rdmsm4x-changelog-20260923-0058-developer-id-p12-exported
rdmsm4x-changelog-20260923-0058-developer-id-p12-exported
Exported the Developer ID Application identity to the one file every spoke imports on its next dev_update run.
- Window: 2026-09-23 00:47–00:58 EDT, rdmsm4x (Aqua session; Rich approved the keychain dialog)
- Cause of "no password prompt": replicate_developer_id.zsh only imports/copies an existing p12; it never exports.
- ~/.secrets/signing/developer_id_application.key.pem does NOT match the live cert (public-key hash mismatch) — not usable.
- Created ~/.secrets/signing/developer_id_application.p12 (600), leaf SHA-1 1C07FCD80C36EAD5D9E3B73F7ACCCA5368DC73FB, legacy PKCS#12 wrapped with FLEET_SIGNING_P12_PASSWORD (name only).
- Verified: decrypts; real
security importinto a throwaway keychain shows 1 valid identity; wrong passphrase rc=1. - All 5 spokes: identity currently absent (0), passphrase key present, basis file readable over ssh → rmfix_signing_identity (dev_update 2.09) imports on next run.
- Plaintext intermediates shredded from session scratchpad.
- Do NOT run replicate_developer_id.zsh: swallows import errors (prints PASS on failure), omits jdmbair13m5, and would re-create the fleet-signing keychain shadow on rdmsm4x.
- Undo: mv the p12 into ~/.secrets/signing/archive/.
Close-out 2026-09-23 14:26–14:31 EDT
- All 5 spokes imported it on their own dev_update runs. Verified by a real codesign on each (rc 0, Developer ID authority) 5/5; login keychain first on 5/5.
- replicate_developer_id.zsh retired: early
exit 3with the reasons in its header. Snapshot: ~/.agent-coordination/snapshots/rdmsm4x/fleet/20260923-142659. - fleet/signing-finish-20260905/STATUS.md §7 appended (key.pem is an orphan from an unused CSR; kept).
- Ticket TASK-20260923-01 opened and resolved with evidence.
- fleet-update ISSUES.md correction relayed via ~/dev/todo/items/20260923-fleet-update-devid-exported.md.
- Note: signing-finish-20260905/ is untracked in the fleet repo (it was before this session). Not committed here; left to the kit's owner.