From beb7ef790e9f05d7b87670d64b39b5c0aca88161 Mon Sep 17 00:00:00 2001
From: Micah Alpern <malpern@gmail.com>
Date: Sat, 24 Oct 2026 08:28:34 -0700
Subject: [PATCH] Use validated App Store Connect key for notarization

---
 Scripts/lib/signing.sh          | 4 ++--
 Scripts/release-candidate.sh    | 2 +-
 docs/process/release-process.md | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Scripts/lib/signing.sh b/Scripts/lib/signing.sh
index 612b77dc3..9ee3facdf 100644
--- a/Scripts/lib/signing.sh
+++ b/Scripts/lib/signing.sh
@@ -19,8 +19,8 @@ KP_NOTARY_WAIT_TIMEOUT=${KP_NOTARY_WAIT_TIMEOUT:-15m}
 # the ~9 minute build, and submit failed with "No Keychain password item
 # found"). The file-based API key has no lock-state dependency. The key id and
 # issuer are identifiers, not secrets.
-KP_NOTARY_DEFAULT_KEY_PATH=${KP_NOTARY_DEFAULT_KEY_PATH:-"$HOME/.appstoreconnect/private_keys/AuthKey_XQ4565NYZ7.p8"}
-KP_NOTARY_DEFAULT_KEY_ID=${KP_NOTARY_DEFAULT_KEY_ID:-XQ4565NYZ7}
+KP_NOTARY_DEFAULT_KEY_PATH=${KP_NOTARY_DEFAULT_KEY_PATH:-"$HOME/.appstoreconnect/private_keys/AuthKey_62KY64SQQB.p8"}
+KP_NOTARY_DEFAULT_KEY_ID=${KP_NOTARY_DEFAULT_KEY_ID:-62KY64SQQB}
 KP_NOTARY_DEFAULT_ISSUER=${KP_NOTARY_DEFAULT_ISSUER:-60b8eb46-ca64-4580-a43b-850d92fcc7ab}
 
 # Opt release scripts into the API key when the key file exists and no auth was
diff --git a/Scripts/release-candidate.sh b/Scripts/release-candidate.sh
index 0a3cb5eaa..cced74284 100755
--- a/Scripts/release-candidate.sh
+++ b/Scripts/release-candidate.sh
@@ -43,7 +43,7 @@ Environment:
   NOTARY_PROFILE      notarytool keychain profile override.
   KP_NOTARY_KEY_PATH / KP_NOTARY_KEY_ID / KP_NOTARY_ISSUER
                       App Store Connect API key for notarytool. Defaults to
-                      ~/.appstoreconnect/private_keys/AuthKey_XQ4565NYZ7.p8
+                      ~/.appstoreconnect/private_keys/AuthKey_62KY64SQQB.p8
                       when that file exists; set KP_NOTARY_AUTH=keychain-profile
                       to force keychain-profile auth instead.
   KP_NOTARY_WAIT_TIMEOUT
diff --git a/docs/process/release-process.md b/docs/process/release-process.md
index 6949f4c82..70159c723 100644
--- a/docs/process/release-process.md
+++ b/docs/process/release-process.md
@@ -111,7 +111,7 @@ changes the cdhash and permanently detaches the installed app from its ticket.
 whenever notarization was requested.
 
 Notarization credentials: the scripts prefer the file-based App Store Connect
-API key (`~/.appstoreconnect/private_keys/AuthKey_XQ4565NYZ7.p8`, overridable
+API key (`~/.appstoreconnect/private_keys/AuthKey_62KY64SQQB.p8`, overridable
 via `KP_NOTARY_KEY_PATH`/`KP_NOTARY_KEY_ID`/`KP_NOTARY_ISSUER`) over the
 `KeyPath-Profile` keychain profile. notarytool stores profiles in the
 data-protection keychain, which becomes unreadable when the login session