fix(packaging): scope CloudKit provisioning to the signing team - #3461
Merged
Conversation
Extract the profile-selection repair from #3372 and derive app groups from the resolved bundle ID. Co-authored-by: Juanito <krazybean@gmail.com>
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
clawsweeper
Bot
added
P2
|
Codex review: needs maintainer review before merge. Reviewed September 6, 2026, 11:46 PM ET / September 7, 2026, 03:46 UTC. ClawSweeper reviewWhat this changesRestrict bundled CloudKit provisioning to upstream-team release signing, preserve app/widget groups, and add configuration-matrix tests and packaging documentation. Merge readiness✅ Ready for maintainer review The repair remains necessary on current main and v0.56.7. No introduced correctness defect was found in this narrowly scoped, owner-authored PR. Priority: P2 Review scores
Verification
How this fits togetherCodexBar’s packaging script turns build configuration and signing-team settings into app/widget entitlements and a signed application. The resulting CloudKit entitlement controls whether the app can initialize iCloud sync. flowchart TD
A[Build configuration] --> C[Packaging script]
B[Resolved signing team] --> C
C --> D[Matching app and widget groups]
C --> E{Upstream identity release?}
E -->|Yes| F[Embed profile and CloudKit entitlements]
E -->|No| G[Package without CloudKit access]
F --> H[Signed application]
G --> H
Before mergeNone. Agent review detailsSecurityNone. Review metrics
Technical reviewBest possible solution: Keep provisioning tied to its authorized team while preserving existing app groups and signing safeguards; handle automatic identity discovery separately. Do we have a high-confidence way to reproduce the issue? Yes, at source level: an alternate APP_TEAM_ID with identity/release packaging still enters main’s upstream-profile gate and fails when that profile is absent. Native signing and launch were not executed. Is this the best way to solve the issue? Yes. Adding the team condition at the shared entitlement/profile selection point is a narrow repair, and the group-expression simplification preserves both supported bundle IDs. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning medium; reviewed against 49f2dc916919. LabelsLabel changes:
Label justifications:
EvidenceWhat I checked:
Likely related people:
Rating scale
Overall follows the weaker of proof and patch quality. Workflow
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Packaging embeds the upstream Developer ID provisioning profile and CloudKit entitlements for every identity-signed release, even when APP_TEAM_ID has already been resolved to another team. That can require or embed a profile that does not authorize the selected team's app.
Restrict the bundled profile and CloudKit entitlements to the upstream team. Derive the shared app/widget group directly from the resolved bundle ID, removing duplicated debug suffix handling. Net production delta: -3 lines in package_app.sh.
Extracted the profile-selection repair from #3372, with @krazybean's contributor credit preserved. Direct APP_IDENTITY calls without a matching resolved APP_TEAM_ID remain a separate scope; this does not claim complete alternate-identity discovery. Required widget builds, timestamping, hardened runtime, signature verification and sandbox smoke checks remain enforced.
Validation:
make checkpassed. Isolated P2 autoreview found no actionable findings.The source regression is traceable to the unscoped CloudKit gate added in #2597. Changelog and packaging documentation describe the repaired team boundary.