ci(mac): make the signed menubar and desktop workflows import the Developer ID cert (#1731)

Keychain Access exports the Developer ID p12 with RC2-40 encryption and a 1-iteration sha1 MAC, which the runner's security import rejects as a wrong password. Both workflows rewrap it with openssl@3 -legacy (3DES, 2048 iterations) under a masked one-off password; the desktop workflow now signs from its own keychain because electron-builder's temporary keychain failed to unlock. Verified: both workflows green on dispatch, signed, notarized and stapled.

.github/workflows/build-desktop-mac.yml

@@ -48,19 +48,44 @@ jobs:
             if [ -z "${!name}" ]; then echo "::error::secret $name is not set"; exit 1; fi
           done
           echo "$APPSTORE_API_KEY_P8_BASE64" | base64 --decode > "$RUNNER_TEMP/notary.p8"
+          # Keychain Access exports a legacy p12 (RC2-40, sha1 MAC, 1 iteration) that the
+          # runner's `security import` rejects as a wrong password; rewrap it in a form it reads.
+          # electron-builder's own temporary keychain fails to unlock on this runner, so import
+          # into our keychain (as release-menubar.yml does) and let it find the identity there.
+          umask 077
+          openssl3="$(brew --prefix openssl@3)/bin/openssl"
+          cert="$RUNNER_TEMP/signing.p12"
+          keychain="$RUNNER_TEMP/codeburn-signing.keychain-db"
+          base64 --decode <<< "$MACOS_CERT_P12_BASE64" > "$cert.in"
+          "$openssl3" pkcs12 -legacy -in "$cert.in" -passin env:MACOS_CERT_PASSWORD -nodes -out "$cert.pem"
+          export cert_password="$(openssl rand -hex 24)"
+          echo "::add-mask::$cert_password"
+          "$openssl3" pkcs12 -export -legacy -in "$cert.pem" -out "$cert" -passout env:cert_password \
+            -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES -macalg sha1 -iter 2048
+          rm -f "$cert.in" "$cert.pem"
+          keychain_password="$(openssl rand -hex 24)"
+          echo "::add-mask::$keychain_password"
+          security create-keychain -p "$keychain_password" "$keychain"
+          security set-keychain-settings -lut 21600 "$keychain"
+          security unlock-keychain -p "$keychain_password" "$keychain"
+          security import "$cert" -k "$keychain" -P "$cert_password" -f pkcs12 -T /usr/bin/codesign -T /usr/bin/security
+          rm -f "$cert"
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$keychain_password" "$keychain" > /dev/null
+          # shellcheck disable=SC2046
+          security list-keychains -d user -s "$keychain" $(security list-keychains -d user | tr -d '"')
+          security find-identity -v -p codesigning "$keychain" | grep -q 'Developer ID Application: .*(XRVP7P7F9M)' \
+            || { echo "::error::No Developer ID Application identity for team XRVP7P7F9M in MACOS_CERT_P12_BASE64."; exit 1; }
 
       - name: Build, sign and notarize
         working-directory: app
         env:
-          CSC_LINK: ${{ secrets.MACOS_CERT_P12_BASE64 }}
-          CSC_KEY_PASSWORD: ${{ secrets.MACOS_CERT_PASSWORD }}
           APPLE_API_KEY: ${{ runner.temp }}/notary.p8
           APPLE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}
           APPLE_API_ISSUER: ${{ secrets.APPSTORE_API_ISSUER_ID }}
         run: |
           npm run stage-cli
           npm run build
-          npx electron-builder --mac --publish never \
+          CSC_IDENTITY_AUTO_DISCOVERY=true npx electron-builder --mac --publish never \
             -c.mac.identity="Resham Joshi (XRVP7P7F9M)" \
             -c.mac.hardenedRuntime=true \
             -c.dmg.sign=true
@@ -89,7 +114,9 @@ jobs:
 
       - name: Remove notary key
         if: always()
-        run: rm -f "$RUNNER_TEMP/notary.p8"
+        run: |
+          rm -f "$RUNNER_TEMP/notary.p8"
+          security delete-keychain "$RUNNER_TEMP/codeburn-signing.keychain-db" 2>/dev/null || true
 
       - name: Upload artifact
         uses: actions/upload-artifact@v6

.github/workflows/release-menubar.yml

@@ -61,11 +61,21 @@ jobs:
 
           keychain="$RUNNER_TEMP/codeburn-signing.keychain-db"
           cert="$RUNNER_TEMP/codeburn-signing.p12"
-          base64 --decode <<< "$MACOS_CERT_P12_BASE64" > "$cert"
+          # Keychain Access exports a legacy p12 (RC2-40, sha1 MAC, 1 iteration) that the
+          # runner's `security import` rejects as a wrong password; rewrap it in a form it reads.
+          umask 077
+          openssl3="$(brew --prefix openssl@3)/bin/openssl"
+          base64 --decode <<< "$MACOS_CERT_P12_BASE64" > "$cert.in"
+          "$openssl3" pkcs12 -legacy -in "$cert.in" -passin env:MACOS_CERT_PASSWORD -nodes -out "$cert.pem"
+          export cert_password="$(openssl rand -hex 24)"
+          echo "::add-mask::$cert_password"
+          "$openssl3" pkcs12 -export -legacy -in "$cert.pem" -out "$cert" -passout env:cert_password \
+            -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES -macalg sha1 -iter 2048
+          rm -f "$cert.in" "$cert.pem"
           security create-keychain -p "$MACOS_KEYCHAIN_PASSWORD" "$keychain"
           security set-keychain-settings -lut 21600 "$keychain"
           security unlock-keychain -p "$MACOS_KEYCHAIN_PASSWORD" "$keychain"
-          security import "$cert" -k "$keychain" -P "$MACOS_CERT_PASSWORD" -f pkcs12 -T /usr/bin/codesign -T /usr/bin/security
+          security import "$cert" -k "$keychain" -P "$cert_password" -f pkcs12 -T /usr/bin/codesign -T /usr/bin/security
           rm -f "$cert"
           security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_KEYCHAIN_PASSWORD" "$keychain" > /dev/null
           # shellcheck disable=SC2046