[GH-ISSUE #735] feat(signing): Phase 3 certificate lifecycle, keychain install, and hardening #199

New issue

Closed

opened 2026-02-26 21:33:59 +03:00 by kerem · 1 comment

kerem commented

2026-02-26 21:33:59 +03:00

Owner

Originally created by @rudrankriyam on GitHub (Feb 23, 2026).
Original GitHub issue: https://github.com/rudrankriyam/App-Store-Connect-CLI/issues/735

Depends on

#PHASE2

Problem

After profile write-back exists, the major remaining gap with fastlane match is certificate/private-key lifecycle and local code-signing install ergonomics.

Phase 3 Goal

Add certificate lifecycle + local keychain install flows needed for practical daily usage and CI reliability.

Proposed CLI Surface (Phase 3)

Enhance asc signing sync and add focused helpers:

# Optional certificate creation path when missing
asc signing sync \
  --bundle-id com.example.app \
  --profile-type IOS_APP_STORE \
  --git-url "git@github.com:org/signing.git" \
  --create-missing \
  --create-missing-certificate \
  --passphrase-env ASC_SIGNING_PASSPHRASE

# Import certificate material into signing store
asc signing import \
  --certificate ./cert.cer \
  --p12 ./cert.p12 \
  --profile ./profile.mobileprovision \
  --git-url "git@github.com:org/signing.git" \
  --passphrase-env ASC_SIGNING_PASSPHRASE

Optional local install flags:

--install-certificates
--keychain-name
--keychain-password
--skip-set-partition-list

Scope

Certificate lifecycle support in sync flow (create/select when required).
Secure handling of .cer + .p12 material in encrypted store.
Local keychain import/install path for macOS.
Import command for existing cert/profile material into store.
Reliability hardening (idempotence, retries, conflict/error surfacing).

Implementation Notes

Reuse existing certificates csr generate where appropriate.
Keep key material out of logs and stdout.
Maintain strict non-interactive behavior.
Validate API-facing flags against current OpenAPI schemas before shipping.

Test Plan (TDD)

Certificate lifecycle tests:
- missing certificate paths
- create/select behavior
Import tests:
- valid/invalid cert+p12+profile combinations
- secure path handling and overwrite protections
Keychain install tests:
- macOS success path
- non-macOS graceful behavior
Regression tests:
- repeated runs are idempotent
- deterministic outputs and commit artifacts

Always run:

make format
make lint
ASC_BYPASS_KEYCHAIN=1 make test

Acceptance Criteria

Certificate lifecycle paths are implemented and documented.
Import flow for existing signing materials is available.
Optional local keychain install works on macOS with clear flags.
Security and idempotence expectations are test-covered.
Tests and lint/format pass.

Out of Scope (future)

Multi-backend storage parity (S3/GCS/GitLab).
Full nuke/password-rotation/migrate parity command set.

Originally created by @rudrankriyam on GitHub (Feb 23, 2026). Original GitHub issue: https://github.com/rudrankriyam/App-Store-Connect-CLI/issues/735 ## Depends on - #PHASE2 ## Problem After profile write-back exists, the major remaining gap with `fastlane match` is certificate/private-key lifecycle and local code-signing install ergonomics. ## Phase 3 Goal Add certificate lifecycle + local keychain install flows needed for practical daily usage and CI reliability. ## Proposed CLI Surface (Phase 3) Enhance `asc signing sync` and add focused helpers: ~~~bash # Optional certificate creation path when missing asc signing sync \ --bundle-id com.example.app \ --profile-type IOS_APP_STORE \ --git-url "git@github.com:org/signing.git" \ --create-missing \ --create-missing-certificate \ --passphrase-env ASC_SIGNING_PASSPHRASE # Import certificate material into signing store asc signing import \ --certificate ./cert.cer \ --p12 ./cert.p12 \ --profile ./profile.mobileprovision \ --git-url "git@github.com:org/signing.git" \ --passphrase-env ASC_SIGNING_PASSPHRASE ~~~ Optional local install flags: - `--install-certificates` - `--keychain-name` - `--keychain-password` - `--skip-set-partition-list` ## Scope 1. Certificate lifecycle support in sync flow (create/select when required). 2. Secure handling of `.cer` + `.p12` material in encrypted store. 3. Local keychain import/install path for macOS. 4. Import command for existing cert/profile material into store. 5. Reliability hardening (idempotence, retries, conflict/error surfacing). ## Implementation Notes - Reuse existing `certificates csr generate` where appropriate. - Keep key material out of logs and stdout. - Maintain strict non-interactive behavior. - Validate API-facing flags against current OpenAPI schemas before shipping. ## Test Plan (TDD) - Certificate lifecycle tests: - missing certificate paths - create/select behavior - Import tests: - valid/invalid cert+p12+profile combinations - secure path handling and overwrite protections - Keychain install tests: - macOS success path - non-macOS graceful behavior - Regression tests: - repeated runs are idempotent - deterministic outputs and commit artifacts Always run: - `make format` - `make lint` - `ASC_BYPASS_KEYCHAIN=1 make test` ## Acceptance Criteria - [ ] Certificate lifecycle paths are implemented and documented. - [ ] Import flow for existing signing materials is available. - [ ] Optional local keychain install works on macOS with clear flags. - [ ] Security and idempotence expectations are test-covered. - [ ] Tests and lint/format pass. ## Out of Scope (future) - Multi-backend storage parity (S3/GCS/GitLab). - Full `nuke`/password-rotation/migrate parity command set.

kerem

2026-02-26 21:33:59 +03:00

closed this issue
added the
enhancement
label

kerem commented

2026-02-26 21:33:59 +03:00

Author

Owner

@rudrankriyam commented on GitHub (Feb 26, 2026):

Closing for now due scope/priority. We can reopen when this work is prioritized again.

@rudrankriyam commented on GitHub (Feb 26, 2026): Closing for now due scope/priority. We can reopen when this work is prioritized again.