Sign with an unambiguous identity and give the release preflight a host #287

Merged

stephen merged 1 commit from fix/release-tooling into main

2026-10-12 04:20:25 +00:00

stephen commented

2026-10-11 23:42:35 +00:00

Owner

Two things that got in the way of cutting v0.6.0, neither in the shipped binary.

make install failed at the signing step with Developer ID Application: Raster & State LLC (62Y3FRM8PD): ambiguous. The login keychain holds more than one valid certificate with that name, and codesign refuses a name that matches several. The Makefile now resolves SIGN_ID to the SHA-1 of the first valid match and signs with that, falling back to the value as given when nothing matches (so a hash or another identity still works). Every certificate of the team satisfies the same designated requirement, so the keychain's "Always Allow" survives whichever one is picked. Checked by installing to a scratch prefix: Identifier=fj-a88ab591fd97b299, TeamIdentifier=62Y3FRM8PD.

scripts/release-preflight.sh ran fj api without a host. With any other host current, every read failed quietly and the script reported "no online runner" for both labels and unreadable secrets, which reads like an infrastructure problem. It now exports FJ_HOST, defaulting to rasterhub.com (FJ_HOST or FJ_RELEASE_HOST override), and a runner listing that cannot be fetched is reported as that.

No Rust changes.

Two things that got in the way of cutting v0.6.0, neither in the shipped binary. `make install` failed at the signing step with `Developer ID Application: Raster & State LLC (62Y3FRM8PD): ambiguous`. The login keychain holds more than one valid certificate with that name, and codesign refuses a name that matches several. The Makefile now resolves `SIGN_ID` to the SHA-1 of the first valid match and signs with that, falling back to the value as given when nothing matches (so a hash or another identity still works). Every certificate of the team satisfies the same designated requirement, so the keychain's "Always Allow" survives whichever one is picked. Checked by installing to a scratch prefix: `Identifier=fj-a88ab591fd97b299`, `TeamIdentifier=62Y3FRM8PD`. `scripts/release-preflight.sh` ran `fj api` without a host. With any other host current, every read failed quietly and the script reported "no online runner" for both labels and unreadable secrets, which reads like an infrastructure problem. It now exports `FJ_HOST`, defaulting to `rasterhub.com` (`FJ_HOST` or `FJ_RELEASE_HOST` override), and a runner listing that cannot be fetched is reported as that. No Rust changes.

stephen added 1 commit

2026-10-11 23:42:35 +00:00

Sign with an unambiguous identity and give the release preflight a host

ci / check (pull_request) Successful in 12m29s

Details

ci / coverage (pull_request) Successful in 3m8s

Details

ci / live-e2e (pull_request) Successful in 3m39s

Details

273e782300

`make install` failed at codesign once a second Developer ID certificate
with the same name was in the keychain: codesign refuses an ambiguous
name. The Makefile now resolves SIGN_ID to the SHA-1 of the first valid
match and signs with that, falling back to the value as given.

`scripts/release-preflight.sh` called `fj api` with no host, so with a
different current host every read failed and was reported as missing
runners and unreadable secrets. It now defaults FJ_HOST to rasterhub.com
(FJ_HOST and FJ_RELEASE_HOST override), and a runner listing that cannot
be read says so, not that no runner is online.

stephen merged commit 41f34220c4 into main

2026-10-12 04:20:25 +00:00

stephen deleted branch fix/release-tooling

2026-10-12 04:20:25 +00:00

stephen referenced this pull request from a commit

2026-10-12 04:20:27 +00:00

Sign with an unambiguous identity and give the release preflight a host (#287)