fix: normalize macOS signing certificate

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.github/workflows/release.yml

@@ -174,11 +174,22 @@ jobs:
             exit 1
           fi
 
+          SOURCE_CERT_PATH="$RUNNER_TEMP/apple-signing-source.p12"
           CERT_PATH="$RUNNER_TEMP/apple-signing.p12"
+          PEM_PATH="$RUNNER_TEMP/apple-signing.pem"
+          PRECHECK_KEYCHAIN_PATH="$RUNNER_TEMP/apple-signing-preflight.keychain-db"
+          PRECHECK_KEYCHAIN_PASSWORD="$(uuidgen)"
           API_KEY_PATH="$RUNNER_TEMP/AuthKey_${APPLE_API_KEY_ID}.p8"
 
-          CERT_PATH="$CERT_PATH" python3 - <<'PY'
+          cleanup_precheck_keychain() {
+            security delete-keychain "$PRECHECK_KEYCHAIN_PATH" >/dev/null 2>&1 || true
+          }
+
+          trap cleanup_precheck_keychain EXIT
+
+          CERT_PATH="$SOURCE_CERT_PATH" python3 - <<'PY'
           import base64
+          import binascii
           import os
           from pathlib import Path
 
@@ -187,7 +198,11 @@ jobs:
           if not normalized_value:
               raise SystemExit("APPLE_CERT_P12_BASE64 is empty after whitespace normalization")
 
-          decoded = base64.b64decode(normalized_value, validate=True)
+          try:
+              decoded = base64.b64decode(normalized_value, validate=True)
+          except binascii.Error:
+              raise SystemExit("APPLE_CERT_P12_BASE64 is not valid base64")
+
           if not decoded:
               raise SystemExit("Decoded Apple signing certificate is empty")
 
@@ -195,16 +210,50 @@ jobs:
           PY
           printf '%s' "$APPLE_API_KEY_P8" > "$API_KEY_PATH"
 
-          if [[ ! -s "$CERT_PATH" ]]; then
+          if [[ ! -s "$SOURCE_CERT_PATH" ]]; then
             echo "Decoded Apple signing certificate file is empty." >&2
             exit 1
           fi
 
-          if ! openssl pkcs12 -in "$CERT_PATH" -noout -passin env:APPLE_CERT_PASSWORD >/dev/null 2>&1; then
+          if ! openssl pkcs12 -in "$SOURCE_CERT_PATH" -noout -passin env:APPLE_CERT_PASSWORD >/dev/null 2>&1; then
             echo "Decoded Apple signing certificate could not be opened with APPLE_CERT_PASSWORD." >&2
             exit 1
           fi
 
+          if ! openssl pkcs12 -in "$SOURCE_CERT_PATH" -passin env:APPLE_CERT_PASSWORD -nodes -out "$PEM_PATH" >/dev/null 2>&1; then
+            echo "Decoded Apple signing certificate could not be converted to PEM." >&2
+            exit 1
+          fi
+
+          if ! openssl pkcs12 -export -out "$CERT_PATH" -in "$PEM_PATH" -passout env:APPLE_CERT_PASSWORD -macalg sha1 -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES >/dev/null 2>&1; then
+            echo "Apple signing certificate could not be re-exported into a macOS-compatible PKCS#12." >&2
+            exit 1
+          fi
+
+          if [[ ! -s "$CERT_PATH" ]]; then
+            echo "Normalized Apple signing certificate file is empty." >&2
+            exit 1
+          fi
+
+          if ! security create-keychain -p "$PRECHECK_KEYCHAIN_PASSWORD" "$PRECHECK_KEYCHAIN_PATH" >/dev/null 2>&1; then
+            echo "Unable to create the macOS signing precheck keychain." >&2
+            exit 1
+          fi
+
+          if ! security unlock-keychain -p "$PRECHECK_KEYCHAIN_PASSWORD" "$PRECHECK_KEYCHAIN_PATH" >/dev/null 2>&1; then
+            echo "Unable to unlock the macOS signing precheck keychain." >&2
+            exit 1
+          fi
+
+          if ! security import "$CERT_PATH" -k "$PRECHECK_KEYCHAIN_PATH" -P "$APPLE_CERT_PASSWORD" -T /usr/bin/codesign -T /usr/bin/productsign >/dev/null 2>&1; then
+            echo "Normalized Apple signing certificate is still not importable by macOS security." >&2
+            exit 1
+          fi
+
+          rm -f "$SOURCE_CERT_PATH" "$PEM_PATH"
+          cleanup_precheck_keychain
+          trap - EXIT
+
           write_github_env "CSC_LINK" "$CERT_PATH"
           write_github_env "CSC_KEY_PASSWORD" "$APPLE_CERT_PASSWORD"
           write_github_env "APPLE_API_KEY" "$API_KEY_PATH"

ARCHITECTURE.md

@@ -348,7 +348,7 @@ The build pipeline is organized around three layers:
 - publishing the sidecar for the target runtime
 - packaging platform artifacts with electron-builder
 
-electron-builder bundles the packaged Electron app, copies the published sidecar into `resources/sidecar`, produces Windows NSIS installers, macOS DMG + ZIP artifacts, and Linux AppImages, and uploads the release assets plus update metadata to GitHub Releases. Tagged macOS release jobs now materialize the certificate and App Store Connect key from repository secrets into temporary files on the runner, export the standard `electron-builder` signing and notarization environment variables from those files, and package with checked-in hardened-runtime entitlements so native modules still run correctly under code signing. The main process consumes the published metadata through `electron-updater`, which checks GitHub Releases for packaged builds and can stage a restart-based update install.
+electron-builder bundles the packaged Electron app, copies the published sidecar into `resources/sidecar`, produces Windows NSIS installers, macOS DMG + ZIP artifacts, and Linux AppImages, and uploads the release assets plus update metadata to GitHub Releases. Tagged macOS release jobs now materialize the certificate and App Store Connect key from repository secrets into temporary files on the runner, normalize the decoded PKCS#12 into a `security import`-compatible container, preflight that normalized certificate against a temporary keychain, export the standard `electron-builder` signing and notarization environment variables from those files, and package with checked-in hardened-runtime entitlements so native modules still run correctly under code signing. The main process consumes the published metadata through `electron-updater`, which checks GitHub Releases for packaged builds and can stage a restart-based update install.
 
 Current Windows builds are unsigned, so the packaging config disables executable resource editing/signing and skips Windows update signature verification until a code-signing certificate is available. The packaging scripts also clear `release/` before each build so local packaging runs cannot accidentally mix stale artifacts with current ones.
 

README.md

@@ -134,7 +134,7 @@ To publish packaged artifacts and update metadata to GitHub Releases, run:
 
 GitHub Actions runs validation on pushes and pull requests, and tagged releases now use `electron-builder` to publish Windows (NSIS), macOS (DMG + ZIP for updater metadata), and Linux (AppImage) artifacts directly to GitHub Releases. Packaged builds use `electron-updater` against those releases for in-app updates.
 
-Tagged macOS release jobs now prepare signing assets from the GitHub secrets `APPLE_CERT_P12_BASE64`, `APPLE_CERT_PASSWORD`, `APPLE_API_KEY_P8`, `APPLE_API_KEY_ID`, `APPLE_API_ISSUER`, and `APPLE_TEAM_ID`, then export the standard `electron-builder` environment variables (`CSC_LINK`, `CSC_KEY_PASSWORD`, `APPLE_API_KEY`, `APPLE_API_KEY_ID`, `APPLE_API_ISSUER`, `APPLE_TEAM_ID`) before packaging. That same release path signs and notarizes the macOS artifacts as part of publication.
+Tagged macOS release jobs now prepare signing assets from the GitHub secrets `APPLE_CERT_P12_BASE64`, `APPLE_CERT_PASSWORD`, `APPLE_API_KEY_P8`, `APPLE_API_KEY_ID`, `APPLE_API_ISSUER`, and `APPLE_TEAM_ID`, normalize the decoded PKCS#12 into a macOS-compatible container, preflight `security import` against a temporary keychain, and then export the standard `electron-builder` environment variables (`CSC_LINK`, `CSC_KEY_PASSWORD`, `APPLE_API_KEY`, `APPLE_API_KEY_ID`, `APPLE_API_ISSUER`, `APPLE_TEAM_ID`) before packaging. That same release path signs and notarizes the macOS artifacts as part of publication.
 
 Windows builds are currently packaged without Authenticode signing, so Aryx disables `electron-updater`'s Windows signature verification until a signing certificate is configured. macOS auto-update metadata still requires a ZIP artifact alongside the DMG build.