fix(signing): pin a team-based designated requirement for dev builds#70
Merged
Conversation
Commit #65 switched dev-build signing from a pinned Developer ID cert to the generic "Apple Development" identity on the reasoning "same team, so TCC stays stable." That holds for Developer ID (team-based DR) but NOT for Apple Development: codesign's default DR for a development cert pins the specific leaf cert's Common Name ("Apple Development: … (ID)"), which changes on cert rotation. So the designated requirement silently changed, TCC's stored csreq (from the old Developer-ID grant) no longer matched the new signature, and Accessibility read "toggle on, still denied." Pin an explicit team-based DR on the /Applications re-sign step: identifier "dev.alex.blurt" and anchor apple generic and certificate leaf[subject.OU] = "Y54ZB9JF63" It's satisfied by both Apple Development and Developer ID signatures and survives cert rotation, so the grant stays stable. Built via the DEVELOPMENT_TEAM / PRODUCT_BUNDLE_IDENTIFIER build settings so it tracks the project config. Verified: clean Debug-Local build installs to /Applications with the team-based DR; codesign --verify --strict passes; hotkey/injection works after a one-time re-grant. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
On the dev build, Accessibility showed toggle on, still denied — the hotkey/keystroke-injection path was blocked even though Blurt appeared authorized in System Settings.
Root cause
Commit #65 switched dev-build signing from a pinned Developer ID cert to the generic
"Apple Development"identity, on the reasoning "same teamY54ZB9JF63, so TCC stays stable."That's true for Developer ID (its designated requirement is team-based:
certificate leaf[subject.OU] = Y54ZB9JF63), but not for Apple Development. codesign's default DR for a development cert pins the specific leaf certificate's Common Name —"Apple Development: Alex Kroman (R3Z539L7XT)"— which changes whenever that cert rotates (they expire ~yearly and Xcode reissues them).TCC keys the Accessibility grant to the app's designated requirement. It still had the
csreqblob from the old Developer-ID grant (which requires the6.2.6Developer-ID marker); the new Apple Development signature can't satisfy it, so TCC denied at check time despite the toggle being on.Fix
Pin an explicit team-based designated requirement on the
/Applicationsre-sign step:PRODUCT_BUNDLE_IDENTIFIER/DEVELOPMENT_TEAMbuild settings, so it tracks project config.OU = team), and stable across cert rotation — so this can't recur.Verification
codesign -d --requirements -on the freshly installed/Applications/Blurt.appshows the team-based DR.codesign --verify --strictpasses.tccutil reset Accessibility dev.alex.blurt+ re-toggle), the hotkey/injection path works.Note
Existing dev installs need a one-time Accessibility re-grant, since the old grant was bound to the previous (Developer-ID) requirement. After that it stays stable.
🤖 Generated with Claude Code