test: keep local macOS proof certificate-free

Author: ebursztein

scripts/build-test-macos-package.sh

@@ -1,5 +1,9 @@
 #!/bin/bash
-# Build and inspect the exact macOS candidate package consumed by the Tart gate.
+# Build the unsigned local macOS candidate package consumed by the Tart gate.
+#
+# The installer postinstall ad-hoc signs the installed Mach-O payload with the
+# required entitlements. Developer ID signing, notarization, and stapling belong
+# only to the tagged publication workflow.
 set -euo pipefail
 
 ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
@@ -42,31 +46,8 @@ cargo build --release \
     -p capsem-gateway \
     -p capsem-tray \
     -p capsem-admin
-if [ -n "${APPLE_SIGNING_IDENTITY:-}" ]; then
-    for binary in \
-        capsem \
-        capsem-service \
-        capsem-process \
-        capsem-tui \
-        capsem-mcp \
-        capsem-mcp-aggregator \
-        capsem-mcp-builtin \
-        capsem-gateway \
-        capsem-tray \
-        capsem-admin
-    do
-        codesign \
-            --sign "$APPLE_SIGNING_IDENTITY" \
-            --options runtime \
-            --timestamp \
-            --entitlements "$ROOT/entitlements.plist" \
-            --force \
-            "$ROOT/target/release/$binary"
-    done
-fi
 bash scripts/build-pkg.sh \
     --manifest "$MANIFEST_URL" \
-    --signing-identity "${CAPSEM_INSTALLER_SIGNING_IDENTITY:?missing installer identity}" \
     "$ROOT/target/release/bundle/macos/Capsem.app" \
     "$ROOT/target/release" \
     "$ROOT/assets" \
@@ -75,8 +56,6 @@ bash scripts/build-pkg.sh \
 
 PKG="$ROOT/packages/Capsem-$VERSION.pkg"
 test -s "$PKG"
-/usr/sbin/pkgutil --check-signature "$PKG" | grep -F "Developer ID Installer"
-codesign --verify --deep --strict --verbose=2 "$ROOT/target/release/bundle/macos/Capsem.app"
 SBOM="$ROOT/target/macos-package-sbom.spdx.json"
 python3 scripts/generate-host-binary-sbom.py --output "$SBOM" "$PKG"
 python3 - "$SBOM" <<'PY'

scripts/macos_release_glowup.py

@@ -18,10 +18,6 @@
     from release_glowup import ArtifactIdentity, assert_manifest_artifact
 except ModuleNotFoundError:
     from scripts.release_glowup import ArtifactIdentity, assert_manifest_artifact
-try:
-    from macos_signing import ephemeral_signing_environment
-except ModuleNotFoundError:
-    from scripts.macos_signing import ephemeral_signing_environment
 
 
 ROOT = Path(__file__).resolve().parent.parent
@@ -215,18 +211,16 @@ def main() -> int:
         env=frontend_env,
     )
     run(["bash", "scripts/materialize-config.sh"])
-    with ephemeral_signing_environment(ROOT / "private" / "apple-certificate") as signing_env:
-        run(
-            [
-                "bash",
-                "scripts/build-test-macos-package.sh",
-                "--version",
-                args.version,
-                "--manifest-url",
-                manifest_url,
-            ],
-            env=signing_env,
-        )
+    run(
+        [
+            "bash",
+            "scripts/build-test-macos-package.sh",
+            "--version",
+            args.version,
+            "--manifest-url",
+            manifest_url,
+        ]
+    )
     package = ROOT / "packages" / f"Capsem-{args.version}.pkg"
     sbom = ROOT / "target" / "macos-package-sbom.spdx.json"
     manifest_path, asset_share, profile_share = prepare_candidate_manifest(

scripts/macos_signing.py

@@ -76,7 +76,7 @@ for binary in "${BINARIES[@]}"; do
     "$path" --version | grep -F "$VERSION"
     codesign --verify --strict "$path"
     codesign -d --verbose=4 "$path" 2>&1 \
-        | grep -F "Authority=Developer ID Application:"
+        | grep -F "Signature=adhoc"
 done
 
 verify_channel() {
@@ -121,6 +121,7 @@ report = {
         "architecture": sys.argv[6],
         "clean_precondition": True,
         "app_bundle": True,
+        "installed_binary_signature": "ad-hoc",
     },
 }
 Path(sys.argv[1]).write_text(json.dumps(report, indent=2, sort_keys=True) + "\n")

scripts/macos_tart_guest.sh

@@ -158,6 +158,13 @@ same package on the physical Mac and boots a real Capsem guest from its exact
 binary/profile payload to a shell marker. Both focused scripts remain
 debugging tools; `just test` is the release gate that owns them.
 
+The local `.pkg` is intentionally unsigned. Its installer postinstall applies
+ad-hoc signatures and the required entitlements to executable payloads, which
+the Tart guest verifies before service and gateway checks. Local installation
+tests must not import or unlock an Apple Developer certificate or mutate the
+user's keychain. Developer ID signing, notarization, and stapling are
+publication-workflow responsibilities.
+
 ## Key files
 
 ```

skills/dev-installation/SKILL.md

@@ -60,9 +60,14 @@ branching, reporting, cleanup, or resource ownership.
 - Linux parity and both `.deb` architectures;
 - host package SBOM;
 - Linux systemd install plus channel glow-up;
-- on macOS, signed exact `.pkg` install in Tart and physical Apple VZ boot.
+- on macOS, an unsigned local `.pkg` install in Tart, ad-hoc signature checks
+  on the installed executable payload, and physical Apple VZ boot from that
+  exact package.
 
 Do not fork or approximate this graph in another public recipe.
+Local qualification must not import, unlock, or use Apple Developer
+certificates. Developer ID package signing, notarization, and stapling belong
+only to the tagged publication workflow.
 
 ## Public-surface gate
 

skills/dev-just/SKILL.md

@@ -65,6 +65,11 @@ production assembler, installs that exact file in a disposable headless Tart
 guest, verifies the receipt, app bundle, complete binary cohort, service and
 gateway health, then extracts the same package on the physical Mac and boots a
 real Capsem guest VM from its exact binary/profile payload to a shell marker.
+The local package is unsigned; its postinstall ad-hoc signs the installed
+Mach-O payload with the required entitlements. Local qualification must not
+load Developer ID material or create a signing keychain. The tagged publication
+workflow alone signs, notarizes, staples, and installs the final publishable
+package.
 Tart macOS guests do not support nested virtualization, so these are two
 explicit halves of one script rather than a claimed nested proof. `just smoke`
 deliberately excludes Tart; pulling a 25 GB

skills/dev-testing/SKILL.md

@@ -219,6 +219,13 @@ GitHub-hosted macOS job separately builds, signs, notarizes, staples, installs,
 and verifies the exact publishable `.pkg`, but hosted runners cannot repeat the
 VZ guest path because nested virtualization is unavailable.
 
+The local package is intentionally unsigned. Its postinstall ad-hoc signs the
+installed Mach-O payload with the required entitlements, so local qualification
+needs no release certificate, private key, or temporary keychain. Developer ID
+signing, notarization, stapling, Gatekeeper verification, and installation of
+that final signed artifact remain owned exclusively by the tagged publication
+workflow.
+
 The accepted release risk is explicit: the published `.pkg` is not installed
 again on a physical Mac for a second VZ guest-shell run after publication. Do
 not claim that missing post-publication combination as evidence; record the