ci: the real signing import test carries the Developer ID G2 intermediate by lawrencecchen · Pull Request #21151 · manaflow-ai/cmux

lawrencecchen · 2026-10-16T07:12:27Z

Summary

Follow-up to #21145 (cmuxterm-hq#2053). The real macOS import test (tests/test_signing_keychain_real_import.sh, from #21142) now builds its throwaway .p12 with the vendored Apple Developer ID G2 intermediate in the chain, as the CI certificate secret has. The real scripts/ci/signing-keychain.sh create then runs the real scripts/import-apple-developer-id-intermediates.sh against a keychain that already holds that intermediate. That is the path that failed in the first main nightly after #21043 (run 38857402565).

No secret: the identity is self-signed and made in the job; the workflow has no environment and contents: read.

Testing

Red before ci: accept a Developer ID intermediate that the signing .p12 already added #21145 (main tip then): https://github.com/manaflow-ai/cmux/actions/runs/38861491788 shows DeveloperIDG2CA.cer: already in cmux-real-import-test-1149.keychain, then FAIL: signing-keychain.sh create failed.
Green on ci: accept a Developer ID intermediate that the signing .p12 already added #21145's fix (same test on feat-cmux-next, which has the same fix as ci: accept a Developer ID intermediate that the signing .p12 already added #21143): https://github.com/manaflow-ai/cmux/actions/runs/38864400339 shows DeveloperIDG2CA is already in cmux-real-import-test-1191.keychain (SHA-1 5B45F61068B29FCC8FFFF1A7E99B78DA9E9C4635), then PASS.
This PR's own run of the workflow is in the checks.

Changelog

none

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by cubic

Makes the real macOS signing import test carry the vendored Apple Developer ID G2 intermediate in its throwaway .p12, matching the CI certificate secret. This reproduces the nightly failure from #21043 where the intermediates step met the G2 intermediate already in the keychain, and the test now asserts it took that path so the fix is actually verified.

^{Written for commit 572ded6. Summary will update on new commits.}

Summary by CodeRabbit

Tests
- Expanded signing-keychain checks to cover importing an identity that includes the Developer ID G2 intermediate certificate and verify that the intermediate is already present in the keychain.
- Test output is now shown when creation succeeds, and failures include the captured log to make the result easier to diagnose.

github-actions · 2026-10-16T07:12:44Z

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

…its .p12 The CI certificate secret's .p12 carries Apple's Developer ID G2 intermediate; signing then failed in import-apple-developer-id-intermediates.sh with "already in build.keychain" (main 38857402565). The throwaway identity now carries it too, so the real import test covers that path. Red before #21145 (run 38861491788), green on its fix (run 38864400339). Refs cmuxterm-hq#2053. Bead cx-yzoow.

coderabbitai · 2026-10-16T07:13:27Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 2be1e474-4419-4953-b413-9656d48c3d2e

📥 Commits

Reviewing files that changed from the base of the PR and between dd66cb0 and 572ded6.

📒 Files selected for processing: 1

tests/test_signing_keychain_real_import.sh

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 6 remain after this review.

📝 Walkthrough

The real keychain import test adds the Developer ID G2 intermediate certificate to its PKCS#12 identity. It captures the keychain creation output and checks that the log reports the intermediate was already in the keychain.

Changes: Keychain Import Test

Layer / File(s)	Summary
Build and verify intermediate-containing identity `tests/test_signing_keychain_real_import.sh`	The test converts the G2 certificate to PEM and includes it in the PKCS#12 export. It captures the creation output, displays it on success, and checks for the already-present intermediate message.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 572de

This test update exercises the intended duplicate-intermediate import path. No concrete merge-blocking risk was identified.

Pre-merge checks: 25

Check name	Status	Explanation
Description check		The description clearly explains the problem, implementation, testing evidence, and changelog impact. The Proof and Checklist sections are omitted, but the description is otherwise complete and the ch…
Title check		The title clearly and concisely identifies the main change: the real signing import test now carries the Developer ID G2 intermediate.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Cmux Cloud Persistent Session And Early Input		PASS. The pull request changes only `tests/test_signing_keychain_real_import.sh`. The diff adds Developer ID G2 certificate handling and log assertions for the macOS signing-keychain test. It does not…
Cmux Swift Actor Isolation		The pull request changes only `tests/test_signing_keychain_real_import.sh`, a Bash test. It introduces no production Swift changes, Swift actors, MainActor models or protocols, Sendable reference type…
Cmux Swift Blocking Runtime		The PR changes only the test-only shell script `tests/test_signing_keychain_real_import.sh`. It adds certificate conversion, PKCS#12 setup, log capture, and a deterministic `grep` assertion. It does n…
Cmux Browser Automation Off-Main		PASS: The pull request changes only `tests/test_signing_keychain_real_import.sh`. The diff adds OpenSSL, PKCS#12, logging, and keychain-test assertions. It does not change `Sources/TerminalController.…
Cmux Expensive Synchronous Load		PASS: The pull request changes only tests/test_signing_keychain_real_import.sh. It adds shell/OpenSSL keychain-test logic and no production Swift code or agent-history load. The expensive synchronous …
Cmux Cache Substitution Correctness		PASS: The pull request changes only `tests/test_signing_keychain_real_import.sh`, a Bash test. It introduces no production Swift, TypeScript, or JavaScript change and does not match the cache-substitu…
Cmux No Hacky Sleeps		PASS: The pull request changes only `tests/test_signing_keychain_real_import.sh`, which is test-only shell scaffolding. The diff adds certificate conversion, PKCS#12 setup, log capture, and a grep ass…
Cmux Algorithmic Complexity		PASS: The PR changes only tests/test_signing_keychain_real_import.sh. The added operations convert one fixed vendored certificate and grep one captured log; they are test-only scaffolding, not product…
Cmux Swift Concurrency		The pull request changes only `tests/test_signing_keychain_real_import.sh`. It introduces shell/OpenSSL/keychain test logic and no cmux-owned Swift code, so it does not introduce or expand any listed …
Cmux Swift `@Concurrent`		PASS: The pull request changes only `tests/test_signing_keychain_real_import.sh`. The authoritative diff contains no Swift files or Swift declarations, so the `@concurrent` criteria do not apply.
Cmux Swift Package Boundaries		The pull request changes only `tests/test_signing_keychain_real_import.sh`, a shell test. It introduces no production Swift changes and does not affect Swift package boundaries.
Cmux Swiftpm Lockfiles		The pull request changes only `tests/test_signing_keychain_real_import.sh`. It changes no `Package.swift`, `Package.resolved`, `.gitignore`, workflow, Xcode project, or dependency declaration. Therefo…
Cmux Swift Logging		The pull request changes only `tests/test_signing_keychain_real_import.sh`, a shell test. It adds CLI/test output and captures `create` diagnostics; it does not add or materially change production Swi…
Cmux User-Facing Error Privacy		PASS. The pull request changes only `tests/test_signing_keychain_real_import.sh`. Its added output and diagnostics run in the macOS CI workflow, not in a cmux app, product CLI, or product API. The rul…
Cmux Full Internationalization		The PR changes only `tests/test_signing_keychain_real_import.sh`. The added comments, failure messages, log output, and `grep` assertion are test-only/diagnostic text. The diff adds no Swift UI, app c…
Cmux Swiftui State Layout		PASS. The pull request changes only `tests/test_signing_keychain_real_import.sh`. The diff contains shell commands for certificate conversion, PKCS#12 creation, logging, and `grep`; it contains no Swi…
Cmux Architecture Rethink		PASS: The pull request changes only `tests/test_signing_keychain_real_import.sh`, a shell test. It introduces no Swift architecture changes, lifecycle ownership changes, timing repair paths, mutable s…
Cmux Swift Auxiliary Window Close Shortcuts		PASS: The pull request changes only tests/test_signing_keychain_real_import.sh. It adds no Swift, NSWindow, NSPanel, NSWindowController, SwiftUI Window, or WindowGroup code, so the auxiliary-window cl…
Cmux Source Artifacts		The only changed path is `tests/test_signing_keychain_real_import.sh`, a hand-written test script. Its new `.pem`, `.p12`, and `create.log` files are created under a runtime temporary directory and ar…
Cmux No Test Or Debug Seam In Production Source		PASS: The pull request changes only tests/test_signing_keychain_real_import.sh. It changes no Swift file under a production Sources/ path, so it cannot introduce a test or debug seam in production sou…

Full details: Description check

Explanation

The description clearly explains the problem, implementation, testing evidence, and changelog impact. The Proof and Checklist sections are omitted, but the description is otherwise complete and the change is CI-only.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files.

Full details: Cmux Cloud Persistent Session And Early Input

Explanation

PASS. The pull request changes only tests/test_signing_keychain_real_import.sh. The diff adds Developer ID G2 certificate handling and log assertions for the macOS signing-keychain test. It does not change Cloud terminal creation, cmux-tui transport, manual renderers, input ownership, auth, idempotency, revision, or lease handling.

Full details: Cmux Swift Actor Isolation

Explanation

The pull request changes only tests/test_signing_keychain_real_import.sh, a Bash test. It introduces no production Swift changes, Swift actors, MainActor models or protocols, Sendable reference types, or UI-bound store access.

Full details: Cmux Swift Blocking Runtime

Explanation

The PR changes only the test-only shell script tests/test_signing_keychain_real_import.sh. It adds certificate conversion, PKCS#12 setup, log capture, and a deterministic grep assertion. It does not change Swift or introduce any listed blocking or timing primitive in production code.

Full details: Cmux Browser Automation Off-Main

Explanation

PASS: The pull request changes only tests/test_signing_keychain_real_import.sh. The diff adds OpenSSL, PKCS#12, logging, and keychain-test assertions. It does not change Sources/TerminalController.swift, ControlCommandExecutionPolicy.swift, or any browser.* socket command routing.

Full details: Cmux Expensive Synchronous Load

Explanation

PASS: The pull request changes only tests/test_signing_keychain_real_import.sh. It adds shell/OpenSSL keychain-test logic and no production Swift code or agent-history load. The expensive synchronous load check is not applicable.

Full details: Cmux Cache Substitution Correctness

Explanation

PASS: The pull request changes only tests/test_signing_keychain_real_import.sh, a Bash test. It introduces no production Swift, TypeScript, or JavaScript change and does not match the cache-substitution failure condition.

Full details: Cmux No Hacky Sleeps

Explanation

PASS: The pull request changes only tests/test_signing_keychain_real_import.sh, which is test-only shell scaffolding. The diff adds certificate conversion, PKCS#12 setup, log capture, and a grep assertion. It adds no sleep, timer, polling loop, fixed delay, or wall-clock wait. The rule explicitly allows deterministic test-only scaffolding.

Full details: Cmux Algorithmic Complexity

Explanation

PASS: The PR changes only tests/test_signing_keychain_real_import.sh. The added operations convert one fixed vendored certificate and grep one captured log; they are test-only scaffolding, not production runtime code or scalable collection processing. The rule explicitly passes test-only changes.

Full details: Cmux Swift Concurrency

Explanation

The pull request changes only tests/test_signing_keychain_real_import.sh. It introduces shell/OpenSSL/keychain test logic and no cmux-owned Swift code, so it does not introduce or expand any listed Swift concurrency pattern.

Full details: Cmux Swiftpm Lockfiles

Explanation

The pull request changes only tests/test_signing_keychain_real_import.sh. It changes no Package.swift, Package.resolved, .gitignore, workflow, Xcode project, or dependency declaration. Therefore it does not trigger any failure condition in the SwiftPM lockfile policy.

Full details: Cmux Swift Logging

Explanation

The pull request changes only tests/test_signing_keychain_real_import.sh, a shell test. It adds CLI/test output and captures create diagnostics; it does not add or materially change production Swift logging. The Swift logging criteria do not apply.

Full details: Cmux User-Facing Error Privacy

Explanation

PASS. The pull request changes only tests/test_signing_keychain_real_import.sh. Its added output and diagnostics run in the macOS CI workflow, not in a cmux app, product CLI, or product API. The rule explicitly allows tests and internal CI diagnostics, and no concrete path to a cmux end user exists.

Full details: Cmux Full Internationalization

Explanation

The PR changes only tests/test_signing_keychain_real_import.sh. The added comments, failure messages, log output, and grep assertion are test-only/diagnostic text. The diff adds no Swift UI, app catalog, Info.plist, web UI, metadata, API response, markdown, or changelog content requiring localization.

Full details: Cmux Swiftui State Layout

Explanation

PASS. The pull request changes only tests/test_signing_keychain_real_import.sh. The diff contains shell commands for certificate conversion, PKCS#12 creation, logging, and grep; it contains no SwiftUI code, ObservableObject, @Published, @Observable, GeometryReader, lazy/list row state, or render-time state mutation.

Full details: Cmux Architecture Rethink

Explanation

PASS: The pull request changes only tests/test_signing_keychain_real_import.sh, a shell test. It introduces no Swift architecture changes, lifecycle ownership changes, timing repair paths, mutable state owners, observers, or duplicate UI action wiring.

Full details: Cmux Swift Auxiliary Window Close Shortcuts

Explanation

PASS: The pull request changes only tests/test_signing_keychain_real_import.sh. It adds no Swift, NSWindow, NSPanel, NSWindowController, SwiftUI Window, or WindowGroup code, so the auxiliary-window close-shortcut rule is not applicable.

Full details: Cmux Source Artifacts

Explanation

The only changed path is tests/test_signing_keychain_real_import.sh, a hand-written test script. Its new .pem, .p12, and create.log files are created under a runtime temporary directory and are not added to source control. The vendored certificate is only read as an existing test fixture. No source-control artifact path is introduced.

Full details: Cmux No Test Or Debug Seam In Production Source

Explanation

PASS: The pull request changes only tests/test_signing_keychain_real_import.sh. It changes no Swift file under a production Sources/ path, so it cannot introduce a test or debug seam in production source.

✨ Finishing Touches

📝 Generate docstrings

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

…ady in the keychain Review findings on #21151. Refs cmuxterm-hq#2053. Bead cx-yzoow.

lawrencecchen · 2026-10-16T07:14:59Z

Correctness review (subagent): approve, with no defects. I added its two suggestions in 572ded6:

The test now checks the create output for DeveloperIDG2CA is already in <keychain>. This proves the duplicate path from ci: accept a Developer ID intermediate that the signing .p12 already added #21145 ran. Before, the test only checked that create succeeded.
A failed DER-to-PEM conversion now gives a FAIL message.

github-actions · 2026-10-16T07:32:20Z

Merge receipt for 572ded6576: every check was green at merge (10 verified; 15 skipped by policy). Full suite runs on main after merge.

…cx-q1lnl) 15 main commits since the last sync (ec21dd9). Full rename detection (merge.renameLimit=30000). Priority: main's signing commits. Signing (one version per script): - scripts/ci/signing-keychain.sh, scripts/import-apple-developer-id-intermediates.sh, scripts/ci/finalize-release.py, scripts/ci/publish-release-assets.py, tests/test_github_release_publication.py: identical on both sides after feat's ports (5f8d2ce, b0c33eb, fad7929, a2380e7); the .p12 + `-f pkcs12` import and the SHA-1 fingerprint check stay. - tests/test_signing_keychain_real_import.sh: main's version (manaflow-ai#21151: the G2 intermediate from the .p12 must be met in the keychain; openssl error text). signing-keychain-macos.yml: identical. - scripts/ci/notarize-nightly-dmg.sh, resume-nightly-notarization.sh, scripts/ci/smoke-dmg.sh: main's CMUX_DEFER_LAUNCH_SMOKES (manaflow-ai#21024) on feat's script. - .github/workflows/nightly.yml (manaflow-ai#21024, manaflow-ai#21049, manaflow-ai#21140): the signing job is split three ways: secret-free prepare-nightly-variant (helper, cmux-tui client, regressions, thinning, sidecar handshake; takes feat's build-nightly-app output), build-sign-notarize-nightly (runs no bundle code; smokes deferred), secret-free verify-signed-nightly (signed app, CLI, sidecar, SSH daemon contract, feat's 15 s crash-checking launch smoke, smoke-dmg.sh on the final DMG). Recovery keeps feat's find/recover jobs; recover defers smokes to a new secret-free verify-recovered-nightly-next. publish-nightly needs both verify jobs and publishes only tested digests. Literal Blacksmith labels on secret-holding jobs (incl. sign-release-notes). Promote guard (manaflow-ai#21049) merged without conflict. Feat's .publish-tooling recheck (manaflow-ai#21144 port), publish-by-id (manaflow-ai#21140, feat already had it), nightly-next notary pause/hold, signed-unnotarized zip, 20m wait, publish-nightly-identity-legacy and legacy-identity-target are kept. Not ported: main's CMUX_NOTARY_SUBMIT_ONLY async notarization (feat keeps its in-job wait + recovery); publish-nightly-identity-legacy defers its launch smokes and has no secret-free smoke of the re-signed NIGHTLY DMG yet (it re-signs the build verify-signed-nightly smoked). - .github/workflows/release.yml: feat's job (90 min, universal app only) with main's literal blacksmith-12vcpu-macos-26 signing label (manaflow-ai#21024); feat's single-appcast resume and MDM asset list (manaflow-ai#21140 resume). - tests/test_nightly_universal_build.sh: feat's in-job wait contract and pin-cmux-tui.sh resolver, main's prepare-nightly-variant job name. tests/test_nightly_next_recovery.py, test_nightly_cmux_tui_resolve.py, test_nightly_next_computer_use_helper.py, test_nightly_signed_unnotarized_artifact.py: updated for the new jobs. Other conflict choices: - 128 modify/delete in the legacy app, CLI, iOS/macOS legacy packages, cmuxTests, legacy resources and legacy docs: kept deleted. - cmux.xcodeproj/project.pbxproj: feat-cmux-next's side. - .github/test-determinism-allowlist.txt: feat's side (main's entries name deleted tests). - cmux-tui (manaflow-ai#20570, Cloud terminal cwd): mux.rs feat's split file; publish_resource_event (mux/journal.rs) now publishes pending terminal directories; terminal_directory.rs notifies with publish_journal_event and keeps feat's emit_terminal_tabs_changed; cmux-tui-platform platform.rs: case-insensitive kitty-shell-cwd scheme and the Windows drive slash strip ported into feat's existing parser. Main's new unit tests dropped. - cmux-browser-host JS, plans/cmux-next/browser-repl, tests/browser-parity: feat's side. manaflow-ai#18380 (browser repl hardening) NOT ported: feat has its own earlier port (cx-2y2, cx-p9mu, cx-wj2w); main's later version targets the WebKit/Swift host and conflicts in ~100 hunks; it needs a port lane gated by the browser-parity harness. Main's new unit tests, scenarios 40/41 and async-owner.js dropped. - CmuxNextDesign Localizable.xcstrings: feat's side (rename detection mapped main's legacy Resources/Localizable.xcstrings keys there). Not ported (legacy-only code paths): manaflow-ai#20346, manaflow-ai#21128, manaflow-ai#20354, manaflow-ai#18641, manaflow-ai#21135. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lawrencecchen force-pushed the ci-signing-g2-real-import-test branch from 3b6a91d to 9e51de6 Compare October 16, 2026 07:13

ci: the real import test asserts that it met the G2 intermediate alre…

572ded6

…ady in the keychain Review findings on #21151. Refs cmuxterm-hq#2053. Bead cx-yzoow.

lawrencecchen merged commit cc2280f into main Oct 16, 2026
52 checks passed

lawrencecchen deleted the ci-signing-g2-real-import-test branch October 16, 2026 07:32

Navigation Menu

Repository navigation

ci: the real signing import test carries the Developer ID G2 intermediate - #21151

ci: the real signing import test carries the Developer ID G2 intermediate#21151
lawrencecchen merged 2 commits into
mainfrom
ci-signing-g2-real-import-test

lawrencecchen commented Oct 16, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

github-actions Bot commented Oct 16, 2026

Uh oh!

coderabbitai Bot commented Oct 16, 2026 •

edited

Loading

Uh oh!

lawrencecchen commented Oct 16, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 16, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

lawrencecchen commented Oct 16, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Changelog

Summary by cubic

Summary by CodeRabbit

Uh oh!

github-actions Bot commented Oct 16, 2026

Uh oh!

coderabbitai Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lawrencecchen commented Oct 16, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 16, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

lawrencecchen commented Oct 16, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 16, 2026 •

edited

Loading