Access applies. |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Master's first Desktop App CI on Xcode 27.1, after PR #1266, failed in
build-macos(run 41008479402): "No Developer ID Application identity found in imported Apple certificate", 0 valid identities.Blacksmith's macOS 27 image doesn't install Apple's Developer ID intermediate. A throwaway diagnostic dispatch on that image (run 41013574043) found no Developer ID CA in its System keychain. GitHub's images install it, which is why the Agent's signing passed on GitHub's
xcode-27image, also macOS 27, in the same push. Release builds use the same function, so the next Research release would fail the same way.What
scripts/ci/apple-developer-id-g2.pem. It comes from apple.com (SHA-256F16CD3C5…43D2DF3A) and is the issuer of our Developer ID Application certificate.import_apple_developer_certificateimports it into the signing keychain.-v, so the log shows why an identity is invalid.Validation
plan.py lintand the CI script suite (551 tests) pass.🤖 Generated with Claude Code
Need help on this PR? Tag
@codesmith-botwith what you need.