From 4e8f091ac93d8a271904d1b1d5a3a5ed11cb0e09 Mon Sep 17 00:00:00 2001 From: Alex Kroman Date: Mon, 27 Jul 2026 17:53:54 -0400 Subject: [PATCH] Unlock signing keychain before the notary preflight check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The blurt-notary credentials live in the dedicated blurt-signing keychain, which stays locked at rest by design. The preflight ran the notarytool profile check before unlock_signing_keychain, and since notarytool reads non-interactively it couldn't see the profile in a locked keychain — so it died "profile not found" before ever reaching the unlock step, never prompting to load the keychain. Move the check after the unlock so a genuine "not found" really means the profile was never stored. Co-Authored-By: Claude Opus 4.8 (1M context) --- scripts/release-build.sh | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/scripts/release-build.sh b/scripts/release-build.sh index 80755ca..5cbfdb6 100755 --- a/scripts/release-build.sh +++ b/scripts/release-build.sh @@ -180,15 +180,20 @@ step "Preflight" require_tools --hint='brew install create-dmg if needed' \ xcodegen xcodebuild xcrun hdiutil codesign spctl create-dmg awk shasum -xcrun notarytool history --keychain-profile "$NOTARY_PROFILE" >/dev/null 2>&1 \ - || die "notarytool profile '$NOTARY_PROFILE' not found. Run: xcrun notarytool store-credentials $NOTARY_PROFILE --apple-id --team-id $TEAM_ID --password " - unlock_signing_keychain # Re-lock the dedicated signing keychain no matter how we exit (success, die, or # a mid-build failure). Lives here rather than in a dedicated cleanup because the # only other EXIT trap (the DMG mount, below) is set up much later. trap lock_signing_keychain EXIT +# Check the notary profile only AFTER unlocking the signing keychain: the +# blurt-notary credentials live in that keychain, and notarytool runs +# non-interactively, so against a still-locked keychain it can't read the +# profile item and reports it as missing. Unlock first, then a genuine +# "not found" here really means the profile was never stored. +xcrun notarytool history --keychain-profile "$NOTARY_PROFILE" >/dev/null 2>&1 \ + || die "notarytool profile '$NOTARY_PROFILE' not found. Run: xcrun notarytool store-credentials $NOTARY_PROFILE --apple-id --team-id $TEAM_ID --password " + identity_listed "$IDENTITY" <<<"$(security find-identity -v -p codesigning)" \ || die "Developer ID identity $IDENTITY not in keychain (check: security find-identity -v -p codesigning). Wrong Mac, or the signing key is missing."