J124: ship signed and notarized arm64 macOS CLI and capture helper

kayg commented

2026-11-03 05:36:27 +00:00

Owner

Goal

Implement D321 delivery: an arm64 macOS infraternal CLI/agent built with remote,desktop and InfraternalCaptureHelper.app, signed, notarized, stapled and verifiable for owner testing.

Plan

Read D321, D204/D205, D213, the desktop plugin build integration, release packaging, #146 owner steps and #265 macOS-node coordination; confirm the existing signing-keychain scripts and 1Password item names without exposing credentials.
Add a reproducible scripts/ build-sign-notarize-verify entry point using the existing dedicated keychain, hardened runtime and justified minimal entitlements.
Build on the assigned machines, serialize Mac VM use with /tmp/mac-bench.lock and a bounded wait plus EXIT trap, produce distributable artifacts and SHA256SUMS, then verify signatures, Gatekeeper acceptance and staple.
Publish a pre-release asset, update #146 with installation/test steps and artifact checksums, and coordinate relevant Mac-node status on #265.
Run scripts/verify fast on an available build VM and report exact gate output and artifact evidence.

Estimate

6-8 hours of implementation and release work, plus Apple notarization service time. Re-estimate on the issue if findings materially change the scope.

Constraints

No secrets in source, argv, comments or logs. Reuse the existing dedicated signing keychain; never use the login keychain or touch TCC. No numbered decision changes. No deployment.

## Goal Implement D321 delivery: an arm64 macOS infraternal CLI/agent built with remote,desktop and InfraternalCaptureHelper.app, signed, notarized, stapled and verifiable for owner testing. ## Plan 1. Read D321, D204/D205, D213, the desktop plugin build integration, release packaging, #146 owner steps and #265 macOS-node coordination; confirm the existing signing-keychain scripts and 1Password item names without exposing credentials. 2. Add a reproducible scripts/ build-sign-notarize-verify entry point using the existing dedicated keychain, hardened runtime and justified minimal entitlements. 3. Build on the assigned machines, serialize Mac VM use with /tmp/mac-bench.lock and a bounded wait plus EXIT trap, produce distributable artifacts and SHA256SUMS, then verify signatures, Gatekeeper acceptance and staple. 4. Publish a pre-release asset, update #146 with installation/test steps and artifact checksums, and coordinate relevant Mac-node status on #265. 5. Run scripts/verify fast on an available build VM and report exact gate output and artifact evidence. ## Estimate 6-8 hours of implementation and release work, plus Apple notarization service time. Re-estimate on the issue if findings materially change the scope. ## Constraints No secrets in source, argv, comments or logs. Reuse the existing dedicated signing keychain; never use the login keychain or touch TCC. No numbered decision changes. No deployment.

kayg commented

2026-11-03 05:37:19 +00:00

Author

Owner

Started J124 on branch j124-signed-macos, based on origin/dev at 7add126405. Planning and estimate are in the issue body; I am verifying the named decisions, packaging path, and Mac VM access before implementation.

Started J124 on branch j124-signed-macos, based on origin/dev at 7add126405a9205bb817a154af11fad2c438cd45. Planning and estimate are in the issue body; I am verifying the named decisions, packaging path, and Mac VM access before implementation.

kayg commented

2026-11-03 05:39:10 +00:00

Author

Owner

Finding: origin/dev contains D321 requiring signed and notarized arm64 macOS releases, with the signing material used only on the Mac build machine (DECISIONS.md:3614-3618). The existing scripts/desktop-helper-bundle compiles the crate-produced Swift companion into InfraternalCaptureHelper.app and signs it against an explicit keychain with hardened runtime and no entitlements; scripts/package-release handles Linux artifacts only. Mac SSH now succeeds using the existing trusted host entry, and /tmp/mac-bench.lock was free on the initial read-only check.

kayg commented

2026-11-03 05:41:01 +00:00

Author

Owner

Signing-access finding: the existing unlock.sh passes the keychain password through , which would expose it in argv. I have not run it. I will reuse the existing dedicated keychain through a password-file-to-Security-API path instead. The 1Password CLI is missing on the Mac VM; the token file is present with mode 0600, so I will install op as requested and inspect item names only.

kayg commented

2026-11-03 05:42:26 +00:00

Author

Owner

The existing signing setup was inspected under the Mac lock. Its unlock.sh invokes security unlock-keychain with the keychain password as the -p argument, so I will leave it unused and unlock only the dedicated keychain through a small Security.framework call that reads the 0600 password file. Homebrew installed op 2.41.1; completion generation hit permission errors, but the binary installation completed. I am checking its service-account access and item titles now.

kayg commented

2026-11-03 05:45:58 +00:00

Author

Owner

1Password finding: the service account lists three accessible items. Apple Certificates contains the Developer ID Application.p12 attachment. Its only concealed field is named password, is not in Apple app-specific-password format, and its notes contain no notarization reference; there is no .p8 attachment. No separate notarization item appears among active or archived accessible items. I am checking the dedicated keychain for an existing notarytool profile before treating credentials as a blocker.

kayg commented

2026-11-03 05:58:03 +00:00

Author

Owner

Runtime packaging finding: crates/infraternal-agent/src/plugins.rs:107-117 resolves infraternal-desktop-helper from beside the main executable. J124 now packages and signs that required Rust helper alongside the CLI and InfraternalCaptureHelper.app, and checks all three in the notarized archive.

kayg commented

2026-11-03 06:00:26 +00:00

Author

Owner

Mac keychain verification: a password-file-to-Security.framework call unlocked only the existing infraternal-signing keychain. Its identity.sha1 matches exactly one valid code-signing identity; no matching identity or certificate detail was printed. Metadata inspection found no notary-related item in that keychain. The 1Password service account has one accessible vault, with no active or archived notarization item.

kayg commented

2026-11-03 06:01:07 +00:00

Author

Owner

Blocked on final notarization and release: the Mac VM service account has no App Store Connect API key or Apple ID app-specific-password item, and the dedicated signing keychain has no notarytool profile. The release script preflights that profile before building. I requested an accessible API-key item title; code review and scripts/verify fast continue independently.

kayg referenced this issue

2026-11-03 10:09:29 +00:00

J124: signed and notarized arm64 macOS CLI and capture helper #321

kayg commented

2026-11-03 10:09:29 +00:00

Author

Owner

J124c takeover: this issue is the earlier copy of the same job; progress continues on #321.

kayg referenced this issue

2026-11-04 17:01:56 +00:00

J210: overnight housekeeping, 2026-11-04 #350

kayg referenced this issue