fix(phase4): set the default keychain for the macOS runner job (#78)

* fix(phase4): set the default keychain for the macOS runner job

notarytool resolves its credential profile through the session DEFAULT
keychain, but a launchd runner job has no default keychain set, so
notarization failed with "No Keychain password item found for profile" even
though code signing (which uses the search list) succeeded. After the hook's
trust validation passes, set the dedicated account's login keychain as the
default and search keychain and unlock it, on macOS only.

The keychain password is read from a machine-local file owned by the runner
account ($HOME/.config/1helm/mac-keychain-password); it is never committed to
this repository or exported into the job environment. No sudo, no elevation.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(phase4): read the root-owned OCI image store with sudo in Linux acceptance

The retained channel-image verification checked
/var/lib/1helm-oci-v1/shared-images/sha256/<digest> without sudo, but
install-oci-runtime.sh creates that store root-owned and mode 0700. The
ordinary runner user cannot traverse it, so the `[[ -d ... && sha256 ... ]]`
assertion always failed after an otherwise successful clean install — the exact
silent failure the new ERR trap pinpointed at this line. The adjacent state
checks already use sudo; this one was the outlier.

Run the directory test and the image digest read under sudo, matching the
store's ownership. No product change; acceptance-script only.

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Joseph Yaksich <gitcommit90@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>

Author: gitcommit90

ops/platform-acceptance/linux.sh

@@ -72,7 +72,8 @@ sudo systemctl is-active --quiet 1helm.service
 curl -fsS http://127.0.0.1:8123/api/setup/status >"$work/clean-health.json"
 [[ "$(readlink -f /opt/1helm/current)" == "/opt/1helm/releases/$VERSION-$OFFLINE_DIGEST" ]]
 RETAINED_IMAGE="/var/lib/1helm-oci-v1/shared-images/sha256/$IMAGE_DIGEST"
-[[ -d "$RETAINED_IMAGE" && "$(find "$RETAINED_IMAGE" -maxdepth 1 -type f -name '*.oci.tar' -exec sha256sum {} \; | awk '{print $1}')" == "$IMAGE_DIGEST" ]]
+sudo test -d "$RETAINED_IMAGE"
+[[ "$(sudo find "$RETAINED_IMAGE" -maxdepth 1 -type f -name '*.oci.tar' -exec sha256sum {} \; | awk '{print $1}')" == "$IMAGE_DIGEST" ]]
 
 # Resolve the newest immutable public Stable release distinct from this
 # candidate version. Candidate versions normally remain unchanged during
@@ -140,7 +141,8 @@ sudo systemctl is-active --quiet 1helm.service
 curl -fsS http://127.0.0.1:8123/api/setup/status >"$work/rollback-health.json"
 STATE_AFTER="$(sudo sha256sum "$MARKER" | awk '{print $1}')"
 [[ "$STATE_BEFORE" == "$STATE_AFTER" ]]
-[[ -d "$RETAINED_IMAGE" && "$(find "$RETAINED_IMAGE" -maxdepth 1 -type f -name '*.oci.tar' -exec sha256sum {} \; | awk '{print $1}')" == "$IMAGE_DIGEST" ]]
+sudo test -d "$RETAINED_IMAGE"
+[[ "$(sudo find "$RETAINED_IMAGE" -maxdepth 1 -type f -name '*.oci.tar' -exec sha256sum {} \; | awk '{print $1}')" == "$IMAGE_DIGEST" ]]
 sudo rm -rf -- "$FAILURE_RELEASE"
 
 export HELM_PREVIOUS_VERSION="$PREVIOUS_VERSION"

ops/platform-acceptance/runner-job-started.sh

@@ -30,3 +30,22 @@ if not (
 ):
     raise SystemExit("Phase 4 runner refused an untrusted repository/ref/SHA/CI event.")
 PY
+
+# macOS only: prepare the dedicated signing account's login keychain for this
+# now-validated, trusted job. Code signing resolves its identity through the
+# keychain search list, but notarytool resolves its credential profile through
+# the session DEFAULT keychain, and a launchd runner job otherwise has no
+# default keychain, so notarization fails with "No Keychain password item
+# found". Set login as the default (and search) keychain and unlock it. The
+# password is read from a machine-local file owned by the runner account; it is
+# never stored in this repository or exported into the job environment.
+if [[ "$(uname)" == "Darwin" ]]; then
+  kc="$HOME/Library/Keychains/login.keychain-db"
+  kc_pw_file="$HOME/.config/1helm/mac-keychain-password"
+  if [[ -f "$kc" && -r "$kc_pw_file" ]]; then
+    security list-keychains -d user -s "$kc" /Library/Keychains/System.keychain >/dev/null 2>&1 || true
+    security default-keychain -d user -s "$kc" >/dev/null 2>&1 || true
+    security set-keychain-settings "$kc" >/dev/null 2>&1 || true
+    security unlock-keychain -p "$(cat "$kc_pw_file")" "$kc" >/dev/null 2>&1 || true
+  fi
+fi