Skip to content

Resolve notary profile deterministically from the signing keychain #90

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
alexkroman merged 1 commit into from
Jul 27, 2026
+8 −3
Merged

Resolve notary profile deterministically from the signing keychain #90

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions scripts/release-build.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,15 +180,20 @@ step "Preflight"
require_tools --hint='brew install create-dmg if needed' \
xcodegen xcodebuild xcrun hdiutil codesign spctl create-dmg awk shasum

xcrun notarytool history --keychain-profile "$NOTARY_PROFILE" >/dev/null 2>&1 \
|| die "notarytool profile '$NOTARY_PROFILE' not found. Run: xcrun notarytool store-credentials $NOTARY_PROFILE --apple-id <you@example.com> --team-id $TEAM_ID --password <app-specific-password>"

unlock_signing_keychain
# Re-lock the dedicated signing keychain no matter how we exit (success, die, or
# a mid-build failure). Lives here rather than in a dedicated cleanup because the
# only other EXIT trap (the DMG mount, below) is set up much later.
trap lock_signing_keychain EXIT

# Check the notary profile only AFTER unlocking the signing keychain: the
# blurt-notary credentials live in that keychain, and notarytool runs
# non-interactively, so against a still-locked keychain it can't read the
# profile item and reports it as missing. Unlock first, then a genuine
# "not found" here really means the profile was never stored.
Comment on lines +189 to +193
xcrun notarytool history --keychain-profile "$NOTARY_PROFILE" >/dev/null 2>&1 \
|| die "notarytool profile '$NOTARY_PROFILE' not found. Run: xcrun notarytool store-credentials $NOTARY_PROFILE --apple-id <you@example.com> --team-id $TEAM_ID --password <app-specific-password>"

identity_listed "$IDENTITY" <<<"$(security find-identity -v -p codesigning)" \
|| die "Developer ID identity $IDENTITY not in keychain (check: security find-identity -v -p codesigning). Wrong Mac, or the signing key is missing."

Expand Down