[paulsenon-r]

Problem

The first signed release failed in run 43170295251 after certificate import and fingerprint verification succeeded. codesign could not resolve the private key from the temporary keychain.

Change

Register the temporary signing keychain in the user search list, preserving existing entries. On this Mac, --keychain alone did not make the identity available to codesign.

Before exporting the release identity, require its SHA-1 in the valid code-signing identities and sign/verify a temporary binary. Failed probes stop the job before the build; the probe and PKCS#12 are removed on exit.

The current PKCS#12 encoding and secrets remain usable. Certificate pinning, the runner-only trust step, the Electron signer, and release triggers are unchanged.

Scope and approval

Follow-up to #17 and #31, limited to the signed-release key lookup failure and early detection. Includes five isolated regression cases in PR checks and the corresponding reviewed network-baseline fingerprints.

Verification

• Native macOS reproduction with a throwaway certificate generated outside the repo: the existing 3DES PKCS#12 imported as one identity, with SHA-1 matching find-identity.
• Before: with the keychain outside the search list, signing a copied binary and non-code resource failed with no identity found.
• After: adding only that keychain to the search list let the same untrusted identity sign both files. Removing it reproduced the lookup failure. The original search list was restored.
• Trust was not needed for that comparison. A local trust-setting attempt prompted and was canceled; a read-only export confirmed no entry for the throwaway certificate. All throwaway keychains and private material were removed.
• OpenSSL default modern PKCS#12 failed macOS import; both the existing explicit 3DES encoding and -legacy imported successfully. No secret regeneration required.
• Five importer regressions pass; four fail against the original importer. System commands, including sudo, are faked in these tests.
• Pass: shell syntax, ShellCheck, targeted lint/format, scripts typecheck, workflow-scan.ts origin/main, policy-verify.ts, and egress-scan.ts.
• The pre-commit hook passed format/lint but failed repository-wide Knip on three unchanged files: apps/mobile/scripts/upload-sourcemaps.mts, apps/web/scripts/verify-built-boot.ts, and scripts/safe/sign-macos.cjs. Used the authorized VP_GIT_HOOKS=0 bypass for the commit.
• The installed osx-sign walker selects binary resources including .pak; direct signing of a non-code resource succeeded. No resource-skipping change is needed for this failure.

The full Electron build and the runner's system-trust step were not rerun locally. No workflow dispatch, merge, secrets, or environment changes.

Implementation ran through the Codex harness with GPT-6.1 Sol.

🤖 Generated with Claude Code