kayg/hermternal-apple
Watch
1
0
Fork
You've already forked hermternal-apple
 0
Code Issues 44 Pull requests Projects Releases 4 Packages Wiki Activity Actions

Outstanding: Unblock notarized release credentials and key partition ACL #25

New issue
Open
opened 2026-08-22 04:18:02 +00:00 by kayg · 0 comments
kayg commented 2026-08-22 04:18:02 +00:00
Owner
Copy link

Current state

Outstanding blocker. The notarized release tooling and signing wizard are delivered, but a remote SSH release remains blocked when the signing key ACL needs security set-key-partition-list, and App Store Connect notary credentials still need to be provisioned. The release scripts diagnose the private-key/keychain failure; they do not remove the human credential prerequisite.

Acceptance criteria

  • In the GUI signing session, the Developer ID private-key partition list is configured with security set-key-partition-list so the release identity is usable by the intended signing process.
  • App Store Connect notary credentials/API key are provisioned and stored where the release wizard expects them.
  • A real release run from the supported environment can sign, submit, staple, and pass Gatekeeper verification without the known ACL or missing-credential block.
  • Document the required human-only setup and distinguish this unblock from the delivered release scripts in d978b31 and 9c08672.
## Current state Outstanding blocker. The notarized release tooling and signing wizard are delivered, but a remote SSH release remains blocked when the signing key ACL needs `security set-key-partition-list`, and App Store Connect notary credentials still need to be provisioned. The release scripts diagnose the private-key/keychain failure; they do not remove the human credential prerequisite. ## Acceptance criteria - In the GUI signing session, the Developer ID private-key partition list is configured with `security set-key-partition-list` so the release identity is usable by the intended signing process. - App Store Connect notary credentials/API key are provisioned and stored where the release wizard expects them. - A real release run from the supported environment can sign, submit, staple, and pass Gatekeeper verification without the known ACL or missing-credential block. - Document the required human-only setup and distinguish this unblock from the delivered release scripts in `d978b31` and `9c08672`.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
dev
feat/sidebar-selection-archive-purge
v0.0.4
v0.0.3
v0.0.2
v0.0.1
Labels
Clear labels   
delivered
Shipped and recorded in project history

  
outstanding
Not yet delivered or blocked

No labels
delivered
outstanding
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/hermternal-apple#25
No description provided.