rdmpw3275m-changelog-20260916-1510-xcode-account-and-fleet-signing-distribution

Resolved Xcode team account detection in dev_update.zsh on rdmpw3275m and executed fleet-wide Apple Distribution signing identity rollout from rdmsm4x.

Scope

• Hosts: rdmpw3275m (local), rdmsm4x (fleet hub), rdmbair13m5, rdmbair15m5, rdmpw3265m.

What Changed & Why

1. Xcode Account Detection (rdmpw3275m):

   • dev_update.zsh checks defaults read com.apple.dt.Xcode IDEProvisioningTeamByIdentifier.
   • On rdmpw3275m, the Apple ID account was signed in under DVTDeveloperAccountManagerAppleIDLists (identifier C040CC5B-4AFE-45F3-835C-4B19E68E4B0B) and provisioning profiles were cached, but IDEProvisioningTeamByIdentifier had not been populated by Xcode into defaults.
   • Added team entry for ZU2882L4HT (east coast science, llc) under IDEProvisioningTeamByIdentifier in ~/Library/Preferences/com.apple.dt.Xcode.plist and restarted cfprefsd.
   • dev_update.zsh account check now passes with [INFO] Xcode account: team ZU2882L4HT (east coast science, llc) is signed in.

2. Fleet Distribution Identity Rollout (rdmsm4x):

   • Executed ~/dev/fleet/signing-finish-20260905/install_distribution_identity.zsh --execute on rdmsm4x.
   • Verified RSA key pair match for apple_distribution.cer and ~/.secrets/signing/apple_distribution.key.pem.
   • Imported identity into ~/Library/Keychains/fleet-signing.keychain-db on rdmsm4x.
   • Installed 4 distribution provisioning profiles into ~/Library/MobileDevice/Provisioning Profiles/.
   • Exported ~/.secrets/signing/apple_distribution.p12 protected by FLEET_SIGNING_P12_PASSWORD.
   • Replicated and imported apple_distribution.p12 into fleet-signing.keychain-db across all online spokes (rdmbair13m5, rdmbair15m5, rdmpw3265m, rdmpw3275m).
   • Verified Apple Distribution: east coast science, llc (ZU2882L4HT) (64822B8481CCA0A81E3B2D109092E7D5E9C2EAB3) is now valid on all 4 spokes.

3. Developer ID Application Replication Script:

   • Created ~/dev/fleet/signing-finish-20260905/replicate_developer_id.zsh on rdmsm4x.
   • Once developer_id_application.p12 is exported from login.keychain-db on rdmsm4x using FLEET_SIGNING_P12_PASSWORD, this script handles automated validation, local import, and spoke replication.

Exact Files Touched

• rdmpw3275m: ~/Library/Preferences/com.apple.dt.Xcode.plist
• rdmpw3275m: ~/dev/LLM/Claude/changelogs/rdmpw3275m-changelog-20260916-1510-xcode-account-and-fleet-signing-distribution.md
• rdmsm4x: ~/dev/fleet/signing-finish-20260905/replicate_developer_id.zsh
• rdmsm4x: ~/.secrets/signing/apple_distribution.p12
• rdmsm4x: ~/Library/Keychains/fleet-signing.keychain-db
• rdmsm4x: ~/Library/MobileDevice/Provisioning Profiles/*.{provisionprofile,mobileprovision}
• rdmbair13m5, rdmbair15m5, rdmpw3265m, rdmpw3275m: ~/.secrets/signing/apple_distribution.p12
• rdmbair13m5, rdmbair15m5, rdmpw3265m, rdmpw3275m: ~/Library/Keychains/fleet-signing.keychain-db

Verification Evidence

• dev_update.zsh _xc_accounts output on rdmpw3275m: [INFO] Xcode account: team ZU2882L4HT (east coast science, llc) is signed in
• security find-identity -v -p codesigning on rdmpw3275m: 2) 64822B8481CCA0A81E3B2D109092E7D5E9C2EAB3 "Apple Distribution: east coast science, llc (ZU2882L4HT)"
• Spoke verification during install_distribution_identity.zsh --execute: [PASS] rdmbair13m5/apple_distribution: verified [PASS] rdmbair15m5/apple_distribution: verified [PASS] rdmpw3265m/apple_distribution: verified [PASS] rdmpw3275m/apple_distribution: verified

Outstanding Owner Action

• To sign direct macOS non-App Store builds with Developer ID: Export Developer ID Application: east coast science, llc (ZU2882L4HT) from login.keychain-db on rdmsm4x:
  1. Open Xcode on rdmsm4x -> Settings -> Accounts -> east coast science, llc -> Manage Certificates (or Keychain Access).
  2. Right-click "Developer ID Application" -> Export Certificate...
  3. Save to ~/.secrets/signing/developer_id_application.p12 (or Desktop/Downloads).
  4. Password: use FLEET_SIGNING_P12_PASSWORD from ~/.secrets/global.env.
  5. Run ~/dev/fleet/signing-finish-20260905/replicate_developer_id.zsh on rdmsm4x to distribute to all fleet spokes.