From 7ca2265e56ed38906322b9956d51ab0dfd622742 Mon Sep 17 00:00:00 2001 From: TheCryptoDonkey Date: Thu, 22 Oct 2026 20:10:24 +0100 Subject: [PATCH] docs: describe the macOS signing identity without naming its holder --- docs/MACOS-SIGNING-2026-10-06.md | 2 +- docs/evidence/macos-signing-2026-10-06/aarch64.json | 4 ++-- docs/evidence/macos-signing-2026-10-06/x64.json | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/MACOS-SIGNING-2026-10-06.md b/docs/MACOS-SIGNING-2026-10-06.md index a28d1ab..1d853fa 100644 --- a/docs/MACOS-SIGNING-2026-10-06.md +++ b/docs/MACOS-SIGNING-2026-10-06.md @@ -18,7 +18,7 @@ The inputs are the public DMGs built by installer workflow `37460450117` from `95185d73339a6ec372c1ad0cbac1b74e48743e32` has the same source tree. Signing and stapling modify the package bytes; the output hashes below identify the candidates. -Identity: `Developer ID Application: Epona Solutions Ltd (2GLP954N6A)`. +Identity: `Developer ID Application (the project's Apple certificate)`. Existing Keychain credentials were used without exporting private keys or reading passwords into the process environment, chat or logs. diff --git a/docs/evidence/macos-signing-2026-10-06/aarch64.json b/docs/evidence/macos-signing-2026-10-06/aarch64.json index a838b84..82d2349 100644 --- a/docs/evidence/macos-signing-2026-10-06/aarch64.json +++ b/docs/evidence/macos-signing-2026-10-06/aarch64.json @@ -3,8 +3,8 @@ "input": "Wildbloom.Node_0.3.3_aarch64.dmg", "input_sha256": "07bdca42e6f3391a1b66518639d9de5f86958b4afb1169ba5fb55fcacd952a9a", "source_commit": "39e46f4d5802d8660ce1617956cf5ae9b6200e11", - "signing_identity": "Developer ID Application: Epona Solutions Ltd (2GLP954N6A)", - "team_id": "2GLP954N6A", + "signing_identity": "Developer ID Application (the project's Apple certificate)", + "team_id": "(withheld)", "started_at": "2026-10-06T13:25:47.648949+00:00", "script_sha256": "381751094824a71886a3a896c00bbfb235c3aac92eeb8c21399c15fd858031ec", "passed": true, diff --git a/docs/evidence/macos-signing-2026-10-06/x64.json b/docs/evidence/macos-signing-2026-10-06/x64.json index 124762b..bb6a426 100644 --- a/docs/evidence/macos-signing-2026-10-06/x64.json +++ b/docs/evidence/macos-signing-2026-10-06/x64.json @@ -3,8 +3,8 @@ "input": "Wildbloom.Node_0.3.3_x64.dmg", "input_sha256": "e4bff7c9118e53db4a681f1565396e89e3c98615de7e214aa13f62c313cf3c64", "source_commit": "39e46f4d5802d8660ce1617956cf5ae9b6200e11", - "signing_identity": "Developer ID Application: Epona Solutions Ltd (2GLP954N6A)", - "team_id": "2GLP954N6A", + "signing_identity": "Developer ID Application (the project's Apple certificate)", + "team_id": "(withheld)", "started_at": "2026-10-06T15:28:19.328629+00:00", "script_sha256": "381751094824a71886a3a896c00bbfb235c3aac92eeb8c21399c15fd858031ec", "passed": true,