Dashboard › spotlight › Distillation
d18668da-7c7c-4b44-b0c8-2d64a2b8684a["bf38116e89a44f49fc4ad72e56243944","c0d7f572a2b14e378ab1110bcd10b020","e24aaf2921b466f4d5b285a79a587e14","e4543b2a582e951c6620911ae61559c3","1f946ff2781d94a35d3b99148fa9e5eb","5302f5581015f9adc14f6b4898efe422","533737c8db19fcb055ee7923a9f42b6e","d271fc94d8a98baeca586d768a63eaba","7aab5e86cb1448539b1be308d7591172","955f9b6ca465f513d547ba9ff9c616d7","6b0a5fc8da00bec74a396ddcf8ef70c9","55fb9fcb17eb1c0cf86304fb67d25190","8fc89b94aa0dfcde55b09a3c2c18b0bd","a0592d67786fbc29bebbfa7ff74430cf","1299106b96c22b66e7d973bcc664dca0","d50d66113eef684c99dac97762a29e51","a9e5d23cc7b77de0a5e67320e69340a6","68322b23905f43dafd9921a86d5f5bbe","4bee2ecbcc06f0a895a08957da403cd5","66b489654dfd09662c8a141f780a870e","e4db3d7fae0488b6c201770aa4a7ad27","46c10956f5b5e6f8c8de5093750ca325","cadf4483370fa510295422e479aa9e90","457a41d64d6de45f0eae2abbd6e33102","e94a2cef542b0b00af7cebfb7a651eb6","e3121563023240ee5f8d2048a27ae902","793daa6ccf62f24c09a7257a264fd5bf","d74dc7b94548d2a95a20652a8d4a26e5","4b81394852cdf19a0b897b052b10d028","22bc4834d0efd51836d71bba6b659383","effc510994a0e2c2ab4b5e0e673b106b","f4f2d7d15ad92cf5fb4c5e9b71890e29","1f672ea0e858890553d678adb81f0ae2","1186e60a3ed7506e89150af7d263855d","283c67f627fe974cd0f271624214f89a","30bdc6f7cc268fa1d3cf14c192d166d5","217d57fcfa46cd9d3f68985c15d8f8fa","0f42e741a44333595e374f80004f8c4a","ca39f4f42d1d7e1d6aaacdefcabf7e70","2bea4feda58c7221c76a9b7c209cbad6","b20298d011c468f8689fd51533a2fb2b","7ea5ac232d8b798dfa03a53d4f017af1","e8116e80b19f3edceb86593ca3439749","864581c2cd436ce91f27cdbdc4fb96d1","f20711fc7f0aed1f764328f43ca19321","93b0f9c4574526d8e97d0817793702ab","4366f09985bde3f7d80e837a645965b7"]
fold output runs directly into -----END----- line unless an explicit blank line/newline is inserted before END. Fix: { echo "-----BEGIN PRIVATE KEY-----"; fold -w 64 <body>; echo; echo "-----END PRIVATE KEY-----"; } — verified both v1 and v2 forms work; idempotency for already-armored input handled via grep -q "BEGIN PRIVATE KEY" guard.APPLE_API_KEY secret's private_key is stored as raw base64 DER body with no PEM armor (one long unwrapped line), and cat /tmp/apple_key.json | jq .private_key -r > /tmp/apple_key.pem writes it verbatim; openssl pkey refuses unarmored input.Error: inv...; electron-builder 24's bundled @electron/notarize@2.2.1 does raw JSON.parse on that error text and throws a masking SyntaxError. Ruled out file permissions — same .pem path notarized fine a month prior.build.yml (build job line 84, electron-mac job line 391), idempotent for bare or already-armored input, requires blank line between folded body and END line. (2) Secondary (user's pick, deferred) — bump electron-builder ^24.13.3 → ^26.15.7 (pulls @electron/notarize@2.5.0 which surfaces Apple's real error instead of SyntaxError; @electron/osx-sign@1.3.3 is CJS-safe, avoids old 1.0.5 breakage). Noted this alone would not fix the failure, only make errors legible.scripts/notarize.cjs is dead code — electron-builder notarizes internally and never calls it..opencode/plans/1784633071030-cosmic-engine.md; key file ~/k.txt securely deleted and decoded temp files cleaned up..opencode/plans/1784633071030-cosmic-engine.md and instructed assistant to execute it.build.yml lines 76-95 read for context: line 83 decodes APPLE_API_KEY secret to /tmp/apple_key.json, line 84 was cat /tmp/apple_key.json | jq .private_key -r > /tmp/apple_key.pem, lines 85-88 export APPLE_API_KEY_ISSUER_ID, APPLE_API_KEY_ID, APPLE_API_KEY_P8_PATH, APPLE_API_KEY_PATH env vars..github/workflows/build.yml (build job ~line 84, electron-mac job ~line 391): replaced bare jq .private_key extraction with a conditional block — KEY_BODY="$(jq -r .private_key /tmp/apple_key.json)"; if it already contains BEGIN PRIVATE KEY, pass through unchanged; else wrap with -----BEGIN/END PRIVATE KEY----- armor, stripping spaces/CR/LF via tr -d ' \r\n' and folding at 64 columns via fold -w 64, with blank line before END. Diff: 2 files changed (build.yml, .lore.md), 24 insertions, 2 deletions. YAML validity confirmed ("YAML OK")..opencode/ directory and packages/website/content.config.ts are intentionally excluded from commits; .lore.md is always staged with git add .lore.md per established convention.origin/main (main updated 594a50a0..406d7292), replacing prior branch security/deps-js-yaml-babel; new branch tracks origin/fix/notarize-key-pem-armor.86074143 — "fix(ci): armor Apple API key as PEM for Xcode 26 notarytool", 2 files changed, 24 insertions(+), 2 deletions(-). Pushed to origin/fix/notarize-key-pem-armor.electron-mac job only runs on push to main/release/*, so CI on the PR itself won't exercise the notarization path — real proof comes after merge to main (should reach "notarization successful" for both x64 and arm64). Alternative de-risk option offered: temporarily re-store APPLE_API_KEY secret as fully-armored PEM (not required).