gowalk-cicd 1.0.39 → 1.0.40

package/README.md

@@ -330,14 +330,21 @@ its cached cert already revoked by a sibling, mints a new one, and revokes
 another. The symptom is a "Your Certificate Has Been Revoked" email on nearly
 every deploy.
 
-Fix: apps in the same Apple team should **share one cert**. Commit the *same*
-`creds/cert.p12` + `creds/cert.meta.json` into every repo of that team (an Apple
-Distribution cert is team-scoped, not app-scoped, so one cert signs them all).
-Each app then gets a cache hit and no new cert is ever created. Provisioning
-profiles stay per-app (named `CI-<bundle_id>`) and regenerate against the shared
-cert on the next run. When onboarding a new app into an existing team, copy a
-sibling's `cert.p12` + `cert.meta.json` in rather than letting the first run
-create a fresh cert.
+Fix: apps in the same Apple team should **share one cert**. A fleet registry can
+provision the same `creds/cert.p12` + `creds/cert.meta.json` into every repo of
+that team (an Apple Distribution cert is team-scoped, not app-scoped, so one
+cert signs them all). Registry provisioning must also write
+`creds/cert.registry.json` with `managed_by: app-robot`, `state: ready`, and
+SHA-256 commit digests for both `cert.p12` and `cert.meta.json`. It must include
+the same `managed_by` field plus the DER certificate digest in
+`cert.meta.json`.
+
+The marker is a fail-closed ownership boundary: the action may reuse the
+identity and create per-app provisioning profiles, but it never creates,
+replaces, or revokes a registry-managed distribution certificate. Missing,
+partially written, corrupt, expired, Apple-revoked, or resource-ID/P12-mismatched
+managed material aborts with a reconciliation error. Legacy repos without the
+marker keep the historical cache lifecycle.
 
 ## How it works
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.39
+1.0.40

package/action/action.yml

@@ -460,6 +460,7 @@ runs:
         # the source of truth for "is there anything to commit".
         git add -f -- creds/cert.p12 2>/dev/null || true
         git add -f -- creds/cert.meta.json 2>/dev/null || true
+        git add -f -- creds/cert.registry.json 2>/dev/null || true
         git add -f -- creds/profiles.manifest.json 2>/dev/null || true
         # The whole profiles/ directory is action-managed (one
         # .mobileprovision per signable bundle, GC'd when bundles are

package/action/scripts/creds_store.py

@@ -12,6 +12,7 @@ only sane long-term strategy. We keep:
     cert.p12                       PKCS12 with cert + private key
     cert.meta.json                 {cert_id, not_after, p12_password,
                                     created_at}
+    cert.registry.json             optional registry ownership marker
     profiles.manifest.json         {cert_id, profiles:[
                                       {bundle_id, name, uuid, filename,
                                        expiration}]}
@@ -37,16 +38,25 @@ stay private; the cert lives there for warm-cache reasons, not secrecy.
 
 from __future__ import annotations
 
+import base64
+import hashlib
 import json
 import os
 from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
-from typing import Any
 
 from asc_common import request
 from cryptography import x509
-from cryptography.hazmat.primitives.serialization import pkcs12
+from cryptography.hazmat.primitives.serialization import Encoding, pkcs12
+from profile_store import (
+    ProfileEntry,
+    find_reusable_profile,
+    load_profile_manifest,
+    profile_path,
+    write_cached_profile,
+    write_profile_manifest,
+)
 
 
 # Auto-renew when the cert (or any profile) is within this many days of
@@ -73,8 +83,10 @@ P12_PASSWORD = "ci"
 # their own paths and the layout stays a single fact in one place.
 _CERT_P12 = "cert.p12"
 _CERT_META = "cert.meta.json"
+_CERT_REGISTRY = "cert.registry.json"
 _MANIFEST = "profiles.manifest.json"
 _PROFILES_SUBDIR = "profiles"
+REGISTRY_MANAGER = "app-robot"
 
 
 @dataclass
@@ -83,15 +95,7 @@ class CachedCert:
     not_after: datetime
     p12_bytes: bytes
     password: str
-
-
-@dataclass
-class ProfileEntry:
-    bundle_id: str
-    name: str
-    uuid: str
-    filename: str
-    expiration: datetime
+    certificate_sha256: str
 
 
 # --------------------------------------------------------------------------- #
@@ -119,13 +123,43 @@ def _now_utc() -> datetime:
     return datetime.now(timezone.utc)
 
 
-# --------------------------------------------------------------------------- #
-# Path computations (pure)                                                    #
-# --------------------------------------------------------------------------- #
+def registry_managed(creds_dir: Path) -> bool:
+    """Return whether the identity is owned by the app-robot registry.
 
-def profile_path(creds_dir: Path, uuid: str) -> Path:
-    """Return the on-disk path for a cached profile by UUID (pure)."""
-    return creds_dir / _PROFILES_SUBDIR / f"{uuid}.mobileprovision"
+    The dedicated marker makes ownership detectable even when the P12 or
+    metadata is missing/corrupt. Ownership is intentionally marker-only: a
+    rollback removes this panel-owned file while keeping the working P12/meta
+    cache intact. Unknown managers fail closed instead of falling into legacy
+    rotation.
+    """
+    marker = creds_dir / _CERT_REGISTRY
+    return _registry_payload_managed(marker) if marker.exists() else False
+
+
+def _registry_payload_managed(path: Path) -> bool:
+    try:
+        payload = json.loads(path.read_text())
+    except (OSError, ValueError) as exc:
+        raise SystemExit(f"registry marker is unreadable: {exc}") from exc
+    manager = payload.get("managed_by")
+    if not manager:
+        raise SystemExit("registry marker is missing managed_by")
+    if manager != REGISTRY_MANAGER:
+        raise SystemExit(f"unsupported signing registry manager: {manager}")
+    if payload.get("state") != "ready":
+        raise SystemExit("registry-managed signing bundle is not committed and ready")
+    files = (("p12_sha256", _CERT_P12), ("metadata_sha256", _CERT_META))
+    for field, filename in files:
+        expected = str(payload.get(field) or "").lower()
+        if len(expected) != 64 or any(char not in "0123456789abcdef" for char in expected):
+            raise SystemExit(f"registry marker has invalid {field}")
+        try:
+            actual = hashlib.sha256((path.parent / filename).read_bytes()).hexdigest()
+        except OSError as exc:
+            raise SystemExit(f"registry signing bundle is incomplete: {filename}") from exc
+        if actual != expected:
+            raise SystemExit(f"registry signing bundle digest mismatch: {filename}")
+    return True
 
 
 # --------------------------------------------------------------------------- #
@@ -133,18 +167,7 @@ def profile_path(creds_dir: Path, uuid: str) -> Path:
 # --------------------------------------------------------------------------- #
 
 def load_cached_cert(creds_dir: Path) -> CachedCert | None:
-    """Return the cached cert iff p12 + meta exist and decrypt cleanly.
-
-    Returns ``None`` (and logs a ``::warning::``) on any of:
-      * missing p12 or meta file
-      * meta JSON corrupt / missing required keys
-      * p12 fails to decrypt with the stored password
-      * cert NotAfter is within RENEW_THRESHOLD_DAYS
-
-    A returned :class:`CachedCert` is NOT yet validated against Apple —
-    the caller must still confirm the cert id is alive via
-    :func:`verify_cert_alive`.
-    """
+    """Load a locally valid cache; the caller still verifies it with Apple."""
     p12 = creds_dir / _CERT_P12
     meta = creds_dir / _CERT_META
     if not p12.exists() or not meta.exists():
@@ -156,21 +179,30 @@ def load_cached_cert(creds_dir: Path) -> CachedCert | None:
         not_after = _parse_iso(meta_raw["not_after"])
         password = meta_raw.get("p12_password") or P12_PASSWORD
     except (OSError, ValueError, KeyError) as exc:
-        print(f"::warning::cert.meta.json unreadable ({exc}); regenerating cert")
+        print(f"::warning::cert.meta.json unreadable ({exc}); identity cannot be reused")
         return None
 
     p12_bytes = p12.read_bytes()
     try:
-        pkcs12.load_key_and_certificates(p12_bytes, password.encode())
+        _, certificate, _ = pkcs12.load_key_and_certificates(p12_bytes, password.encode())
     except (ValueError, TypeError) as exc:
-        print(f"::warning::cert.p12 decrypt failed ({exc}); regenerating cert")
+        print(f"::warning::cert.p12 decrypt failed ({exc}); identity cannot be reused")
+        return None
+    if certificate is None:
+        print("::warning::cert.p12 has no certificate; identity cannot be reused")
+        return None
+    certificate_sha256 = hashlib.sha256(
+        certificate.public_bytes(Encoding.DER)).hexdigest()
+    declared_digest = str(meta_raw.get("certificate_sha256") or "").lower()
+    if declared_digest and declared_digest != certificate_sha256:
+        print("::warning::cert.meta.json certificate digest does not match cert.p12")
         return None
 
     deadline = _now_utc() + timedelta(days=RENEW_THRESHOLD_DAYS)
     if not_after <= deadline:
         print(
             f"::warning::Cached cert {cert_id} expires {not_after.isoformat()} "
-            f"(within {RENEW_THRESHOLD_DAYS}d); regenerating"
+            f"(within {RENEW_THRESHOLD_DAYS}d); identity requires replacement"
         )
         return None
 
@@ -179,10 +211,12 @@ def load_cached_cert(creds_dir: Path) -> CachedCert | None:
         not_after=not_after,
         p12_bytes=p12_bytes,
         password=password,
+        certificate_sha256=certificate_sha256,
     )
 
 
-def verify_cert_alive(token: str, cert_id: str) -> bool:
+def verify_cert_alive(token: str, cert_id: str,
+                      expected_certificate_sha256: str | None = None) -> bool:
     """Return True iff GET /certificates/{cert_id} returns 200.
 
     A 404 means Apple revoked it (manually or via the cap-rotation done
@@ -195,7 +229,16 @@ def verify_cert_alive(token: str, cert_id: str) -> bool:
         token,
         allow_status={404},
     )
-    return resp.status_code == 200
+    if resp.status_code != 200:
+        return False
+    if expected_certificate_sha256 is None:
+        return True
+    try:
+        encoded = resp.json()["data"]["attributes"]["certificateContent"]
+        certificate_der = base64.b64decode(encoded, validate=True)
+    except (KeyError, TypeError, ValueError):
+        return False
+    return hashlib.sha256(certificate_der).hexdigest() == expected_certificate_sha256
 
 
 def write_cert_bundle(
@@ -221,77 +264,6 @@ def write_cert_bundle(
     _atomic_write(creds_dir / _CERT_META, json.dumps(meta, indent=2).encode())
 
 
-# --------------------------------------------------------------------------- #
-# Profile manifest                                                            #
-# --------------------------------------------------------------------------- #
-
-def load_profile_manifest(creds_dir: Path) -> dict:
-    """Return the parsed manifest, or an empty skeleton if missing/corrupt."""
-    path = creds_dir / _MANIFEST
-    if not path.exists():
-        return {"cert_id": None, "profiles": []}
-    try:
-        data = json.loads(path.read_text())
-    except (OSError, ValueError) as exc:
-        print(f"::warning::profiles.manifest.json unreadable ({exc}); resetting")
-        return {"cert_id": None, "profiles": []}
-    data.setdefault("cert_id", None)
-    data.setdefault("profiles", [])
-    return data
-
-
-def write_profile_manifest(creds_dir: Path, manifest: dict) -> None:
-    """Persist the manifest atomically with profiles sorted by bundle_id."""
-    sorted_profiles = sorted(
-        manifest.get("profiles", []),
-        key=lambda entry: entry.get("bundle_id", ""),
-    )
-    payload = {
-        "cert_id": manifest.get("cert_id"),
-        "profiles": sorted_profiles,
-    }
-    _atomic_write(
-        creds_dir / _MANIFEST, json.dumps(payload, indent=2).encode()
-    )
-
-
-def find_reusable_profile(
-    manifest: dict,
-    bundle_id: str,
-    cert_id: str,
-    creds_dir: Path,
-) -> ProfileEntry | None:
-    """Return a reusable :class:`ProfileEntry` for ``bundle_id`` or None.
-
-    Reusable requires: manifest cert_id matches current cert_id, an
-    entry exists for the bundle, expiration is past the renew
-    threshold, and the .mobileprovision file is on disk.
-    """
-    if manifest.get("cert_id") != cert_id:
-        return None
-    deadline = _now_utc() + timedelta(days=RENEW_THRESHOLD_DAYS)
-    for raw in manifest.get("profiles", []):
-        if raw.get("bundle_id") != bundle_id:
-            continue
-        try:
-            expiration = _parse_iso(raw["expiration"])
-            uuid = raw["uuid"]
-        except (KeyError, ValueError):
-            return None
-        if expiration <= deadline:
-            return None
-        if not profile_path(creds_dir, uuid).exists():
-            return None
-        return ProfileEntry(
-            bundle_id=bundle_id,
-            name=raw.get("name", ""),
-            uuid=uuid,
-            filename=raw.get("filename", f"{uuid}.mobileprovision"),
-            expiration=expiration,
-        )
-    return None
-
-
 # --------------------------------------------------------------------------- #
 # Cache invalidation + cross-module utilities                                 #
 # --------------------------------------------------------------------------- #
@@ -308,11 +280,6 @@ def invalidate_cache(creds_dir: Path) -> None:
     print(f"Invalidated signing cache under {creds_dir}")
 
 
-def write_cached_profile(creds_dir: Path, uuid: str, profile_der: bytes) -> None:
-    """Persist a fresh .mobileprovision atomically under ``profiles/``."""
-    _atomic_write(profile_path(creds_dir, uuid), profile_der)
-
-
 def cert_not_after_from_der(cert_der: bytes) -> datetime:
     """Extract NotAfter from a DER-encoded certificate, normalised to UTC.
 

package/action/scripts/prepare_signing.py

@@ -9,9 +9,9 @@ This script orchestrates the load-or-regen flow:
 
   1. Try to reuse the cached cert (decrypts + NotAfter > 30d +
      ``GET /certificates/{cert_id}`` = 200).
-  2. On miss, invalidate the cache and create a fresh cert via
-     ``cert_factory`` (handling Apple's per-team cap of 2 by revoking
-     the OLDEST existing one).
+  2. On a legacy cache miss, invalidate the cache and create a fresh cert via
+     ``cert_factory``. A registry-managed identity instead fails closed: this
+     action never creates, replaces, or revokes centrally owned certificates.
   3. Hand the cert id + cache_hit flag to ``provision_all_bundles``,
      which decides per-bundle whether to reuse a cached profile or
      create a new one and updates the manifest.
@@ -59,35 +59,43 @@ def optional_env(name: str) -> str:
     return os.environ.get(name, "")
 
 
+def _warn_if_renewal_near(cached: creds_store.CachedCert) -> None:
+    now = datetime.now(timezone.utc)
+    renew_at = now + timedelta(days=creds_store.RENEW_THRESHOLD_DAYS)
+    warn_at = now + timedelta(days=creds_store.WARN_THRESHOLD_DAYS)
+    if renew_at < cached.not_after <= warn_at:
+        print(
+            f"::warning::Cert {cached.cert_id} expires in "
+            f"{(cached.not_after - now).days}d; auto-renew fires at "
+            f"{creds_store.RENEW_THRESHOLD_DAYS}d remaining."
+        )
+
+
 def _load_or_create_cert(
     token: str, creds_dir: Path
 ) -> tuple[str, bytes, str, bool]:
-    """Return ``(cert_id, p12_bytes, password, cache_hit)``.
-
-    Cache hit when the on-disk cert decrypts, NotAfter > 30d away, and
-    Apple confirms the cert id is still alive. On miss the cache is
-    invalidated, a new cert is created (handling Apple's per-team cap),
-    and the cache is repopulated atomically.
-    """
+    """Load a usable identity or create one only for an unmanaged legacy repo."""
+    managed = creds_store.registry_managed(creds_dir)
     cached = creds_store.load_cached_cert(creds_dir)
-    if cached and creds_store.verify_cert_alive(token, cached.cert_id):
+    expected_digest = cached.certificate_sha256 if cached and managed else None
+    if cached and creds_store.verify_cert_alive(token, cached.cert_id, expected_digest):
         print(
             f"Reusing cached distribution cert {cached.cert_id} "
             f"(NotAfter {cached.not_after.isoformat()})"
         )
-        # Warn when inside T-60d..T-30d so operators see renewal is pending
-        # but auto-renew has not yet fired.
-        now = datetime.now(timezone.utc)
-        renew_at = now + timedelta(days=creds_store.RENEW_THRESHOLD_DAYS)
-        warn_at = now + timedelta(days=creds_store.WARN_THRESHOLD_DAYS)
-        if renew_at < cached.not_after <= warn_at:
-            print(
-                f"::warning::Cert {cached.cert_id} expires in "
-                f"{(cached.not_after - now).days}d; auto-renew fires at "
-                f"{creds_store.RENEW_THRESHOLD_DAYS}d remaining."
-            )
+        _warn_if_renewal_near(cached)
         return cached.cert_id, cached.p12_bytes, cached.password, True
 
+    if managed:
+        detail = "missing, corrupt, or within the renewal window"
+        if cached:
+            detail = f"certificate {cached.cert_id} is not active on Apple or does not match cert.p12"
+        raise SystemExit(
+            "registry-managed distribution identity is unusable "
+            f"({detail}); refusing certificate creation or revocation. "
+            "Reconcile and replace the account identity in app-robot."
+        )
+
     if cached:
         print(
             f"Cached cert {cached.cert_id} no longer alive on Apple; "

package/action/scripts/profile_store.py

@@ -0,0 +1,87 @@
+#!/usr/bin/env python3
+"""Persistent provisioning-profile cache under an app's creds directory."""
+from __future__ import annotations
+
+import json
+import os
+from dataclasses import dataclass
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+
+RENEW_THRESHOLD_DAYS = 30
+_MANIFEST = "profiles.manifest.json"
+_PROFILES_SUBDIR = "profiles"
+
+
+@dataclass
+class ProfileEntry:
+    bundle_id: str
+    name: str
+    uuid: str
+    filename: str
+    expiration: datetime
+
+
+def _atomic_write(path: Path, data: bytes) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    temp = path.with_suffix(path.suffix + ".tmp")
+    temp.write_bytes(data)
+    os.replace(temp, path)
+
+
+def _parse_iso(value: str) -> datetime:
+    if value.endswith("Z"):
+        value = value[:-1] + "+00:00"
+    parsed = datetime.fromisoformat(value)
+    return parsed if parsed.tzinfo else parsed.replace(tzinfo=timezone.utc)
+
+
+def profile_path(creds_dir: Path, uuid: str) -> Path:
+    return creds_dir / _PROFILES_SUBDIR / f"{uuid}.mobileprovision"
+
+
+def load_profile_manifest(creds_dir: Path) -> dict:
+    path = creds_dir / _MANIFEST
+    if not path.exists():
+        return {"cert_id": None, "profiles": []}
+    try:
+        data = json.loads(path.read_text())
+    except (OSError, ValueError) as exc:
+        print(f"::warning::profiles.manifest.json unreadable ({exc}); resetting")
+        return {"cert_id": None, "profiles": []}
+    data.setdefault("cert_id", None)
+    data.setdefault("profiles", [])
+    return data
+
+
+def write_profile_manifest(creds_dir: Path, manifest: dict) -> None:
+    profiles = sorted(manifest.get("profiles", []),
+                      key=lambda entry: entry.get("bundle_id", ""))
+    payload = {"cert_id": manifest.get("cert_id"), "profiles": profiles}
+    _atomic_write(creds_dir / _MANIFEST, json.dumps(payload, indent=2).encode())
+
+
+def find_reusable_profile(manifest: dict, bundle_id: str, cert_id: str,
+                          creds_dir: Path) -> ProfileEntry | None:
+    if manifest.get("cert_id") != cert_id:
+        return None
+    deadline = datetime.now(timezone.utc) + timedelta(days=RENEW_THRESHOLD_DAYS)
+    for raw in manifest.get("profiles", []):
+        if raw.get("bundle_id") != bundle_id:
+            continue
+        try:
+            expiration, uuid = _parse_iso(raw["expiration"]), raw["uuid"]
+        except (KeyError, ValueError):
+            return None
+        if expiration <= deadline or not profile_path(creds_dir, uuid).exists():
+            return None
+        return ProfileEntry(
+            bundle_id=bundle_id, name=raw.get("name", ""), uuid=uuid,
+            filename=raw.get("filename", f"{uuid}.mobileprovision"),
+            expiration=expiration,
+        )
+    return None
+
+
+def write_cached_profile(creds_dir: Path, uuid: str, profile_der: bytes) -> None:
+    _atomic_write(profile_path(creds_dir, uuid), profile_der)

package/action/scripts/test_registry_managed_signing.py

@@ -0,0 +1,115 @@
+#!/usr/bin/env python3
+"""Fail-closed behavior for centrally managed distribution identities."""
+from __future__ import annotations
+
+import base64
+import hashlib
+import json
+import sys
+import tempfile
+import unittest
+from datetime import datetime, timezone
+from pathlib import Path
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import creds_store  # noqa: E402
+import prepare_signing  # noqa: E402
+
+
+class RegistryManagedSigningTests(unittest.TestCase):
+    def _managed_dir(self, state: str = "ready") -> tempfile.TemporaryDirectory:
+        temp = tempfile.TemporaryDirectory()
+        root = Path(temp.name)
+        p12, metadata = b"p12", b"metadata"
+        (root / "cert.p12").write_bytes(p12)
+        (root / "cert.meta.json").write_bytes(metadata)
+        marker = root / "cert.registry.json"
+        marker.write_text(json.dumps({
+            "schema_version": 1,
+            "managed_by": "app-robot",
+            "state": state,
+            "p12_sha256": hashlib.sha256(p12).hexdigest(),
+            "metadata_sha256": hashlib.sha256(metadata).hexdigest(),
+        }))
+        return temp
+
+    def test_missing_managed_identity_never_enters_creation_path(self):
+        with self._managed_dir() as raw:
+            creds_dir = Path(raw)
+            (creds_dir / "cert.p12").unlink()
+            with mock.patch.object(prepare_signing.cert_factory, "generate_key_and_csr") as generate:
+                with mock.patch.object(prepare_signing.cert_factory, "create_distribution_cert") as create:
+                    with mock.patch.object(prepare_signing.creds_store, "invalidate_cache") as invalidate:
+                        with self.assertRaisesRegex(SystemExit, "bundle is incomplete"):
+                            prepare_signing._load_or_create_cert("token", creds_dir)
+        generate.assert_not_called()
+        create.assert_not_called()
+        invalidate.assert_not_called()
+
+    def test_revoked_managed_identity_is_not_deleted_or_replaced(self):
+        cached = creds_store.CachedCert(
+            cert_id="CERT1",
+            not_after=datetime(2027, 8, 1, tzinfo=timezone.utc),
+            p12_bytes=b"p12",
+            password="secret",
+            certificate_sha256="a" * 64,
+        )
+        with self._managed_dir() as raw:
+            with mock.patch.object(prepare_signing.creds_store, "load_cached_cert", return_value=cached):
+                with mock.patch.object(prepare_signing.creds_store, "verify_cert_alive", return_value=False):
+                    with mock.patch.object(prepare_signing.cert_factory, "create_distribution_cert") as create:
+                        with self.assertRaisesRegex(SystemExit, "not active on Apple or does not match"):
+                            prepare_signing._load_or_create_cert("token", Path(raw))
+        create.assert_not_called()
+
+    def test_active_managed_identity_is_reused(self):
+        cached = creds_store.CachedCert(
+            cert_id="CERT1",
+            not_after=datetime(2027, 8, 1, tzinfo=timezone.utc),
+            p12_bytes=b"p12",
+            password="secret",
+            certificate_sha256="a" * 64,
+        )
+        with self._managed_dir() as raw:
+            with mock.patch.object(prepare_signing.creds_store, "load_cached_cert", return_value=cached):
+                with mock.patch.object(prepare_signing.creds_store, "verify_cert_alive", return_value=True):
+                    with mock.patch.object(prepare_signing.cert_factory, "create_distribution_cert") as create:
+                        result = prepare_signing._load_or_create_cert("token", Path(raw))
+        self.assertEqual(result, ("CERT1", b"p12", "secret", True))
+        create.assert_not_called()
+
+    def test_managed_liveness_binds_resource_id_to_certificate_bytes(self):
+        remote_der = b"apple-certificate-der"
+        response = mock.Mock(status_code=200)
+        response.json.return_value = {"data": {"attributes": {
+            "certificateContent": base64.b64encode(remote_der).decode(),
+        }}}
+        with mock.patch.object(creds_store, "request", return_value=response):
+            digest = hashlib.sha256(remote_der).hexdigest()
+            self.assertTrue(creds_store.verify_cert_alive("token", "CERT1", digest))
+            self.assertFalse(creds_store.verify_cert_alive("token", "CERT1", "b" * 64))
+
+    def test_updating_managed_bundle_fails_before_reading_identity(self):
+        with self._managed_dir(state="updating") as raw:
+            with mock.patch.object(prepare_signing.creds_store, "load_cached_cert") as load:
+                with self.assertRaisesRegex(SystemExit, "not committed and ready"):
+                    prepare_signing._load_or_create_cert("token", Path(raw))
+        load.assert_not_called()
+
+    def test_ready_marker_rejects_tampered_bundle(self):
+        with self._managed_dir() as raw:
+            (Path(raw) / "cert.p12").write_bytes(b"tampered")
+            with self.assertRaisesRegex(SystemExit, "digest mismatch"):
+                prepare_signing._load_or_create_cert("token", Path(raw))
+
+    def test_metadata_without_ownership_marker_remains_legacy(self):
+        with tempfile.TemporaryDirectory() as raw:
+            meta = Path(raw) / "cert.meta.json"
+            meta.write_text(json.dumps({"managed_by": "app-robot"}))
+            self.assertFalse(creds_store.registry_managed(Path(raw)))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.39
+1.0.40

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.39
+1.0.40

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.39",
+  "version": "1.0.40",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {