rdmsm4x-changelog-20260924-2222-safari-stp253-chrome-passkeys-audit

One-line summary: Installed Safari Technology Preview Release 253 fleet-wide across all 6 Macs and conducted fleet-wide Chrome passkeys / screen lock sanity check.

Scope

• Hosts: rdmsm4x, rdmbair13m5, rdmbair15m5, rdmpw3265m, rdmpw3275m, jdmbair13m5
• Primary ticket: TASK-20260924-18

Actions Taken

1. Safari Technology Preview Fleet-wide Rollout

• Installed Homebrew cask safari-technology-preview across all 6 macOS fleet hosts.
• Re-used and verified downloaded official Apple release DMGs on rdmbair15m5 (SafariTechPreview253.dmg sha256 dbfcc270... for macOS 27; SafariTechnologyPreview.dmg sha256 d1c7592d... for macOS 26).
• Slices and build versions installed:
  • rdmsm4x: 27.0 (Build 22626.1.8.19.2, arm64e) — Gatekeeper accepted
  • rdmbair13m5: 27.0 (Build 22626.1.8.19.2, arm64e) — Gatekeeper accepted
  • rdmbair15m5: 27.0 (Build 22626.1.8.19.2, arm64e) — Gatekeeper accepted
  • rdmpw3265m: 27.0 (Build 21626.1.8.19.2, x86_64 arm64e universal) — Gatekeeper accepted
  • rdmpw3275m: 27.0 (Build 21626.1.8.19.2, x86_64 arm64e universal) — Gatekeeper accepted
  • jdmbair13m5: 27.0 (Build 22626.1.8.19.2, arm64e) — Gatekeeper accepted

2. Chrome & Passkey / Screen Lock Fleet-wide Sanity Check

• Chrome Version: Uniform fleet-wide at 154.0.8037.58 across all 6 hosts.
• Main Profile ([email protected]): Present and active on all 6 hosts:
  • rdmsm4x: Profile 2 ("Your Chrome")
  • rdmbair13m5: Default ("Richh")
  • rdmbair15m5: Default ("[email protected]")
  • rdmpw3265m: Profile 21 ("[email protected]")
  • rdmpw3275m: Default ("[email protected]")
  • jdmbair13m5: Default ("Richh")
• Screen Lock Requirement Confirmation:
  • Screen lock is mandatory for Passkeys & WebAuthn. Apple's LocalAuthentication framework and Google Password Manager require an active device passcode / screen lock to initialize the hardware-backed authenticator and protect synced passkeys.
  • Measured sysadminctl -screenLock status:
    • rdmsm4x, rdmbair13m5, rdmbair15m5, rdmpw3265m, rdmpw3275m: screenLock delay is immediate.
    • jdmbair13m5: screenLock delay is 300 seconds (5 minutes).
• Touch ID / Biometric Templates:
  • rdmsm4x: 3 enrolled templates
  • rdmbair13m5: 3 enrolled templates
  • rdmbair15m5: 3 enrolled templates
  • jdmbair13m5: 2 enrolled templates
  • rdmpw3265m: 0 enrolled templates (Intel workstation; passkeys require Mac login password prompt)
  • rdmpw3275m: 0 enrolled templates (Intel workstation; passkeys require Mac login password prompt)
• Profile Toggle Rationale:
  • Toggling [email protected] off/on clears Chrome's stale local session sync state and forces re-negotiation of the Google Password Manager LSKF (Lock Screen Knowledge Factor) cryptographic key with the OS Keychain and Apple LocalAuthentication context.

Verification Evidence

• 6/6 STP spctl gatekeeper evaluations returned source=Apple System origin=Software Signing accepted.
• All Chrome instances confirmed on version 154.0.8037.58.

How to Undo

• To remove Safari Technology Preview on any host: brew uninstall --cask safari-technology-preview