Repository navigation
fix(nightly): keep DMG signer on trusted Linux route - #29821
Merged
Merged
Conversation
Contributor
|
cmux status (one comment, edited in place; each line is updated by the job that owns it) Review App of this head (app.zip, kept 1 day)
Shipped in:
|
teamleaderleo
temporarily deployed
to
ci-routing-agent
November 1, 2026 00:22 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
Collaborator
Author
|
Review (subagent): SHIP at 26afe95. Linux artifact/dependencies restored; owned-Mac signer admission and keychain exemption removed; freshness and warm-source changes preserved. |
This was referenced Nov 1, 2026
teamleaderleo
added a commit
that referenced
this pull request
Nov 1, 2026
… on a re-run, never 16 or 32 (#29886) The nightly signer jobs (signer-build, signer-app, signer-app-notary, signer-dmg), the nightly sign pick and the DEV daily sign pick ran on Blacksmith Linux 16 or 32 vCPU. They are notarization-bound (HQ build-fleet summary, W44 p50 on 32 vCPU: signer-app 240 s, signer-dmg 199 s, signer-build 7 s, the pick 11 s). Attempt 1 now takes GitHub-hosted ubuntu-24.04, a re-run Blacksmith Linux 4 vCPU. A pool signer GitHub drops unstarted fails the pool path and the macOS signer signs, as before. rcodesign stays the Linux build (#29821 took back the owned-Mac route of #29801). The hosted-runner guard gets the signer route as one exact, measured exception. Leo, 2026-11-01: "surely we measured the signign we dont need 32/16 just for signing", then "surely github has linux hosted we can just use". Agent-Session: https://cmux.com/deeplink/agent?id=aid-d9093a0f1b2d0cbb0b2c Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Takes back #29801: restore the existing signer route until its owned-Mac keychain and exclusive admission are implemented.
The nightly DMG signer is back on its existing Blacksmith Linux route (16 or 32 vCPU;
ubuntu-24.04applies only to forks). The merged Mac route depended on a glaeda signing admission that does not includesigner-dmg; it could therefore fail before signing and stall publication.This fix-forward removes the unused native Mac signer build and the owned-Mac claim path, restores the Linux signer artifact and checksum flow, and keeps the warm-source declaration for the signing job. The owned-Mac signing guard no longer grants a release-signer exception: a future Mac route must first provide a per-job keychain and unconditional cleanup. That design is tracked in HQ research issue #5742.
Leo asked, “why are changes to these not in my current nightly”; the freshness rule keeps each feed’s newest published build within 30 minutes of its branch tip.
Validation:
python3 -m unittest tests/test_nightly_signer_jobs.py tests/test_nightly_sign_runner.py tests/test_ci_nightly_off_blacksmith.py tests/test_ci_signing_owned_mac.py tests/test_ci_signing_keychain_is_deleted_before_bundle_code.py tests/test_release_signer_scripts.py(113 passed);python3 tests/test_ci_warm_sources.py(12 passed);git diff --check.Agent footer: agent session
🤖 Generated with Claude Code