rdmsm4x-changelog-20260924-2222-safari-stp253-chrome-passkeys-audit
rdmsm4x-changelog-20260924-2222-safari-stp253-chrome-passkeys-audit
One-line summary: Installed Safari Technology Preview Release 253 fleet-wide across all 6 Macs and conducted fleet-wide Chrome passkeys / screen lock sanity check.
Scope
- Hosts:
rdmsm4x,rdmbair13m5,rdmbair15m5,rdmpw3265m,rdmpw3275m,jdmbair13m5 - Primary ticket:
TASK-20260924-18
Actions Taken
1. Safari Technology Preview Fleet-wide Rollout
- Installed Homebrew cask
safari-technology-previewacross all 6 macOS fleet hosts. - Re-used and verified downloaded official Apple release DMGs on
rdmbair15m5(SafariTechPreview253.dmgsha256dbfcc270...for macOS 27;SafariTechnologyPreview.dmgsha256d1c7592d...for macOS 26). - Slices and build versions installed:
rdmsm4x: 27.0 (Build 22626.1.8.19.2, arm64e) — Gatekeeper acceptedrdmbair13m5: 27.0 (Build 22626.1.8.19.2, arm64e) — Gatekeeper acceptedrdmbair15m5: 27.0 (Build 22626.1.8.19.2, arm64e) — Gatekeeper acceptedrdmpw3265m: 27.0 (Build 21626.1.8.19.2, x86_64 arm64e universal) — Gatekeeper acceptedrdmpw3275m: 27.0 (Build 21626.1.8.19.2, x86_64 arm64e universal) — Gatekeeper acceptedjdmbair13m5: 27.0 (Build 22626.1.8.19.2, arm64e) — Gatekeeper accepted
2. Chrome & Passkey / Screen Lock Fleet-wide Sanity Check
- Chrome Version: Uniform fleet-wide at
154.0.8037.58across all 6 hosts. - Main Profile (
[email protected]): Present and active on all 6 hosts:rdmsm4x:Profile 2("Your Chrome")rdmbair13m5:Default("Richh")rdmbair15m5:Default("[email protected]")rdmpw3265m:Profile 21("[email protected]")rdmpw3275m:Default("[email protected]")jdmbair13m5:Default("Richh")
- Screen Lock Requirement Confirmation:
- Screen lock is mandatory for Passkeys &
WebAuthn. Apple's
LocalAuthenticationframework and Google Password Manager require an active device passcode / screen lock to initialize the hardware-backed authenticator and protect synced passkeys. - Measured
sysadminctl -screenLock status:rdmsm4x,rdmbair13m5,rdmbair15m5,rdmpw3265m,rdmpw3275m: screenLock delay is immediate.jdmbair13m5: screenLock delay is 300 seconds (5 minutes).
- Screen lock is mandatory for Passkeys &
WebAuthn. Apple's
- Touch ID / Biometric Templates:
rdmsm4x: 3 enrolled templatesrdmbair13m5: 3 enrolled templatesrdmbair15m5: 3 enrolled templatesjdmbair13m5: 2 enrolled templatesrdmpw3265m: 0 enrolled templates (Intel workstation; passkeys require Mac login password prompt)rdmpw3275m: 0 enrolled templates (Intel workstation; passkeys require Mac login password prompt)
- Profile Toggle Rationale:
- Toggling
[email protected]off/on clears Chrome's stale local session sync state and forces re-negotiation of the Google Password Manager LSKF (Lock Screen Knowledge Factor) cryptographic key with the OS Keychain and Apple LocalAuthentication context.
- Toggling
Verification Evidence
- 6/6 STP
spctlgatekeeper evaluations returnedsource=Apple System origin=Software Signing accepted. - All Chrome instances confirmed on version
154.0.8037.58.
How to Undo
- To remove Safari Technology Preview on any host:
brew uninstall --cask safari-technology-preview