From 369eccd6bc7f3aed47bd6b98d4e022152f5ce7e3 Mon Sep 17 00:00:00 2001 From: Joseph Yaksich Date: Wed, 5 Aug 2026 00:56:42 +0000 Subject: [PATCH 1/2] fix(phase4): set the default keychain for the macOS runner job notarytool resolves its credential profile through the session DEFAULT keychain, but a launchd runner job has no default keychain set, so notarization failed with "No Keychain password item found for profile" even though code signing (which uses the search list) succeeded. After the hook's trust validation passes, set the dedicated account's login keychain as the default and search keychain and unlock it, on macOS only. The keychain password is read from a machine-local file owned by the runner account ($HOME/.config/1helm/mac-keychain-password); it is never committed to this repository or exported into the job environment. No sudo, no elevation. Co-Authored-By: Claude --- ops/platform-acceptance/runner-job-started.sh | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/ops/platform-acceptance/runner-job-started.sh b/ops/platform-acceptance/runner-job-started.sh index a51c0dc..b3d8c46 100755 --- a/ops/platform-acceptance/runner-job-started.sh +++ b/ops/platform-acceptance/runner-job-started.sh @@ -30,3 +30,22 @@ if not ( ): raise SystemExit("Phase 4 runner refused an untrusted repository/ref/SHA/CI event.") PY + +# macOS only: prepare the dedicated signing account's login keychain for this +# now-validated, trusted job. Code signing resolves its identity through the +# keychain search list, but notarytool resolves its credential profile through +# the session DEFAULT keychain, and a launchd runner job otherwise has no +# default keychain, so notarization fails with "No Keychain password item +# found". Set login as the default (and search) keychain and unlock it. The +# password is read from a machine-local file owned by the runner account; it is +# never stored in this repository or exported into the job environment. +if [[ "$(uname)" == "Darwin" ]]; then + kc="$HOME/Library/Keychains/login.keychain-db" + kc_pw_file="$HOME/.config/1helm/mac-keychain-password" + if [[ -f "$kc" && -r "$kc_pw_file" ]]; then + security list-keychains -d user -s "$kc" /Library/Keychains/System.keychain >/dev/null 2>&1 || true + security default-keychain -d user -s "$kc" >/dev/null 2>&1 || true + security set-keychain-settings "$kc" >/dev/null 2>&1 || true + security unlock-keychain -p "$(cat "$kc_pw_file")" "$kc" >/dev/null 2>&1 || true + fi +fi From 553e9acdc07a9aa13bb05f38e991f43a6de3bde1 Mon Sep 17 00:00:00 2001 From: Joseph Yaksich Date: Wed, 5 Aug 2026 00:38:24 +0000 Subject: [PATCH 2/2] fix(phase4): read the root-owned OCI image store with sudo in Linux acceptance MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The retained channel-image verification checked /var/lib/1helm-oci-v1/shared-images/sha256/ without sudo, but install-oci-runtime.sh creates that store root-owned and mode 0700. The ordinary runner user cannot traverse it, so the `[[ -d ... && sha256 ... ]]` assertion always failed after an otherwise successful clean install — the exact silent failure the new ERR trap pinpointed at this line. The adjacent state checks already use sudo; this one was the outlier. Run the directory test and the image digest read under sudo, matching the store's ownership. No product change; acceptance-script only. Co-Authored-By: Claude --- ops/platform-acceptance/linux.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/ops/platform-acceptance/linux.sh b/ops/platform-acceptance/linux.sh index d53579b..0138c3a 100755 --- a/ops/platform-acceptance/linux.sh +++ b/ops/platform-acceptance/linux.sh @@ -72,7 +72,8 @@ sudo systemctl is-active --quiet 1helm.service curl -fsS http://127.0.0.1:8123/api/setup/status >"$work/clean-health.json" [[ "$(readlink -f /opt/1helm/current)" == "/opt/1helm/releases/$VERSION-$OFFLINE_DIGEST" ]] RETAINED_IMAGE="/var/lib/1helm-oci-v1/shared-images/sha256/$IMAGE_DIGEST" -[[ -d "$RETAINED_IMAGE" && "$(find "$RETAINED_IMAGE" -maxdepth 1 -type f -name '*.oci.tar' -exec sha256sum {} \; | awk '{print $1}')" == "$IMAGE_DIGEST" ]] +sudo test -d "$RETAINED_IMAGE" +[[ "$(sudo find "$RETAINED_IMAGE" -maxdepth 1 -type f -name '*.oci.tar' -exec sha256sum {} \; | awk '{print $1}')" == "$IMAGE_DIGEST" ]] # Resolve the newest immutable public Stable release distinct from this # candidate version. Candidate versions normally remain unchanged during @@ -140,7 +141,8 @@ sudo systemctl is-active --quiet 1helm.service curl -fsS http://127.0.0.1:8123/api/setup/status >"$work/rollback-health.json" STATE_AFTER="$(sudo sha256sum "$MARKER" | awk '{print $1}')" [[ "$STATE_BEFORE" == "$STATE_AFTER" ]] -[[ -d "$RETAINED_IMAGE" && "$(find "$RETAINED_IMAGE" -maxdepth 1 -type f -name '*.oci.tar' -exec sha256sum {} \; | awk '{print $1}')" == "$IMAGE_DIGEST" ]] +sudo test -d "$RETAINED_IMAGE" +[[ "$(sudo find "$RETAINED_IMAGE" -maxdepth 1 -type f -name '*.oci.tar' -exec sha256sum {} \; | awk '{print $1}')" == "$IMAGE_DIGEST" ]] sudo rm -rf -- "$FAILURE_RELEASE" export HELM_PREVIOUS_VERSION="$PREVIOUS_VERSION"