Initialize Edit signing on Actions with maintainer approval

.github/workflows/package.yml

@@ -12,6 +12,9 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   build:
+    permissions:
+      contents: read
+      actions: read
     runs-on: ubuntu-24.04
     timeout-minutes: 60
     env:
@@ -29,9 +32,23 @@ jobs:
           sudo apt-get install -y pkg-config libxkbcommon-dev libwayland-dev libfontconfig1-dev libx11-dev libxcursor-dev libxi-dev libxrandr-dev unzip curl perl cmake
       - name: Prepare the pinned standalone Rust SDK
         id: sdk
-        uses: mochiOS/devkit/actions/setup-rust-sdk@1ae906d7417e9882b11541e338552c3039c981fb
+        uses: mochiOS/devkit/actions/setup-rust-sdk@0f8585fc13691383bebe304633dae8bced8443d1
         with:
           output: ${{ runner.temp }}/mochios-rust-sdk
+      - name: Check signing approval policy using the read-only job token
+        env:
+          GH_TOKEN: ${{ github.token }}
+          HELPER: ${{ steps.sdk.outputs.helper }}
+          RELEASE_BRANCH: ${{ github.event.repository.default_branch }}
+        run: |
+          python3 -I - "$HELPER" "$GITHUB_REPOSITORY" "$RELEASE_BRANCH" <<'PY'
+          import sys
+          from pathlib import Path
+          sys.path.insert(0, str(Path(sys.argv[1]).parent))
+          import release
+          release.approval_policy(sys.argv[2], 'app-release', 17892808, sys.argv[3])
+          print('Environment Team and branch protection verified')
+          PY
       - name: Test, compile and stage Edit
         env:
           SDK: ${{ steps.sdk.outputs.sdk }}
@@ -73,7 +90,7 @@ jobs:
           path: unsigned-package
       - name: Prepare trusted tooling without checking out application code
         id: sdk
-        uses: mochiOS/devkit/actions/setup-rust-sdk@1ae906d7417e9882b11541e338552c3039c981fb
+        uses: mochiOS/devkit/actions/setup-rust-sdk@0f8585fc13691383bebe304633dae8bced8443d1
         with:
           output: ${{ runner.temp }}/mochios-rust-sdk
       - name: Build the pinned signing tool
@@ -84,9 +101,7 @@ jobs:
       - name: Sign, verify and publish the approved package
         env:
           GH_TOKEN: ${{ github.token }}
-          MSIGN_CERTIFICATE_B64: ${{ secrets.MSIGN_CERTIFICATE_B64 }}
-          MSIGN_PRIVATE_KEY_B64: ${{ secrets.MSIGN_PRIVATE_KEY_B64 }}
-          MSIGN_ROOT_PUBLIC_KEY_B64: ${{ vars.MSIGN_ROOT_PUBLIC_KEY_B64 }}
+          MSIGN_IDENTITY_B64: ${{ secrets.MSIGN_IDENTITY_B64 }}
           HELPER: ${{ steps.sdk.outputs.helper }}
           SOURCE_COMMIT: ${{ github.sha }}
           RELEASE_REPOSITORY: ${{ github.repository }}
@@ -97,7 +112,7 @@ jobs:
             --msign "$RUNNER_TEMP/host-tools/release/msign" \
             --package-id org.mochios.edit \
             --commit "$SOURCE_COMMIT" \
-            --sdk-ref 1ae906d7417e9882b11541e338552c3039c981fb \
+            --sdk-ref 0f8585fc13691383bebe304633dae8bced8443d1 \
             --repository "$RELEASE_REPOSITORY" \
             --environment app-release \
             --reviewer-team 17892808 \

.github/workflows/signing-setup.yml

@@ -0,0 +1,66 @@
+name: Initialize Edit signing
+on:
+  workflow_dispatch:
+    inputs:
+      build_run_id:
+        description: Successful main-branch Build native Edit MPKG run ID
+        required: true
+        type: string
+permissions:
+  contents: read
+  actions: read
+concurrency:
+  group: edit-signing-initialization
+  cancel-in-progress: false
+jobs:
+  initialize:
+    if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+    environment: app-release
+    runs-on: ubuntu-24.04
+    timeout-minutes: 40
+    env:
+      CARGO_BUILD_JOBS: '4'
+    steps:
+      - name: Download the selected unsigned build (never execute application code)
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          name: edit-unsigned-mpkg
+          path: ${{ runner.temp }}/unsigned-build
+          run-id: ${{ inputs.build_run_id }}
+          github-token: ${{ github.token }}
+          repository: ${{ github.repository }}
+      - name: Prepare pinned SDK tooling without an application checkout
+        id: sdk
+        uses: mochiOS/devkit/actions/setup-rust-sdk@0f8585fc13691383bebe304633dae8bced8443d1
+        with:
+          output: ${{ runner.temp }}/mochios-rust-sdk
+      - name: Build trusted msign and Kome
+        env:
+          SDK: ${{ steps.sdk.outputs.sdk }}
+          HELPER: ${{ steps.sdk.outputs.helper }}
+        run: |
+          python3 "$(dirname "$HELPER")/host-tool.py" --sdk "$SDK" --tool msign --output "$RUNNER_TEMP/signing-tools"
+          python3 "$(dirname "$HELPER")/host-tool.py" --sdk "$SDK" --tool kome --output "$RUNNER_TEMP/signing-tools"
+      - name: Authorize Kome and save the verified signing identity
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SIGNING_SETUP_TOKEN: ${{ secrets.SIGNING_SETUP_TOKEN }}
+          MSIGN_SETUP_KEYPAIR_B64: ${{ secrets.MSIGN_SETUP_KEYPAIR_B64 }}
+          APP_RELEASE_ENABLED: ${{ vars.APP_RELEASE_ENABLED }}
+          HELPER: ${{ steps.sdk.outputs.helper }}
+          BUILD_RUN: ${{ inputs.build_run_id }}
+          SETUP_REPOSITORY: ${{ github.repository }}
+          SETUP_BRANCH: ${{ github.event.repository.default_branch }}
+        run: |
+          python3 "$(dirname "$HELPER")/signing-setup.py" \
+            --repository "$SETUP_REPOSITORY" \
+            --environment app-release \
+            --reviewer-team 17892808 \
+            --branch "$SETUP_BRANCH" \
+            --package-id org.mochios.edit \
+            --developer-id 019f9e5ac6687902b0e72fe53abfbef1 \
+            --build-run "$BUILD_RUN" \
+            --build-workflow .github/workflows/package.yml \
+            --sdk-ref 0f8585fc13691383bebe304633dae8bced8443d1 \
+            --artifacts "$RUNNER_TEMP/unsigned-build" \
+            --tools "$RUNNER_TEMP/signing-tools/release"

BUILDING.md

@@ -19,12 +19,35 @@ been enabled, waits for approval in the `app-release` Environment. That
 environment is restricted to the default branch and reviewed by
 `mochiOS/application-maintainers`.
 
-Publication is initially disabled. Before setting the repository variable
-`APP_RELEASE_ENABLED=true`, configure these Environment values:
+Publication is initially disabled. Initialize the identity on Actions before
+setting the repository variable `APP_RELEASE_ENABLED=true`:
 
-* Secret `MSIGN_CERTIFICATE_B64`: base64 of the issued app Developer Certificate file.
-* Secret `MSIGN_PRIVATE_KEY_B64`: base64 of its corresponding private-key file.
-* Variable `MSIGN_ROOT_PUBLIC_KEY_B64`: base64 of the trusted issuer public-key file.
+1. Merge the reviewed workflow changes and wait for the main-branch package run
+   to succeed. Copy its run ID from the Actions URL. PR artifacts are refused.
+2. Create a short-lived fine-grained PAT with only Edit.app selected and
+   Environments read/write. Save it in the `app-release` Environment as
+   `SIGNING_SETUP_TOKEN`. Do not paste the token into workflow inputs or logs.
+3. Run **Initialize Edit signing** on `main`, supplying the successful build run
+   ID. The existing `application-maintainers` protection requires approval.
+4. Open the running **Authorize Kome and save the verified signing identity**
+   step. Follow its public device-login URL in a browser and authorize the
+   official mochiOS Developer. No account tokens are copied into GitHub inputs.
+5. After the workflow succeeds, revoke the temporary PAT in GitHub settings.
+   The workflow deletes its `SIGNING_SETUP_TOKEN` Secret, but this alone does
+   not revoke the PAT itself.
+
+The workflow generates Edit's key on the ephemeral hosted runner, obtains an
+exact-package Developer Certificate and verifies a signed copy of the selected
+MPKG. It atomically saves `MSIGN_IDENTITY_B64` (certificate, private key and
+issuer public key) as one Environment Secret. It never uploads credential files,
+publishes a release, enables publication, or checks out application code.
+
+An encrypted `MSIGN_SETUP_KEYPAIR_B64` recovery Secret is retained if issuance
+fails, so the next approved attempt reuses the same key. On success it is
+removed. Existing production credentials are never silently overwritten;
+rotation requires a separate explicit procedure. Temporary CLI sessions are
+logged out and runner credential files are cleaned. Neither Root nor
+Intermediate private keys are needed by this workflow.
 
 Do not commit key files or use development fixture identities. The approval job
 does not check out or run application code. It checks the build's source commit,