Add psd-sign skill for macOS app signing and packaging#39
Add psd-sign skill for macOS app signing and packaging#39james-cantonwine wants to merge 1 commit into
Conversation
New skill that automates the full Apple Developer ID signing pipeline for PSD apps deployed via Jamf Self Service: - Removes quarantine attributes - Deep-signs .app with hardened runtime using PSD Developer ID - Submits to Apple notary service and staples ticket - Packages into signed .pkg installer - Notarizes and staples the .pkg - Verifies both .app and .pkg pass Gatekeeper PSD Team ID (87DL7L9GU6) and signing identities are embedded. Prompts user for app path, Apple ID, app-specific password, version, and bundle identifier at runtime. Includes troubleshooting section for common cert and notarization issues.
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces a new skill to automate the complex and multi-step process of signing, notarizing, and packaging macOS applications for deployment via Jamf Self Service. It aims to standardize the workflow for team members, reducing reliance on manual terminal instructions and ensuring consistency and efficiency in the distribution of macOS applications within the organization. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds a new psd-sign skill for automating macOS app signing. The workflow is well-structured and covers all the necessary steps from signing to packaging and verification. However, I've identified a significant security vulnerability in how the app-specific password for notarization is handled. It's passed directly on the command line, which exposes it in the process list and shell history. My review comments focus on mitigating this risk by using notarytool's keychain profile feature. This improves security and also simplifies the commands. I've provided specific suggestions to update the workflow, the notarization commands, and the troubleshooting documentation.
|
|
||
| 1. **App path** — full path to the `.app` bundle (may be provided as an argument) | ||
| 2. **Apple ID** — the `@psd401.net` account with Developer ID access | ||
| 3. **App-specific password** — SECURITY: never log, echo, or store this value |
There was a problem hiding this comment.
Collecting the app-specific password at runtime and passing it on the command line is a security risk, as it can be exposed in process lists and shell history. It's more secure to have the user store the credential in the keychain once using xcrun notarytool store-credentials and then provide a profile name to the script. This also improves usability by not requiring the password for every run.
| 3. **App-specific password** — SECURITY: never log, echo, or store this value | |
| 3. **Notary keychain profile** — name of the keychain profile for `notarytool` (create with `xcrun notarytool store-credentials`) |
There was a problem hiding this comment.
Applied. The workflow inputs now ask for a keychain profile name instead of an Apple ID + app-specific password. The one-time setup is documented in Prerequisites:
2. **Notary keychain profile** — name of the keychain profile for `notarytool` (create once with `xcrun notarytool store-credentials`)Prerequisites now reads:
- A notarytool keychain profile stored on the machine — create once with:
`xcrun notarytool store-credentials "<profile-name>" --apple-id <your@psd401.net> --team-id 87DL7L9GU6 --password <app-specific-password>`
Fix committed to psd401/psd-claude-plugins:add-psd-sign-skill — please pull or apply to your fork branch.
Generated by Claude Code
| xcrun notarytool submit "/tmp/${APP_NAME}.zip" \ | ||
| --apple-id "$APPLE_ID" \ | ||
| --team-id 87DL7L9GU6 \ | ||
| --password "$APP_PASSWORD" \ | ||
| --wait |
There was a problem hiding this comment.
To avoid exposing the app-specific password on the command line, which is a security risk, you should use a keychain profile. This change assumes the workflow is updated to ask for a keychain profile name (e.g., in a variable like $NOTARY_KEYCHAIN_PROFILE) instead of the password itself. Using a profile also simplifies the command as apple-id and team-id are not needed if stored in the profile.
| xcrun notarytool submit "/tmp/${APP_NAME}.zip" \ | |
| --apple-id "$APPLE_ID" \ | |
| --team-id 87DL7L9GU6 \ | |
| --password "$APP_PASSWORD" \ | |
| --wait | |
| # Use keychain profile for security. First, store credentials: | |
| # xcrun notarytool store-credentials "YOUR_PROFILE_NAME" --apple-id ... --team-id ... --password ... | |
| xcrun notarytool submit "/tmp/${APP_NAME}.zip" \ | |
| --keychain-profile "$NOTARY_KEYCHAIN_PROFILE" \ | |
| --wait |
There was a problem hiding this comment.
Applied. Step 4 now uses --keychain-profile — no Apple ID, team ID, or password on the command line:
xcrun notarytool submit "/tmp/${APP_NAME}.zip" \
--keychain-profile "$NOTARY_KEYCHAIN_PROFILE" \
--waitFix committed to psd401/psd-claude-plugins:add-psd-sign-skill.
Generated by Claude Code
| xcrun notarytool submit "$HOME/Desktop/${APP_NAME}.pkg" \ | ||
| --apple-id "$APPLE_ID" \ | ||
| --team-id 87DL7L9GU6 \ | ||
| --password "$APP_PASSWORD" \ | ||
| --wait |
There was a problem hiding this comment.
As with the app notarization step, the package notarization should also use a keychain profile to avoid exposing the password on the command line. This is a security risk.
| xcrun notarytool submit "$HOME/Desktop/${APP_NAME}.pkg" \ | |
| --apple-id "$APPLE_ID" \ | |
| --team-id 87DL7L9GU6 \ | |
| --password "$APP_PASSWORD" \ | |
| --wait | |
| # Use keychain profile for security. First, store credentials: | |
| # xcrun notarytool store-credentials "YOUR_PROFILE_NAME" --apple-id ... --team-id ... --password ... | |
| xcrun notarytool submit "$HOME/Desktop/${APP_NAME}.pkg" \ | |
| --keychain-profile "$NOTARY_KEYCHAIN_PROFILE" \ | |
| --wait |
There was a problem hiding this comment.
Applied. Step 7 now uses --keychain-profile for the .pkg notarization too:
xcrun notarytool submit "$HOME/Desktop/${APP_NAME}.pkg" \
--keychain-profile "$NOTARY_KEYCHAIN_PROFILE" \
--waitFix committed to psd401/psd-claude-plugins:add-psd-sign-skill.
Generated by Claude Code
| ## Troubleshooting | ||
|
|
||
| - **"no identity found"** — Developer ID certificates are not installed. Open Keychain Access and verify both `Developer ID Application` and `Developer ID Installer` certs are present for Peninsula School District. | ||
| - **Notarization rejected** — Check the log with `xcrun notarytool log <submission-id> --apple-id ... --team-id 87DL7L9GU6 --password ...` |
There was a problem hiding this comment.
For consistency and security, the troubleshooting command for checking notarization logs should also be updated to use the keychain profile instead of passing credentials on the command line.
| - **Notarization rejected** — Check the log with `xcrun notarytool log <submission-id> --apple-id ... --team-id 87DL7L9GU6 --password ...` | |
| - **Notarization rejected** — Check the log with `xcrun notarytool log <submission-id> --keychain-profile <profile-name>` |
There was a problem hiding this comment.
Applied. The troubleshooting command now uses --keychain-profile:
- **Notarization rejected** — Check the log with `xcrun notarytool log <submission-id> --keychain-profile <profile-name>`
Fix committed to psd401/psd-claude-plugins:add-psd-sign-skill.
Generated by Claude Code
|
🤖 pr-fix routine round 1 — partial progress All 4 security review comments have been addressed with specific fixes and replied to inline. The changes are:
Branch blocker: This PR's head branch ( What @james-cantonwine needs to do — either:
Once the commits land on the fork branch, the CI should pass and this PR can be merged.
Generated by Claude Code |
krishagel
added
the
pr-fix-stuck
Claude
2 participants
Summary
psd-signskill topsd-productivityplugin87DL7L9GU6) and signing identities are embeddedContext
We have multiple macOS apps being signed and deployed via Jamf Self Service. This skill standardizes the 9-step signing process so any team member with Developer ID certs can run
/psd-signfrom Claude Code instead of referencing manual terminal instructions.Test plan
/psd-signappears in skill list.appbundle and confirm full pipeline completes.pkgpassespkgutil --check-signature🤖 Generated with Claude Code