From d0823c8be40714bb7b88ecc90e475b158f27b278 Mon Sep 17 00:00:00 2001 From: prklm10 Date: Tue, 14 Jul 2026 17:28:20 +0530 Subject: [PATCH] fix(ci): notarytool does not support altool's @env: password syntax MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PR #2281 switched the notarization password to `@env:APPLE_ID_KEY` to keep it out of argv (CWE-214), but that prefix is altool-only. notarytool sends the literal string "@env:APPLE_ID_KEY" as the password, so every submission fails with HTTP 401 regardless of the stored secrets — this broke the v1.32.3 release build. Pass the expanded env value again; the argv exposure is negligible on an ephemeral single-tenant runner and GitHub masks the secret in logs. A follow-up can adopt an App Store Connect API key or --keychain-profile for hardening notarytool actually supports. Co-Authored-By: Claude Fable 5 --- scripts/executable.sh | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/scripts/executable.sh b/scripts/executable.sh index 8e31e3213..a195ac8f0 100755 --- a/scripts/executable.sh +++ b/scripts/executable.sh @@ -76,10 +76,13 @@ if [ -n "${APPLE_DEV_CERT:-}" ]; then mv percy-osx percy zip percy-osx.zip percy - # Read the Apple app-specific password from the environment via notarytool's - # `@env:` prefix instead of passing it as a CLI argument, so it is not visible - # in the process table / `ps aux` (CWE-214). - xcrun notarytool submit --apple-id "$APPLE_ID_USERNAME" --password "@env:APPLE_ID_KEY" --team-id "$APPLE_TEAM_ID" percy-osx.zip --wait + # NOTE: `@env:VAR` is altool syntax — notarytool does NOT support it and + # treats the string as the literal password, so every submission 401s + # (this broke the v1.32.3 release). Pass the expanded value instead; argv + # visibility (CWE-214) is a non-issue on an ephemeral single-tenant runner, + # and GitHub masks the secret in logs. For stronger hardening later, use an + # App Store Connect API key (--key/--key-id/--issuer) or --keychain-profile. + xcrun notarytool submit --apple-id "$APPLE_ID_USERNAME" --password "$APPLE_ID_KEY" --team-id "$APPLE_TEAM_ID" percy-osx.zip --wait cleanup else