@omega.js/desktop 0.50.0 → 0.51.0

package/dist/test/suites/build/url-helpers.test.js

@@ -69,14 +69,15 @@ const NO_ENV = {
 module.exports = defineCases({
   type: 'group', // independent tests; run all even on failure
   layer: 'build',
-  description: 'utils/url-helpers: every local helper resolves env → baked dev.ports → classic',
+  description: 'utils/url-helpers: every local helper resolves env, then the baked dev.ports, then throws',
   tests: [
     {
-      name: 'exports { attachTo, getApiUrl, localPort }',
+      name: 'exports { attachTo, getApiUrl, localPort, requiredPort }',
       run: (ctx) => {
         ctx.expect(typeof helpers.attachTo).toBe('function');
         ctx.expect(typeof helpers.getApiUrl).toBe('function');
         ctx.expect(typeof helpers.localPort).toBe('function');
+        ctx.expect(typeof helpers.requiredPort).toBe('function');
       },
     },
     {
@@ -107,11 +108,19 @@ module.exports = defineCases({
       },
     },
     {
-      name: 'neither channel → the classic hosting port 5002',
+      // The classic 5002 used to answer here (#834). It is gone: a dev build
+      // always bakes the resolved map, so neither channel answering means the
+      // artifact is broken, and a wrong API base is a silent connection refusal
+      // or a hit on a neighbouring project's stack.
+      name: 'neither channel → a throw naming the port and the bundle task',
       run: (ctx) => {
         withEnv(NO_ENV, () => {
-          ctx.expect(helpers.getApiUrl.call(fakeManager('testing'))).toBe('http://localhost:5002');
-          ctx.expect(helpers.getApiUrl.call(fakeManager('development'))).toBe('http://localhost:5002');
+          for (const environment of ['testing', 'development']) {
+            ctx.expect(() => helpers.getApiUrl.call(fakeManager(environment)))
+              .toThrow(/dev port for `hosting`/);
+            ctx.expect(() => helpers.getApiUrl.call(fakeManager(environment)))
+              .toThrow(/bundle task/);
+          }
         });
       },
     },
@@ -163,11 +172,11 @@ module.exports = defineCases({
       },
     },
     {
-      name: 'getFunctionsUrl: neither channel → the classic functions port 5001',
+      name: 'getFunctionsUrl: neither channel → a throw naming the port (#834)',
       run: (ctx) => {
         withEnv(NO_ENV, () => {
-          ctx.expect(helpers.getFunctionsUrl.call(fakeManager('development')))
-            .toBe('http://localhost:5001/demo-app/us-central1');
+          ctx.expect(() => helpers.getFunctionsUrl.call(fakeManager('development')))
+            .toThrow(/dev port for `functions`/);
         });
       },
     },
@@ -200,10 +209,11 @@ module.exports = defineCases({
       },
     },
     {
-      name: 'getWebsiteUrl: neither channel → the classic dev origin https://localhost:4000',
+      name: 'getWebsiteUrl: neither channel → a throw naming the port (#834)',
       run: (ctx) => {
         withEnv(NO_ENV, () => {
-          ctx.expect(helpers.getWebsiteUrl.call(fakeManager('development'))).toBe('https://localhost:4000');
+          ctx.expect(() => helpers.getWebsiteUrl.call(fakeManager('development')))
+            .toThrow(/dev port for `website`/);
         });
       },
     },
@@ -228,12 +238,18 @@ module.exports = defineCases({
       },
     },
     {
-      // The lockstep the renderer bundle forces: url-helpers rides the browser
-      // bundle, so it cannot require @omega.js/config (fs/net/json5) and mirrors
-      // the constant instead. This Node-side case is what keeps the copy honest.
-      name: 'CLASSIC_DEV_ORIGIN is in lockstep with @omega.js/config',
+      // There is no lockstep copy to keep honest any more (#834): the classic
+      // numbers live ONLY in @omega.js/config, the bundle task bakes them into
+      // the artifact as the floor of the resolved map, and this module reads
+      // that map. A copy here would be the exact defect the issue closed.
+      name: 'no classic constants live in this module (#834)',
       run: (ctx) => {
-        ctx.expect(helpers.CLASSIC_DEV_ORIGIN).toBe(require('../../../vendor/config/index.js').CLASSIC_DEV_ORIGIN);
+        ctx.expect(helpers.CLASSIC_DEV_ORIGIN).toBe(undefined);
+        const source = require('fs').readFileSync(require.resolve('../../../utils/url-helpers.js'), 'utf8');
+        const code = source.split('\n').filter((line) => !line.trim().startsWith('//')).join('\n');
+        for (const classic of ['4000', '5001', '5002', '9099']) {
+          ctx.expect(code.includes(classic)).toBe(false);
+        }
       },
     },
     {
@@ -244,7 +260,7 @@ module.exports = defineCases({
         withEnv(NO_ENV, () => {
           // getAuthUrl calls `this.getWebsiteUrl()`, which attachTo() supplies on a
           // real Manager — hand the stand-in the same helper.
-          const manager = fakeManager('development');
+          const manager = fakeManager('development', { website: 4000 });
           manager.getWebsiteUrl = helpers.getWebsiteUrl;
           const url = new URL(helpers.getAuthUrl.call(manager));
           ctx.expect(url.origin).toBe('https://localhost:4000');
@@ -274,8 +290,12 @@ module.exports = defineCases({
           withBridgeManager(fakeManager('testing', { auth: 9109 }), () => {
             ctx.expect(clientBridge._authEmulatorPort()).toBe(9109);
           });
+          // The classic 9099 used to answer here (#834): nothing identity-checks
+          // what holds that port, so a neighbouring project's emulator read as
+          // an auth mystery instead of a port problem.
           withBridgeManager(fakeManager('testing'), () => {
-            ctx.expect(clientBridge._authEmulatorPort()).toBe(9099);
+            ctx.expect(() => clientBridge._authEmulatorPort()).toThrow(/dev port for `auth`/);
+            ctx.expect(() => clientBridge._authEmulatorPort()).toThrow(/bundle task/);
           });
         });
         withEnv({ OMEGA_AUTH_PORT: '9119' }, () => {

package/dist/test/suites/build/validate-certs.test.js

@@ -1,100 +1,473 @@
-// Build-layer tests for commands/validate-certs.js — provisioning profile parsing logic.
+// Build-layer tests for commands/validate-certs.js: what CSC_LINK is allowed to
+// carry, the three validity rungs every surface shares
+// ([#892](https://github.com/Omega-JS-Stack/omega/issues/892)), and the rung an
+// UNSET key is now ([#891](https://github.com/Omega-JS-Stack/omega/issues/891)):
+// the step READS the env the boot derived, and the `config/certs/` scan that
+// used to stop a deploy the build would have signed fine is gone.
 // The full validate flow (Keychain query, env vars) is exercised via real `npx omega deploy` prechecks.
 
 const path = require('path');
 const fs   = require('fs');
 const os   = require('os');
+const { execFileSync } = require('child_process');
 
 const validateCerts = require(path.join(__dirname, '..', '..', '..', 'commands', 'validate-certs.js'));
 const defineCases = require('../../../vendor/devkit/test/define-cases.js');
 
-// A minimal mock provisioning profile (CMS-wrapped XML plist payload).
-function makeMockProvision({ appId, expirationDate }) {
-  const appIdLine = appId
-    ? `\n  <key>application-identifier</key>\n  <string>${appId}</string>`
-    : '';
-  const expLine = expirationDate
-    ? `\n  <key>ExpirationDate</key>\n  <date>${expirationDate.toISOString()}</date>`
-    : '';
-
-  // The function strips outer CMS wrapping by regex-matching the inner plist; we just
-  // wrap our test XML in some CMS-like junk so the regex still works.
-  const inner = `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>${appIdLine}${expLine}
-</dict>
-</plist>`;
-
-  return `XX-CMS-WRAPPER-XX${inner}YY-CMS-WRAPPER-YY`;
+// A REAL signing certificate: a self-signed cert exported to a .p12 with a
+// password, so the expiry read is the same openssl path a build takes.
+function stageSigningCert({ days = 365 } = {}) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-p12-'));
+  const keyPath = path.join(dir, 'private.key');
+  const certPath = path.join(dir, 'cert.cer');
+  const p12Path = path.join(dir, 'dev-id.p12');
+  const password = 'fixture-pass';
+
+  execFileSync('openssl', [
+    'req', '-x509', '-nodes', '-newkey', 'rsa:2048', '-keyout', keyPath, '-out', certPath,
+    '-days', String(days), '-subj', '/CN=Developer ID Application: Fixture/C=US', '-outform', 'DER',
+  ], { stdio: 'pipe' });
+  execFileSync('openssl', [
+    'pkcs12', '-export', '-legacy', '-inkey', keyPath, '-in', certPath, '-out', p12Path,
+    '-passout', 'env:OMEGA_P12_PASSWORD',
+  ], { stdio: 'pipe', env: { ...process.env, OMEGA_P12_PASSWORD: password } });
+
+  return { dir, p12Path, password };
+}
+
+// Run one call with exactly these env vars set (undefined deletes the key), then
+// put the environment back the way it was. An ASYNC call holds the window until
+// it settles: checkMac awaits the Keychain query, and a restore that fired at
+// the first await would hand the rest of the run this machine's real signing env.
+function withEnv(vars, run) {
+  const previous = {};
+  for (const [key, value] of Object.entries(vars)) {
+    previous[key] = process.env[key];
+    if (value === undefined) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+
+  const restore = () => {
+    for (const [key, value] of Object.entries(previous)) {
+      if (value === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    }
+  };
+
+  let result;
+  try {
+    result = run();
+  } catch (error) {
+    restore();
+    throw error;
+  }
+
+  if (result && typeof result.then === 'function') {
+    return result.finally(restore);
+  }
+
+  restore();
+  return result;
+}
+
+// Run one call as if this leg were `platform`, then put the real value back.
+// The mac rungs are darwin-only (#891), so a case about them has to say which
+// leg it is rather than inherit the machine the suite happens to run on.
+function withPlatform(platform, run) {
+  const descriptor = Object.getOwnPropertyDescriptor(process, 'platform');
+  Object.defineProperty(process, 'platform', { value: platform, configurable: true });
+
+  const restore = () => Object.defineProperty(process, 'platform', descriptor);
+
+  let result;
+  try {
+    result = run();
+  } catch (error) {
+    restore();
+    throw error;
+  }
+
+  if (result && typeof result.then === 'function') {
+    return result.finally(restore);
+  }
+
+  restore();
+  return result;
 }
 
 module.exports = defineCases({
   type: 'suite',
   layer: 'build',
-  description: 'validate-certs — provisioning profile parsing',
+  description: 'validate-certs: the shapes CSC_LINK takes, the three validity rungs, and the unset-key rung',
   tests: [
+    // BOTH mac credentials take three shapes
+    // ([#872](https://github.com/Omega-JS-Stack/omega/issues/872)): a path, an https
+    // URL, or the file itself as inline base64. The build workflow ships two of them,
+    // because only the mac job decodes the base64 secrets to files, and treating that
+    // base64 as a path threw ENAMETOOLONG out of the precheck: first on CSC_LINK,
+    // then, once that was fixed, on APPLE_API_KEY.
+    // The cloud provider is read where sign-windows and the build read it,
+    // `platforms.windows.signing.cloud.provider` (#872): the checker used to look
+    // under `targets`, so a configured provider was always "not set" and its
+    // env vars were never checked.
+    {
+      name: 'the Windows cloud provider is read from platforms.windows, and its env vars are checked',
+      run: (ctx) => {
+        const config = { platforms: { windows: { signing: { strategy: 'cloud', cloud: { provider: 'azure' } } } } };
+        const azure = { AZURE_TENANT_ID: 't', AZURE_CLIENT_ID: 'c', AZURE_CLIENT_SECRET: 's', AZURE_TRUSTED_SIGNING_ENDPOINT: 'e' };
+        const none = Object.fromEntries(Object.keys(azure).map((key) => [key, undefined]));
+
+        const configured = [];
+        withEnv(azure, () => validateCerts.checkWindows(configured, 'cloud', config));
+        ctx.expect(configured).toEqual([]);
+
+        const bare = [];
+        withEnv(none, () => validateCerts.checkWindows(bare, 'cloud', config));
+        ctx.expect(bare.length).toBe(1);
+        ctx.expect(bare[0].message).toContain('Missing cloud-signing env vars for azure');
+      },
+    },
+    {
+      name: 'CSC_LINK carrying an inline base64 cert is reported, not statted',
+      run: (ctx) => {
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-csc-'));
+        const inline = 'MIIKvwIBAzCCCn8GCSqGSIb3DQEHAaCCCnAEggpsMIIKaDCCBR8'.repeat(60);
+
+        try {
+          ctx.expect(validateCerts.describeCertRef(inline, tmpDir).kind).toBe('inline');
+
+          const issues = [];
+          withEnv({ CSC_KEY_PASSWORD: 'hunter2' }, () => validateCerts.checkSigningCert(issues, inline, tmpDir));
+          ctx.expect(issues).toEqual([]);
+        } finally {
+          fs.rmSync(tmpDir, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      name: 'CSC_LINK carrying a URL is reported, not statted',
+      run: (ctx) => {
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-csc-'));
+        const url = 'https://certs.example.com/dev-id.p12';
+
+        try {
+          ctx.expect(validateCerts.describeCertRef(url, tmpDir).kind).toBe('url');
+
+          const issues = [];
+          withEnv({ CSC_KEY_PASSWORD: 'hunter2' }, () => validateCerts.checkSigningCert(issues, url, tmpDir));
+          ctx.expect(issues).toEqual([]);
+        } finally {
+          fs.rmSync(tmpDir, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      name: 'CSC_LINK naming a missing file is still the error it always was',
+      run: (ctx) => {
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-csc-'));
+
+        try {
+          const described = validateCerts.describeCertRef('config/certs/dev-id.p12', tmpDir);
+          ctx.expect(described.kind).toBe('file');
+          ctx.expect(described.exists).toBe(false);
+
+          const issues = [];
+          withEnv({ CSC_KEY_PASSWORD: 'hunter2' }, () => validateCerts.checkSigningCert(issues, 'config/certs/dev-id.p12', tmpDir));
+          ctx.expect(issues.length).toBe(1);
+          ctx.expect(issues[0].severity).toBe('error');
+          ctx.expect(issues[0].message).toContain('CSC_LINK points to a missing file');
+        } finally {
+          fs.rmSync(tmpDir, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      // Flipped by #891: a certificate nobody can open signs nothing, and the
+      // run that discovered this shipped an unsigned app on a warning.
+      name: 'a cert of any shape without CSC_KEY_PASSWORD is an ERROR',
+      run: (ctx) => {
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-csc-'));
+        const inline = 'MIIKvwIBAzCCCn8GCSqGSIb3DQEHAaCCCnAEggpsMIIKaDCCBR8'.repeat(60);
+
+        try {
+          const issues = [];
+          withEnv({ CSC_KEY_PASSWORD: undefined }, () => validateCerts.checkSigningCert(issues, inline, tmpDir));
+          ctx.expect(issues.length).toBe(1);
+          ctx.expect(issues[0].severity).toBe('error');
+          ctx.expect(issues[0].message).toContain('CSC_KEY_PASSWORD');
+        } finally {
+          fs.rmSync(tmpDir, { recursive: true, force: true });
+        }
+      },
+    },
+    // ── The three validity rungs, one rule (#892) ───────────────────────────
+    // The manager's certificates walk and this step read the SAME function and
+    // apply the same window, so a cert is never "fine" in one and stale in the
+    // other.
+    {
+      name: 'a real .p12 reports its expiry through the shared reader, and a healthy one raises nothing',
+      run: (ctx) => {
+        const { dir, p12Path, password } = stageSigningCert();
+
+        try {
+          const issues = [];
+          withEnv({ CSC_KEY_PASSWORD: password }, () => validateCerts.checkSigningCert(issues, p12Path, dir));
+          ctx.expect(issues).toEqual([]);
+        } finally {
+          fs.rmSync(dir, { recursive: true, force: true });
+        }
+      },
+    },
     {
-      name: 'parseProvision extracts plist from CMS-wrapped file',
+      name: 'under 30 days WARNS, expired ERRORS, and a healthy date says nothing',
       run: (ctx) => {
-        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-test-'));
-        const profPath = path.join(tmpDir, 'test.provisionprofile');
-        fs.writeFileSync(profPath, makeMockProvision({
-          appId: 'TEAMID.com.itwcw.testapp',
-          expirationDate: new Date('2099-01-01T00:00:00Z'),
-        }));
+        const days = (n) => ({ expiresAt: new Date(Date.now() + n * 86400000), daysLeft: n });
+
+        ctx.expect(validateCerts.expiryRung('config/certs/dev-id.p12', days(200))).toBeNull();
+
+        const soon = validateCerts.expiryRung('config/certs/dev-id.p12', days(10));
+        ctx.expect(soon.severity).toBe('warn');
+        ctx.expect(soon.message).toContain('expires in 10 day(s)');
+
+        const expired = validateCerts.expiryRung('config/certs/dev-id.p12', days(-5));
+        ctx.expect(expired.severity).toBe('error');
+        ctx.expect(expired.message).toContain('EXPIRED on');
+        ctx.expect(expired.message).toContain('omega manage --service certificates');
+
+        // A profile with no date at all is not a finding
+        ctx.expect(validateCerts.expiryRung('x.provisionprofile', null)).toBeNull();
+      },
+    },
+    {
+      name: 'a .p12 whose password does not open it is an error, not a silent pass',
+      run: (ctx) => {
+        const { dir, p12Path } = stageSigningCert();
 
         try {
-          const result = validateCerts.parseProvision(profPath);
-          ctx.expect(result.parsed).toBeTruthy();
-          ctx.expect(result.parsed['application-identifier']).toBe('TEAMID.com.itwcw.testapp');
-          ctx.expect(result.parsed.ExpirationDate).toBeInstanceOf(Date);
-          ctx.expect(result.raw).toContain('<plist');
+          const issues = [];
+          withEnv({ CSC_KEY_PASSWORD: 'the-wrong-password' }, () => validateCerts.checkSigningCert(issues, p12Path, dir));
+          ctx.expect(issues.length).toBe(1);
+          ctx.expect(issues[0].severity).toBe('error');
+        } finally {
+          fs.rmSync(dir, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      name: 'APPLE_API_KEY carrying an inline base64 key is reported, not statted',
+      run: (ctx) => {
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-key-'));
+        const inline = 'LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tTUlHVEFnRUFNQk1HQnlxR1NNNDk'.repeat(50);
+
+        try {
+          ctx.expect(validateCerts.describeCertRef(inline, tmpDir).kind).toBe('inline');
+
+          // An inline key has no filename, so the AuthKey_<id>.p8 cross-check has
+          // nothing to read, while the id and issuer are still wanted.
+          const issues = [];
+          withEnv({ APPLE_API_KEY_ID: 'ABCDE12345', APPLE_API_ISSUER: '00000000-0000-0000-0000-000000000000' }, () => {
+            validateCerts.checkNotarizationKey(issues, inline, tmpDir);
+          });
+          ctx.expect(issues).toEqual([]);
         } finally {
           fs.rmSync(tmpDir, { recursive: true, force: true });
         }
       },
     },
     {
-      name: 'parseProvision returns nulls for malformed file',
+      name: 'an inline APPLE_API_KEY still wants its key id and issuer',
       run: (ctx) => {
-        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-test-'));
-        const profPath = path.join(tmpDir, 'bad.provisionprofile');
-        fs.writeFileSync(profPath, 'this is not a plist at all');
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-key-'));
+        const inline = 'LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tTUlHVEFnRUFNQk1HQnlxR1NNNDk'.repeat(50);
 
         try {
-          const result = validateCerts.parseProvision(profPath);
-          ctx.expect(result.parsed).toBeNull();
-          ctx.expect(result.raw).toBeNull();
+          const issues = [];
+          withEnv({ APPLE_API_KEY_ID: undefined, APPLE_API_ISSUER: undefined }, () => {
+            validateCerts.checkNotarizationKey(issues, inline, tmpDir);
+          });
+
+          ctx.expect(issues.length).toBe(2);
+          ctx.expect(issues.map((issue) => issue.message).join(' ')).toContain('APPLE_API_KEY_ID is missing');
+          ctx.expect(issues.map((issue) => issue.message).join(' ')).toContain('APPLE_API_ISSUER is missing');
         } finally {
           fs.rmSync(tmpDir, { recursive: true, force: true });
         }
       },
     },
     {
-      name: 'parseProvision handles missing file',
+      name: 'APPLE_API_KEY naming a missing file is still the error it always was',
       run: (ctx) => {
-        const result = validateCerts.parseProvision('/nonexistent/path.provisionprofile');
-        ctx.expect(result.parsed).toBeNull();
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-key-'));
+
+        try {
+          const issues = [];
+          withEnv({ APPLE_API_KEY_ID: 'ABCDE12345', APPLE_API_ISSUER: 'x' }, () => {
+            validateCerts.checkNotarizationKey(issues, 'config/certs/AuthKey.p8', tmpDir);
+          });
+
+          ctx.expect(issues.length).toBe(1);
+          ctx.expect(issues[0].severity).toBe('error');
+          ctx.expect(issues[0].message).toContain('APPLE_API_KEY points to a missing file');
+        } finally {
+          fs.rmSync(tmpDir, { recursive: true, force: true });
+        }
       },
     },
     {
-      name: 'parseProvision raw string contains the appId for substring match logic',
+      name: 'a real AuthKey file still gets the filename/key-id cross-check',
       run: (ctx) => {
-        // The validator checks `parsed.raw.includes(expectedAppId)` — confirm the raw is
-        // searchable for that.
-        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-test-'));
-        const profPath = path.join(tmpDir, 'app.provisionprofile');
-        fs.writeFileSync(profPath, makeMockProvision({
-          appId: 'TEAMID.com.itwcw.somiibo',
-          expirationDate: new Date('2099-01-01T00:00:00Z'),
-        }));
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-key-'));
+        fs.mkdirSync(path.join(tmpDir, 'config', 'certs'), { recursive: true });
+        fs.writeFileSync(path.join(tmpDir, 'config', 'certs', 'AuthKey_ABCDE12345.p8'), 'key');
 
         try {
-          const result = validateCerts.parseProvision(profPath);
-          ctx.expect(result.raw.includes('com.itwcw.somiibo')).toBe(true);
-          ctx.expect(result.raw.includes('com.itwcw.different-app')).toBe(false);
+          const issues = [];
+          withEnv({ APPLE_API_KEY_ID: 'ZZZZZ99999', APPLE_API_ISSUER: 'x' }, () => {
+            validateCerts.checkNotarizationKey(issues, 'config/certs/AuthKey_ABCDE12345.p8', tmpDir);
+          });
+
+          ctx.expect(issues.length).toBe(1);
+          ctx.expect(issues[0].message).toContain('filename suggests key ID "ABCDE12345"');
+        } finally {
+          fs.rmSync(tmpDir, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      // #891: the boot derives CSC_LINK from the signing tree, so an unset key
+      // here means the TREE has none. The line names where it looked and the
+      // walk that fills it, and there is no `config/certs/` scan left to
+      // contradict the build beside it.
+      name: 'an unset CSC_LINK names the signing tree it looked in, never a certs-dir scan (#891)',
+      run: async (ctx) => {
+        const brand = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-brand-'));
+        fs.mkdirSync(path.join(brand, 'config'), { recursive: true });
+        fs.writeFileSync(path.join(brand, 'config', 'omega.json5'), '{ brand: { id: "b" } }');
+        const target = path.join(brand, 'targets', 'desktop');
+        fs.mkdirSync(target, { recursive: true });
+        // A .p12 sitting in the OLD dispersed location: nothing may read it.
+        fs.mkdirSync(path.join(target, 'config', 'certs'), { recursive: true });
+        fs.writeFileSync(path.join(target, 'config', 'certs', 'developer-id-application.p12'), 'stale');
+
+        const cwd = process.cwd();
+        process.chdir(target);
+        try {
+          const issues = [];
+          await withPlatform('darwin', () => withEnv({ CSC_LINK: undefined, APPLE_API_KEY: undefined, APPLE_API_KEY_ID: undefined, CSC_KEY_PASSWORD: undefined }, () => (
+            validateCerts.checkMac(issues, { certificates: { providers: { apple: { teamId: 'TEAMTEST12' } } } }, { execFn: () => Promise.resolve('') })
+          )));
+
+          const csc = issues.find((issue) => issue.message.includes('CSC_LINK'));
+          ctx.expect(csc.message).toContain('.omega/certificates/apple/certificates/DEVELOPER_ID_APPLICATION_G2.p12');
+          ctx.expect(csc.message).toContain('omega manage --service certificates');
+          ctx.expect(issues.map((issue) => issue.message).join(' ')).not.toContain('Found .p12 in config/certs/');
+        } finally {
+          process.chdir(cwd);
+          fs.rmSync(brand, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      // #891: electron-builder imports a CSC_LINK .p12 into its OWN temporary
+      // keychain, so the login keychain answers nothing about that build. The
+      // rung that read it anyway failed a runner whose file rungs had both just
+      // passed, and it now belongs to the no-CSC_LINK path alone.
+      name: 'a CSC_LINK cert never consults the Keychain, and an unset one still does (#891)',
+      run: async (ctx) => {
+        const { dir, p12Path, password } = stageSigningCert();
+        const apple = { certificates: { providers: { apple: { teamId: 'TEAMTEST12' } } } };
+        // A machine with no Developer ID identity at all.
+        const queried = [];
+        const execFn = (command) => { queried.push(command); return Promise.resolve(''); };
+        const cwd = process.cwd();
+        process.chdir(dir);
+
+        try {
+          const withCert = [];
+          await withPlatform('darwin', () => withEnv({ CSC_LINK: p12Path, CSC_KEY_PASSWORD: password, APPLE_API_KEY: p12Path, APPLE_API_KEY_ID: 'ABCDE12345', APPLE_API_ISSUER: 'x' }, () => (
+            validateCerts.checkMac(withCert, apple, { execFn })
+          )));
+
+          ctx.expect(queried).toEqual([]);
+          ctx.expect(withCert.filter((issue) => issue.severity === 'error')).toEqual([]);
+
+          const without = [];
+          await withPlatform('darwin', () => withEnv({ CSC_LINK: undefined, CSC_KEY_PASSWORD: undefined, APPLE_API_KEY: undefined, APPLE_API_KEY_ID: undefined }, () => (
+            validateCerts.checkMac(without, apple, { execFn })
+          )));
+
+          const keychain = without.find((issue) => issue.message.includes('macOS Keychain'));
+          ctx.expect(queried.length).toBe(1);
+          ctx.expect(keychain.severity).toBe('error');
+        } finally {
+          process.chdir(cwd);
+          fs.rmSync(dir, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      // The gate the env schema already uses for the whole mac set: a brand
+      // that declares no Apple signing owes no credential, so the finding is a
+      // note rather than the rung that stops a deploy.
+      name: 'the unsigned findings are ERRORS only when the config declares Apple signing (#891)',
+      run: async (ctx) => {
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-gate-'));
+        const cwd = process.cwd();
+        process.chdir(tmpDir);
+
+        try {
+          const declared = [];
+          const undeclared = [];
+          const execFn = () => Promise.resolve('');
+          await withPlatform('darwin', () => withEnv({ CSC_LINK: undefined, APPLE_API_KEY: undefined, APPLE_API_KEY_ID: undefined }, async () => {
+            await validateCerts.checkMac(declared, { certificates: { providers: { apple: { teamId: 'TEAMTEST12' } } } }, { execFn });
+            await validateCerts.checkMac(undeclared, {}, { execFn });
+          }));
+
+          const severityOf = (issues, key) => issues.find((issue) => issue.message.includes(key)).severity;
+          ctx.expect(severityOf(declared, 'CSC_LINK')).toBe('error');
+          ctx.expect(severityOf(declared, 'APPLE_API_KEY')).toBe('error');
+          ctx.expect(severityOf(undeclared, 'CSC_LINK')).toBe('warn');
+          ctx.expect(severityOf(undeclared, 'APPLE_API_KEY')).toBe('warn');
+        } finally {
+          process.chdir(cwd);
+          fs.rmSync(tmpDir, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      // #891: the linux and windows legs of the build workflow blank the mac
+      // credentials on purpose (they cannot sign for mac), so running the mac
+      // rungs there only prints two warnings about material nobody put on that
+      // leg. The rungs belong to the leg that ships mac, and to no other.
+      name: 'off darwin the mac rungs do not run at all (#891)',
+      run: async (ctx) => {
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-leg-'));
+        const cwd = process.cwd();
+        process.chdir(tmpDir);
+
+        try {
+          const queried = [];
+          const execFn = (command) => { queried.push(command); return Promise.resolve(''); };
+
+          for (const platform of ['linux', 'win32']) {
+            const issues = [];
+            await withPlatform(platform, () => withEnv({ CSC_LINK: undefined, APPLE_API_KEY: undefined, APPLE_API_KEY_ID: undefined, CSC_KEY_PASSWORD: undefined }, () => (
+              validateCerts.checkMac(issues, { certificates: { providers: { apple: { teamId: 'TEAMTEST12' } } } }, { execFn })
+            )));
+
+            ctx.expect(issues).toEqual([]);
+          }
+
+          ctx.expect(queried).toEqual([]);
         } finally {
+          process.chdir(cwd);
           fs.rmSync(tmpDir, { recursive: true, force: true });
         }
       },