Repository navigation
Sign released CLI with exact helper caller identity - #559
Merged
Merged
Conversation
This was referenced Oct 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
LANE_1 / PR #75 lineage
Fix the native 0.3.7 qualification finding without widening the privileged helper's client admission policy. The live helper runs under root with the exact registered 0.3.7 parent, but its first released CLI status request fails with macOS XPC signature status
-67050. The helper requires the sealed app bundle identifier; the separately signed CLI currently defaults to the short executable identifierforge-platform-installer. A directcodesign --verify -Rof the helper's exact requirement passes for the released GUI and fails for the released CLI.Both offline and protected local release signers now sign the CLI with the validated exact bundle identifier. They verify GUI and CLI against the same Developer ID Application chain, Team and exact identifier required by the helper before notarization and again on the final extracted archive. Helper signing and listener admission stay unchanged.
Evidence
5f54313b7b53522b05cb6a129a36ebc2043a076ash scripts/validate.sh: PASSswift test --enable-code-coverage: 1,255 core + 27 CLI tests, zero failurescodesign --identifierchanges the CLI identifier exactly; no Developer ID key or credential was exportedThe existing public 0.3.7 release remains immutable and still fails the native CLI XPC request. A new canonical installer version, protected release, signing/notarization/public byte readback and live helper transition are required after this PR merges. No product/credential/clean-install PASS is claimed. Frozen producer pins remain Forge 2.7.39 and EP 2.3.106. No LANE_2 source work, Mission-3, CENTRAL reset or T0.