From 19251a634420be9a0f066169e0edf2bd6ce82e6a Mon Sep 17 00:00:00 2001 From: tas0dev <156896971+tas0dev@users.noreply.github.com> Date: Wed, 11 Nov 2026 17:32:01 +0900 Subject: [PATCH 1/2] Initialize Edit signing credentials on an approved Actions runner --- .github/workflows/package.yml | 10 ++--- .github/workflows/signing-setup.yml | 66 +++++++++++++++++++++++++++++ BUILDING.md | 33 ++++++++++++--- 3 files changed, 98 insertions(+), 11 deletions(-) create mode 100644 .github/workflows/signing-setup.yml diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml index 0417220..af6da21 100644 --- a/.github/workflows/package.yml +++ b/.github/workflows/package.yml @@ -29,7 +29,7 @@ jobs: sudo apt-get install -y pkg-config libxkbcommon-dev libwayland-dev libfontconfig1-dev libx11-dev libxcursor-dev libxi-dev libxrandr-dev unzip curl perl cmake - name: Prepare the pinned standalone Rust SDK id: sdk - uses: mochiOS/devkit/actions/setup-rust-sdk@1ae906d7417e9882b11541e338552c3039c981fb + uses: mochiOS/devkit/actions/setup-rust-sdk@0f8585fc13691383bebe304633dae8bced8443d1 with: output: ${{ runner.temp }}/mochios-rust-sdk - name: Test, compile and stage Edit @@ -73,7 +73,7 @@ jobs: path: unsigned-package - name: Prepare trusted tooling without checking out application code id: sdk - uses: mochiOS/devkit/actions/setup-rust-sdk@1ae906d7417e9882b11541e338552c3039c981fb + uses: mochiOS/devkit/actions/setup-rust-sdk@0f8585fc13691383bebe304633dae8bced8443d1 with: output: ${{ runner.temp }}/mochios-rust-sdk - name: Build the pinned signing tool @@ -84,9 +84,7 @@ jobs: - name: Sign, verify and publish the approved package env: GH_TOKEN: ${{ github.token }} - MSIGN_CERTIFICATE_B64: ${{ secrets.MSIGN_CERTIFICATE_B64 }} - MSIGN_PRIVATE_KEY_B64: ${{ secrets.MSIGN_PRIVATE_KEY_B64 }} - MSIGN_ROOT_PUBLIC_KEY_B64: ${{ vars.MSIGN_ROOT_PUBLIC_KEY_B64 }} + MSIGN_IDENTITY_B64: ${{ secrets.MSIGN_IDENTITY_B64 }} HELPER: ${{ steps.sdk.outputs.helper }} SOURCE_COMMIT: ${{ github.sha }} RELEASE_REPOSITORY: ${{ github.repository }} @@ -97,7 +95,7 @@ jobs: --msign "$RUNNER_TEMP/host-tools/release/msign" \ --package-id org.mochios.edit \ --commit "$SOURCE_COMMIT" \ - --sdk-ref 1ae906d7417e9882b11541e338552c3039c981fb \ + --sdk-ref 0f8585fc13691383bebe304633dae8bced8443d1 \ --repository "$RELEASE_REPOSITORY" \ --environment app-release \ --reviewer-team 17892808 \ diff --git a/.github/workflows/signing-setup.yml b/.github/workflows/signing-setup.yml new file mode 100644 index 0000000..7a4106a --- /dev/null +++ b/.github/workflows/signing-setup.yml @@ -0,0 +1,66 @@ +name: Initialize Edit signing +on: + workflow_dispatch: + inputs: + build_run_id: + description: Successful main-branch Build native Edit MPKG run ID + required: true + type: string +permissions: + contents: read + actions: read +concurrency: + group: edit-signing-initialization + cancel-in-progress: false +jobs: + initialize: + if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch) + environment: app-release + runs-on: ubuntu-24.04 + timeout-minutes: 40 + env: + CARGO_BUILD_JOBS: '4' + steps: + - name: Download the selected unsigned build (never execute application code) + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 + with: + name: edit-unsigned-mpkg + path: ${{ runner.temp }}/unsigned-build + run-id: ${{ inputs.build_run_id }} + github-token: ${{ github.token }} + repository: ${{ github.repository }} + - name: Prepare pinned SDK tooling without an application checkout + id: sdk + uses: mochiOS/devkit/actions/setup-rust-sdk@0f8585fc13691383bebe304633dae8bced8443d1 + with: + output: ${{ runner.temp }}/mochios-rust-sdk + - name: Build trusted msign and Kome + env: + SDK: ${{ steps.sdk.outputs.sdk }} + HELPER: ${{ steps.sdk.outputs.helper }} + run: | + python3 "$(dirname "$HELPER")/host-tool.py" --sdk "$SDK" --tool msign --output "$RUNNER_TEMP/signing-tools" + python3 "$(dirname "$HELPER")/host-tool.py" --sdk "$SDK" --tool kome --output "$RUNNER_TEMP/signing-tools" + - name: Authorize Kome and save the verified signing identity + env: + GH_TOKEN: ${{ github.token }} + SIGNING_SETUP_TOKEN: ${{ secrets.SIGNING_SETUP_TOKEN }} + MSIGN_SETUP_KEYPAIR_B64: ${{ secrets.MSIGN_SETUP_KEYPAIR_B64 }} + APP_RELEASE_ENABLED: ${{ vars.APP_RELEASE_ENABLED }} + HELPER: ${{ steps.sdk.outputs.helper }} + BUILD_RUN: ${{ inputs.build_run_id }} + SETUP_REPOSITORY: ${{ github.repository }} + SETUP_BRANCH: ${{ github.event.repository.default_branch }} + run: | + python3 "$(dirname "$HELPER")/signing-setup.py" \ + --repository "$SETUP_REPOSITORY" \ + --environment app-release \ + --reviewer-team 17892808 \ + --branch "$SETUP_BRANCH" \ + --package-id org.mochios.edit \ + --developer-id 019f9e5ac6687902b0e72fe53abfbef1 \ + --build-run "$BUILD_RUN" \ + --build-workflow .github/workflows/package.yml \ + --sdk-ref 0f8585fc13691383bebe304633dae8bced8443d1 \ + --artifacts "$RUNNER_TEMP/unsigned-build" \ + --tools "$RUNNER_TEMP/signing-tools/release" diff --git a/BUILDING.md b/BUILDING.md index 3c8be4c..40be2cb 100644 --- a/BUILDING.md +++ b/BUILDING.md @@ -19,12 +19,35 @@ been enabled, waits for approval in the `app-release` Environment. That environment is restricted to the default branch and reviewed by `mochiOS/application-maintainers`. -Publication is initially disabled. Before setting the repository variable -`APP_RELEASE_ENABLED=true`, configure these Environment values: +Publication is initially disabled. Initialize the identity on Actions before +setting the repository variable `APP_RELEASE_ENABLED=true`: -* Secret `MSIGN_CERTIFICATE_B64`: base64 of the issued app Developer Certificate file. -* Secret `MSIGN_PRIVATE_KEY_B64`: base64 of its corresponding private-key file. -* Variable `MSIGN_ROOT_PUBLIC_KEY_B64`: base64 of the trusted issuer public-key file. +1. Merge the reviewed workflow changes and wait for the main-branch package run + to succeed. Copy its run ID from the Actions URL. PR artifacts are refused. +2. Create a short-lived fine-grained PAT with only Edit.app selected and + Environments read/write. Save it in the `app-release` Environment as + `SIGNING_SETUP_TOKEN`. Do not paste the token into workflow inputs or logs. +3. Run **Initialize Edit signing** on `main`, supplying the successful build run + ID. The existing `application-maintainers` protection requires approval. +4. Open the running **Authorize Kome and save the verified signing identity** + step. Follow its public device-login URL in a browser and authorize the + official mochiOS Developer. No account tokens are copied into GitHub inputs. +5. After the workflow succeeds, revoke the temporary PAT in GitHub settings. + The workflow deletes its `SIGNING_SETUP_TOKEN` Secret, but this alone does + not revoke the PAT itself. + +The workflow generates Edit's key on the ephemeral hosted runner, obtains an +exact-package Developer Certificate and verifies a signed copy of the selected +MPKG. It atomically saves `MSIGN_IDENTITY_B64` (certificate, private key and +issuer public key) as one Environment Secret. It never uploads credential files, +publishes a release, enables publication, or checks out application code. + +An encrypted `MSIGN_SETUP_KEYPAIR_B64` recovery Secret is retained if issuance +fails, so the next approved attempt reuses the same key. On success it is +removed. Existing production credentials are never silently overwritten; +rotation requires a separate explicit procedure. Temporary CLI sessions are +logged out and runner credential files are cleaned. Neither Root nor +Intermediate private keys are needed by this workflow. Do not commit key files or use development fixture identities. The approval job does not check out or run application code. It checks the build's source commit, From 1ebb463438dbe88c69c45672f6fd8e4e9d88d97a Mon Sep 17 00:00:00 2001 From: tas0dev <156896971+tas0dev@users.noreply.github.com> Date: Wed, 11 Nov 2026 17:34:06 +0900 Subject: [PATCH 2/2] Verify signing approval policy with the actual read-only Actions token --- .github/workflows/package.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml index af6da21..d9a113f 100644 --- a/.github/workflows/package.yml +++ b/.github/workflows/package.yml @@ -12,6 +12,9 @@ concurrency: cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: build: + permissions: + contents: read + actions: read runs-on: ubuntu-24.04 timeout-minutes: 60 env: @@ -32,6 +35,20 @@ jobs: uses: mochiOS/devkit/actions/setup-rust-sdk@0f8585fc13691383bebe304633dae8bced8443d1 with: output: ${{ runner.temp }}/mochios-rust-sdk + - name: Check signing approval policy using the read-only job token + env: + GH_TOKEN: ${{ github.token }} + HELPER: ${{ steps.sdk.outputs.helper }} + RELEASE_BRANCH: ${{ github.event.repository.default_branch }} + run: | + python3 -I - "$HELPER" "$GITHUB_REPOSITORY" "$RELEASE_BRANCH" <<'PY' + import sys + from pathlib import Path + sys.path.insert(0, str(Path(sys.argv[1]).parent)) + import release + release.approval_policy(sys.argv[2], 'app-release', 17892808, sys.argv[3]) + print('Environment Team and branch protection verified') + PY - name: Test, compile and stage Edit env: SDK: ${{ steps.sdk.outputs.sdk }}