The pin added earlier read the local keychain unconditionally, which was right
for publish.sh and wrong for release-macos.yml: on CI the cert arrives as a
base64 .p12 in CSC_LINK and electron-builder imports it into a temporary
keychain LATER than this preflight runs, so the probe would have found nothing
and aborted every CI mac build before it started. Fixed by branching on where
the cert actually comes from -- keychain locally, the .p12 itself on CI -- and
running the profile check against whichever cert that resolves to, since both
sources can drift from the embedded profile.
Verified with controls on both paths: the .p12 reader returns the true SHA-1 of
a synthetic cert and returns nothing (rather than a bogus hash) under a wrong
password, and the local path still passes against the live cert and profile.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014wtspwSFzZmjCx9UNPAorQ
find-identity reports five entries all named "Developer ID Application: Haik
Decie (Y26NUZH4NG)": one live cert and four copies of the one whose private key
died with the old Mac. The dead copies still report valid and only fail at the
moment they are asked to sign, so auto-discovery was a coin flip between a real
build and a crash forty minutes into packing a 4.8 GB .app. Pin by SHA-1, then
spend one scratch signature proving the key is actually usable.
The profile check is the same lesson applied to a quieter failure. entitlements
request keychain-access-groups, which macOS honors only when the embedded
profile lists the very cert that signed the app. A profile issued for the
previous cert signs without one complaint and then loses passkeys and Touch ID
at runtime: a green build that ships broken. Verified with both controls, the
old profile fails against the new cert and passes against its own.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014wtspwSFzZmjCx9UNPAorQ
- Bundle uv/uvx universal binaries in backend/uv-bin/ (downloaded during build)
- tools_lib: _extra_bin_dirs and _resolve_command check uv-bin/ for uvx
- build-app.sh: auto-download uv for both architectures, create universal binary
- run.sh: auto-download uv for dev mode on first run
- Removed google-workspace-mcp from requirements.txt (dependency conflict with langchain
