ci: import the signing certificate as a named .p12

Merged
LA
21d ago
+13-8

Summary

Fix forward for #20996. The first nightly on main after it (https://github.com/manaflow-ai/cmux/actions/runs/38723131700) failed in Import signing cert for all three variants:

security: SecKeychainItemImport: Unknown format in import.

scripts/ci/signing-keychain.sh create decoded the certificate into certificate.XXXXXX (no extension). security import infers the format from the file name; the old inline step used /tmp/cert.p12. The file is now certificate.p12 inside a private mktemp -d directory, the import passes -f pkcs12, and the decode uses printf '%s\n' like the old echo. The directory is removed right after the import and again by delete.

The run published nothing (the failure is before any signature).

Testing

  • tests/test_notarize_nightly_dmg.sh now requires a .p12 file and -f pkcs12 in the security import call. First commit: fails. Second commit: passes (Linux VM, fake security).
  • tests/test_ci_self_hosted_guard.sh keychain checks pass.
  • Not verified before merge: a real import. The next nightly from main proves it; this change touches only the import line of the tool.

Changelog

none

Summary by cubic

Fixes the nightly CI failure in Import signing cert where security import couldn't infer the format of the decoded certificate because it lacked a .p12 extension.

  • The certificate is now written as certificate.p12 in a private mktemp -d directory, and the import passes -f pkcs12.
  • The fake-security test now requires a .p12 file name and the explicit format flag.

Summary by CodeRabbit

  • Maintenance
    • Improved signing certificate import and temporary-file cleanup reliability.
    • Updated automated checks to verify the certificate format and keychain lock timeout.