From 55cb86f9ea84fa70ae187d1410ac81e26c1779c2 Mon Sep 17 00:00:00 2001
From: Nicolas Schweitzer <nicolas.schweitzer@datadoghq.com>
Date: Tue, 1 Sep 2026 11:41:50 +0200
Subject: [PATCH] feat(apple): Use new p12 files for apple authent

---
 .../actions/build-macos-package/action.yml    | 44 ++++++++++---------
 .github/workflows/build.yml                   |  8 ++--
 2 files changed, 28 insertions(+), 24 deletions(-)

diff --git a/.github/actions/build-macos-package/action.yml b/.github/actions/build-macos-package/action.yml
index a70b4671..f075d38a 100644
--- a/.github/actions/build-macos-package/action.yml
+++ b/.github/actions/build-macos-package/action.yml
@@ -22,17 +22,17 @@ inputs:
     description: Whether to sign and notarize the binaries
     default: "true"
     required: false
-  apple-application-certificate:
-    description: Apple Developer ID Application Certificate (PEM)
+  apple-application-p12:
+    description: Apple Developer ID Application Certificate + Private Key (base64-encoded P12)
     required: false
-  apple-application-private-key:
-    description: Apple Developer ID Application Private Key (PEM)
+  apple-application-p12-password:
+    description: Password for the Apple Developer ID Application P12
     required: false
-  apple-installer-certificate:
-    description: Apple Developer ID Installer Certificate (PEM)
+  apple-installer-p12:
+    description: Apple Developer ID Installer Certificate + Private Key (base64-encoded P12)
     required: false
-  apple-installer-private-key:
-    description: Apple Developer ID Installer Private Key (PEM)
+  apple-installer-p12-password:
+    description: Password for the Apple Developer ID Installer P12
     required: false
   apple-api-key:
     description: Apple App Store Connect API Key (JSON)
@@ -85,31 +85,33 @@ runs:
     # Secrets are only materialized inside the protected environment. This step
     # is skipped on the unsigned path, so secrets.* expressions in the calling
     # workflow never expand into this runner.
+    #
+    # Only the P12 files (which are already encrypted at rest by their password)
+    # are written to disk. The P12 passwords are kept in the environment for the
+    # signing/notarization steps and are never written to a file.
     - name: Write credentials
       if: inputs.should-sign == 'true'
       shell: bash
       env:
         APPLE_APP_STORE_CONNECT_API_DATA: ${{ inputs.apple-api-key }}
-        APPLE_DEVELOPER_ID_APPLICATION_CERTIFICATE: ${{ inputs.apple-application-certificate }}
-        APPLE_DEVELOPER_ID_APPLICATION_PRIVATE_KEY: ${{ inputs.apple-application-private-key }}
-        APPLE_DEVELOPER_ID_INSTALLER_CERTIFICATE: ${{ inputs.apple-installer-certificate }}
-        APPLE_DEVELOPER_ID_INSTALLER_PRIVATE_KEY: ${{ inputs.apple-installer-private-key }}
+        APPLE_DEVELOPER_ID_APPLICATION_P12: ${{ inputs.apple-application-p12 }}
+        APPLE_DEVELOPER_ID_INSTALLER_P12: ${{ inputs.apple-installer-p12 }}
       run: |-
         echo "$APPLE_APP_STORE_CONNECT_API_DATA" > /tmp/app-store-connect.json
-        echo "$APPLE_DEVELOPER_ID_APPLICATION_CERTIFICATE" > /tmp/certificate-application.pem
-        echo "$APPLE_DEVELOPER_ID_APPLICATION_PRIVATE_KEY" > /tmp/private-key-application.pem
-        echo "$APPLE_DEVELOPER_ID_INSTALLER_CERTIFICATE" > /tmp/certificate-installer.pem
-        echo "$APPLE_DEVELOPER_ID_INSTALLER_PRIVATE_KEY" > /tmp/private-key-installer.pem
+        echo "$APPLE_DEVELOPER_ID_APPLICATION_P12" | base64 -d > /tmp/certificate-application.p12
+        echo "$APPLE_DEVELOPER_ID_INSTALLER_P12" | base64 -d > /tmp/certificate-installer.p12
 
     # https://developer.apple.com/documentation/security/hardened_runtime
     - name: Sign binaries
       if: inputs.should-sign == 'true'
       shell: bash
+      env:
+        RCODESIGN_P12_PASSWORD: ${{ inputs.apple-application-p12-password }}
       run: |-
         for f in bin/*; do
           rcodesign sign -vv \
-          --pem-source /tmp/certificate-application.pem \
-          --pem-source /tmp/private-key-application.pem \
+          --p12-file /tmp/certificate-application.p12 \
+          --p12-password "$RCODESIGN_P12_PASSWORD" \
           --code-signature-flags runtime \
           "$f"
         done
@@ -193,10 +195,12 @@ runs:
     - name: Sign PKG
       if: inputs.should-sign == 'true'
       shell: bash
+      env:
+        RCODESIGN_P12_PASSWORD: ${{ inputs.apple-installer-p12-password }}
       run: >-
         rcodesign sign -vv
-        --pem-source /tmp/certificate-installer.pem
-        --pem-source /tmp/private-key-installer.pem
+        --p12-file /tmp/certificate-installer.p12
+        --p12-password "$RCODESIGN_P12_PASSWORD"
         "staged/${{ steps.pkg.outputs.path }}"
         "signed/${{ steps.pkg.outputs.path }}"
 
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 35065809..0f6a40cc 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -334,10 +334,10 @@ jobs:
         app-name: ${{ env.APP_NAME }}
         python-version: ${{ env.PYTHON_VERSION }}
         pyoxidizer-version: ${{ env.PYOXIDIZER_VERSION }}
-        apple-application-certificate: ${{ secrets.APPLE_DEVELOPER_ID_APPLICATION_CERTIFICATE }}
-        apple-application-private-key: ${{ secrets.APPLE_DEVELOPER_ID_APPLICATION_PRIVATE_KEY }}
-        apple-installer-certificate: ${{ secrets.APPLE_DEVELOPER_ID_INSTALLER_CERTIFICATE }}
-        apple-installer-private-key: ${{ secrets.APPLE_DEVELOPER_ID_INSTALLER_PRIVATE_KEY }}
+        apple-application-p12: ${{ secrets.APPLE_DEVELOPER_ID_APPLICATION_P12 }}
+        apple-application-p12-password: ${{ secrets.APPLE_DEVELOPER_ID_APPLICATION_P12_PASSWORD }}
+        apple-installer-p12: ${{ secrets.APPLE_DEVELOPER_ID_INSTALLER_P12 }}
+        apple-installer-p12-password: ${{ secrets.APPLE_DEVELOPER_ID_INSTALLER_P12_PASSWORD }}
         apple-api-key: ${{ secrets.APPLE_APP_STORE_CONNECT_API_DATA }}
 
   macos-packaging-unsigned: