Repository navigation
ci(macos): read the signing identity from the keychain - #11
Closed
tcpreplay-dev wants to merge 1 commit into
Closed
tcpreplay-dev wants to merge 1 commit into
tcpreplay-dev wants to merge 1 commit into
Conversation
tcpreplay-dev
force-pushed
the
ci/macos-signing-identity-and-fork-fallback
branch
from
September 2, 2026 03:01
80041cb to
b75f2e9
Compare
tcpreplay-dev
changed the title
The identity was spelled out as "Developer ID Application: Michael Richard Garcia ($APPLE_TEAM_ID)" in five codesign invocations. That common name comes from whoever owns the certificate, so the string only ever matches one Apple account: a contributor supplying their own valid credentials gets "no identity found", and a renamed organization would break the release path without a line of code changing. The import step already runs find-identity for its log. Its output is now captured and reused. The keychain is created fresh two commands earlier and holds exactly one codesigning identity, so the match is unambiguous, and an empty capture aborts rather than letting a later codesign fail obscurely. APPLE_TEAM_ID is no longer read anywhere: it existed only to interpolate into that hardcoded name. notarytool authenticates with the App Store Connect key and issuer, which are unchanged. The secret can stay set; nothing consumes it. Signing remains mandatory. A build without credentials still fails at certificate import, as before. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
tcpreplay-dev
force-pushed
the
ci/macos-signing-identity-and-fork-fallback
branch
from
September 2, 2026 03:29
b75f2e9 to
6760544
Compare
Owner
Author
|
Closing .. I won't be signing this repo - this is reference info only. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The signing identity was one person's name.
"Developer ID Application: Michael Richard Garcia ($APPLE_TEAM_ID)"appeared in fivecodesigncalls. That common name comes from whoever owns the certificate, so the string only matches one Apple account — anyone supplying their own valid credentials (a fork, a second maintainer, a renamed organization) getsno identity foundeven with every secret set correctly.What changed
The import step already ran
security find-identityfor its log. Its output is now captured intoSIGN_IDENTITYand used by everycodesigncall. The keychain is created fresh two commands earlier and holds exactly one codesigning identity, so the match is unambiguous; an empty capture aborts with a clear message rather than letting a latercodesignfail obscurely.APPLE_TEAM_IDis no longer read anywhere — it existed only to interpolate into that hardcoded name.notarytoolauthenticates with the App Store Connect key and issuer, untouched here. The secret can stay set; nothing consumes it.What did not change
Signing stays mandatory. A build without credentials still fails at certificate import, exactly as before. No unsigned fallback, no conditional signing steps.
Testing
sedextracting the identity was checked against realfind-identityoutput shapes, including an organization name containing a comma and periods🤖 Generated with Claude Code