Use the Developer ID distribution team

.github/workflows/release.yml

@@ -86,7 +86,7 @@ jobs:
           for value in APPLICATION_P12 APPLICATION_PASSWORD INSTALLER_P12 INSTALLER_PASSWORD TEAM_ID; do
             test -n "${!value}"
           done
-          test "$TEAM_ID" = "9K594G5QQ8"
+          test "$TEAM_ID" = "4NGTWD262W"
 
           keychain="$RUNNER_TEMP/resizelint-signing.keychain-db"
           keychain_password=$(uuidgen)

Docs/ReleasePreparation.md

@@ -23,8 +23,9 @@ issue, chat, commit, or workflow log:
 - `RESIZELINT_TEAM_ID`
 
 The certificate and private-key values are base64-encoded files. The Team ID is
-validated against `9K594G5QQ8`. Credentials are imported into an ephemeral
-keychain and removed even when the workflow fails.
+validated against the Developer ID distribution team `4NGTWD262W`. Credentials
+are imported into an ephemeral keychain and removed even when the workflow
+fails.
 
 ## Release behavior
 
@@ -49,6 +50,6 @@ Run the non-mutating readiness check before a release:
 Scripts/release/verify-signing-readiness.sh
 ```
 
-It requires both Developer ID certificate types for Team `9K594G5QQ8` and an
+It requires both Developer ID certificate types for Team `4NGTWD262W` and an
 available `notarytool`. Missing identities block signing and notarization, but
 do not invalidate unsigned local engineering verification.

Docs/Verification.md

@@ -35,11 +35,11 @@ fix behavior. The detailed defensive assessment is in the
 - The composite Action consumer fixture passed, and both workflows passed
   actionlint 1.7.12.
 
-The local machine did not contain Developer ID Application or Developer ID
-Installer identities for Team `9K594G5QQ8`. The unsigned artifacts are
-engineering evidence only: signature, notarization, stapling, Gatekeeper
-acceptance, and distribution remain blocked until the owner installs the
-certificates and explicitly starts the protected release process.
+The local signing-readiness check finds Developer ID Application and Developer
+ID Installer identities for distribution Team `4NGTWD262W`. General engineering
+tests do not use private signing credentials; signature, notarization, stapling,
+and Gatekeeper evidence must come from the explicitly approved protected release
+workflow.
 
 ## Precision, performance, and interface evidence
 

Formula/resizelint.rb

@@ -2,7 +2,7 @@ class Resizelint < Formula
   desc "Static analysis for Swift apps that need to work in every window size"
   homepage "https://github.com/mikonyaa/ResizeLint"
   url "https://github.com/mikonyaa/ResizeLint/releases/download/1.0.0/ResizeLint-1.0.0-source.tar.gz"
-  sha256 "4cea87f9dcc2e418f97cd3b4f5c2ac8d66f817b3a74962d92e8cef4f7328f173"
+  sha256 "d9388896fb241af065ea44422364626ac30632f7f2ff5d0747acf2dad55b2bd0"
   license "MIT"
 
   depends_on "swift" => :build

Scripts/ci/test-signing-identity-resolution.sh

@@ -21,25 +21,28 @@ case "${1:-}" in
     awk 'BEGIN { for (i = 0; i < 20000; i++) print "identity detail " i }'
     ;;
   find-certificate)
+    output_mode=default
     for argument in "$@"; do
       case "$argument" in
         -p)
-          printf '%s\n' \
-            '-----BEGIN CERTIFICATE-----' \
-            'ZmFrZQ==' \
-            '-----END CERTIFICATE-----'
-          exit 0
+          output_mode=pem
           ;;
         -Z)
-          printf '%s\n' \
-            'SHA-256 hash: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB' \
-            'SHA-1 hash: CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC'
-          awk 'BEGIN { for (i = 0; i < 20000; i++) print "certificate detail " i }'
-          exit 0
+          output_mode=hash
           ;;
       esac
     done
-    exit 64
+    if [[ "$output_mode" == hash ]]; then
+      printf '%s\n' \
+        'SHA-256 hash: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB' \
+        'SHA-1 hash: CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC'
+      awk 'BEGIN { for (i = 0; i < 20000; i++) print "certificate detail " i }'
+    else
+      printf '%s\n' \
+        '-----BEGIN CERTIFICATE-----' \
+        'ZmFrZQ==' \
+        '-----END CERTIFICATE-----'
+    fi
     ;;
   *)
     exit 65
@@ -57,8 +60,16 @@ printf 'subject=CN = Developer ID Installer: Example (%s), OU = %s\n' "$FAKE_TEA
 EOF
 chmod 0755 "$fake_bin/openssl"
 
+cat > "$fake_bin/xcrun" <<'EOF'
+#!/usr/bin/env bash
+
+set -euo pipefail
+[[ "${1:-}" == notarytool && "${2:-}" == --help ]]
+EOF
+chmod 0755 "$fake_bin/xcrun"
+
 resolver="$repository_root/Scripts/release/resolve-signing-identities.sh"
-team_id=9K594G5QQ8
+team_id=4NGTWD262W
 output=$(FAKE_TEAM_ID="$team_id" PATH="$fake_bin:$PATH" "$resolver" test.keychain "$team_id")
 
 test "$(printf '%s\n' "$output" | sed -n '1p')" = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
@@ -72,4 +83,16 @@ if FAKE_TEAM_ID="$team_id" FAKE_APPLICATION_TEAM_ID=WRONGTEAM PATH="$fake_bin:$P
 fi
 grep -q "does not belong to team WRONGTEAM" "$temporary_root/wrong-team.err"
 
+distribution_team_id=4NGTWD262W
+if ! readiness_output=$(
+  FAKE_TEAM_ID="$distribution_team_id" PATH="$fake_bin:$PATH" \
+    "$repository_root/Scripts/release/verify-signing-readiness.sh"
+); then
+  echo "Signing readiness rejected distribution team $distribution_team_id" >&2
+  exit 1
+fi
+grep -q "Developer ID Application ($distribution_team_id): ready" <<<"$readiness_output"
+grep -q "Developer ID Installer ($distribution_team_id): ready" <<<"$readiness_output"
+grep -q "notarytool: available" <<<"$readiness_output"
+
 echo "Signing identity resolution test passed."

Scripts/release/notarize.sh

@@ -3,7 +3,7 @@
 set -euo pipefail
 
 artifact=${1:-}
-profile=${RESIZELINT_NOTARY_PROFILE:-ResizeLintNotary-9K594G5QQ8}
+profile=${RESIZELINT_NOTARY_PROFILE:-ResizeLintNotary-4NGTWD262W}
 
 if [[ -z "$artifact" || ! -f "$artifact" ]]; then
   echo "Usage: $0 <signed-zip-or-package>" >&2

Scripts/release/verify-signing-readiness.sh

@@ -2,19 +2,19 @@
 
 set -euo pipefail
 
-team_id=9K594G5QQ8
+team_id=4NGTWD262W
 application_ready=0
 installer_ready=0
 tool_ready=0
 
-if security find-identity -v -p codesigning 2>/dev/null \
-  | grep -E -q "Developer ID Application:.*\\($team_id\\)"; then
+application_listing=$(security find-identity -v -p codesigning 2>/dev/null || true)
+if grep -E -q "Developer ID Application:.*\\($team_id\\)" <<<"$application_listing"; then
   application_ready=1
 fi
 
-if security find-certificate -a -c "Developer ID Installer" 2>/dev/null \
-  | openssl x509 -inform pem -noout -subject 2>/dev/null \
-  | grep -q "$team_id"; then
+installer_pem=$(security find-certificate -a -c "Developer ID Installer" -p 2>/dev/null || true)
+installer_subject=$(openssl x509 -inform pem -noout -subject <<<"$installer_pem" 2>/dev/null || true)
+if [[ "$installer_subject" == *"$team_id"* ]]; then
   installer_ready=1
 fi