gowalk-cicd 1.0.85 → 1.0.87

package/CLAUDE.md

@@ -123,6 +123,9 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   Version source staged before signing is preserved separately with its original index bytes.
 - Never revoke a distribution certificate automatically, including legacy caches.
   `certificate-cap-policy` accepts only `fail`; a full cap requires registry reconciliation.
+  A certificate POST's HTTP 409 alone does not prove a full cap. `certificate_failure.py`
+  emits fixed reason/code evidence in `apple_certificate_rejected`; raw provider details stay private.
+  Certificate creation sends the complete PEM CSR in `csrContent`, including its framing and newlines.
 - Keep preinstalled Android SDK/NDKs. Every Gradle test/build and SDK download runs
   under `play_store_proxy.py --`, whose owned loopback relay gives Java an explicit
   authenticated account exit without credentials in JVM options. The child HTTP_PROXY

package/README.md

@@ -852,6 +852,13 @@ common ones:
 | `ai-metadata` | `false` to disable AI auto-fill of empty ASC metadata |
 | `ai-metadata-model` | GitHub Models model id (default `openai/gpt-4o`) |
 
+Certificate creation sends the complete PEM CSR in Apple's `csrContent` field, including its framing and newlines.
+Certificate creation refusals emit `apple_certificate_rejected` with schema
+`gowalk-cicd/apple-certificate-rejected.v1`, `operation`, `http_status`, `reason` and `error_codes`.
+HTTP 409 is classified as `certificate_limit` only when Apple's returned detail identifies the limit;
+otherwise it remains `unclassified_conflict`. Codes come from a fixed allowlist. Raw provider text and
+CSR data are excluded. Neither outcome permits automatic certificate deletion or another creation attempt.
+
 ## First-time app setup
 
 The app record must exist in App Store Connect before the first CI upload.

package/action/.daemux-version

@@ -1 +1 @@
-1.0.85
+1.0.87

package/action/scripts/cert_factory.py

@@ -18,6 +18,7 @@ import base64
 import os
 
 from asc_common import request
+import certificate_failure
 from cryptography import x509
 from cryptography.hazmat.primitives import hashes, serialization
 from cryptography.hazmat.primitives.asymmetric import rsa
@@ -34,11 +35,11 @@ def certificate_cap_policy() -> str:
 
 
 def generate_key_and_csr() -> tuple[rsa.RSAPrivateKey, bytes]:
-    """Generate a fresh 2048-bit RSA key + PEM CSR (base64 body only).
+    """Generate a fresh 2048-bit RSA key and complete PEM CSR.
 
     Returns the private key (kept in memory; the caller serialises it
-    into the PKCS12) and the CSR with PEM headers stripped, ready for
-    Apple's ``csrContent`` field.
+    into the PKCS12) and the PEM CSR, including its framing and newlines,
+    for Apple's ``csrContent`` field.
     """
     private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
     csr = (
@@ -54,20 +55,17 @@ def generate_key_and_csr() -> tuple[rsa.RSAPrivateKey, bytes]:
         .sign(private_key, hashes.SHA256())
     )
     csr_pem = csr.public_bytes(serialization.Encoding.PEM)
-    csr_payload = b"".join(
-        line for line in csr_pem.splitlines() if not line.startswith(b"-----")
-    )
-    return private_key, csr_payload
+    return private_key, csr_pem
 
 
-def create_distribution_cert(token: str, csr_b64: str) -> tuple[str, bytes]:
+def create_distribution_cert(token: str, csr_pem: str) -> tuple[str, bytes]:
     """POST one CSR; a full team cap preserves every existing certificate."""
     certificate_cap_policy()
     body = {
         "data": {
             "type": "certificates",
             "attributes": {
-                "csrContent": csr_b64,
+                "csrContent": csr_pem,
                 "certificateType": "DISTRIBUTION",
             },
         }
@@ -76,10 +74,7 @@ def create_distribution_cert(token: str, csr_b64: str) -> tuple[str, bytes]:
         "POST", "/certificates", token, json_body=body, allow_status={409}
     )
     if resp.status_code == 409:
-        raise SystemExit(
-            "distribution certificate cap reached; policy=fail preserves all "
-            "existing certificates and refuses automatic revocation; reconcile the account registry"
-        )
+        certificate_failure.refuse(resp)
     data = resp.json()["data"]
     cert_id = data["id"]
     cert_der = base64.b64decode(data["attributes"]["certificateContent"])

package/action/scripts/certificate_failure.py

@@ -0,0 +1,47 @@
+"""A certificate POST conflict is not proof of quota exhaustion."""
+from __future__ import annotations
+
+import json
+
+_CODES = frozenset({"ENTITY_ERROR", "ENTITY_ERROR.ATTRIBUTE.INVALID", "ENTITY_ERROR.ATTRIBUTE.REQUIRED",
+                    "ENTITY_ERROR.RELATIONSHIP.INVALID", "ENTITY_ERROR.RELATIONSHIP.REQUIRED",
+                    "STATE_ERROR", "FORBIDDEN_ERROR", "UNEXPECTED_ERROR"})
+_CAP_DETAILS = (
+    "maximum number of certificates",
+    "maximum allowed number of certificates",
+    "you already have a current distribution certificate or a pending certificate request",
+    "certificate limit has been reached",
+    "certificate limit reached",
+)
+
+
+def conflict(response) -> dict:
+    """Use fixed labels and code allowlists; never return provider text, URLs or CSR data."""
+    try:
+        payload = response.json()
+    except (ValueError, TypeError):
+        payload = {}
+    errors = payload.get("errors", []) if isinstance(payload, dict) else []
+    errors = errors[:32] if isinstance(errors, list) else []
+    codes, capped = set(), False
+    for error in errors:
+        if not isinstance(error, dict):
+            continue
+        code = error.get("code")
+        if isinstance(code, str) and code in _CODES:
+            codes.add(code)
+        detail = error.get("detail")
+        if isinstance(detail, str):
+            capped |= any(marker in detail[:8192].lower() for marker in _CAP_DETAILS)
+    return {"schema": "gowalk-cicd/apple-certificate-rejected.v1", "operation": "certificates_createInstance",
+            "http_status": 409, "reason": "certificate_limit" if capped else "unclassified_conflict",
+            "error_codes": sorted(codes)}
+
+
+def refuse(response) -> None:
+    result = conflict(response)
+    print("::error title=apple_certificate_rejected::" + json.dumps(result, separators=(",", ":")))
+    raise SystemExit(
+        f"Apple certificate request rejected (HTTP 409; reason={result['reason']}); "
+        "policy=fail preserves all existing certificates and refuses automatic revocation"
+    )

package/action/scripts/prepare_signing.py

@@ -103,9 +103,9 @@ def _load_or_create_cert(
         )
     creds_store.invalidate_cache(creds_dir)
 
-    private_key, csr_b64 = cert_factory.generate_key_and_csr()
+    private_key, csr_pem = cert_factory.generate_key_and_csr()
     cert_id, cert_der = cert_factory.create_distribution_cert(
-        token, csr_b64.decode()
+        token, csr_pem.decode("ascii")
     )
     password = creds_store.P12_PASSWORD
     p12_bytes = cert_factory.serialize_p12(private_key, cert_der, password)

package/action/scripts/test_certificate_cap_policy.py

@@ -5,6 +5,8 @@ from __future__ import annotations
 import os
 import sys
 import unittest
+from contextlib import redirect_stdout
+from io import StringIO
 from pathlib import Path
 from unittest import mock
 
@@ -27,7 +29,8 @@ class CertificateCapPolicyTests(unittest.TestCase):
     def test_fail_policy_preserves_every_certificate_on_cap(self):
         response = mock.MagicMock(status_code=409)
         with mock.patch.dict(os.environ, {"CERTIFICATE_CAP_POLICY": "fail"}, clear=True):
-            with mock.patch.object(cert_factory, "request", return_value=response) as request:
+            with (mock.patch.object(cert_factory, "request", return_value=response) as request,
+                  redirect_stdout(StringIO())):
                 with self.assertRaisesRegex(SystemExit, "refuses automatic revocation"):
                     cert_factory.create_distribution_cert("token", "csr")
         request.assert_called_once()
@@ -36,7 +39,8 @@ class CertificateCapPolicyTests(unittest.TestCase):
     def test_default_policy_never_revokes_or_retries_a_full_cap(self):
         capped = mock.MagicMock(status_code=409)
         with mock.patch.dict(os.environ, {}, clear=True):
-            with mock.patch.object(cert_factory, "request", return_value=capped) as request:
+            with (mock.patch.object(cert_factory, "request", return_value=capped) as request,
+                  redirect_stdout(StringIO())):
                 with self.assertRaisesRegex(SystemExit, "refuses automatic revocation"):
                     cert_factory.create_distribution_cert("token", "csr")
         request.assert_called_once()

package/action/scripts/test_certificate_failure.py

@@ -0,0 +1,64 @@
+"""Retain useful Apple refusal evidence without inventing a cap or exposing response data."""
+import contextlib
+import io
+import json
+import os
+import sys
+import unittest
+from pathlib import Path
+from unittest import mock
+
+import requests
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import cert_factory  # noqa: E402
+
+
+class CertificateFailureTests(unittest.TestCase):
+    def request(self, body):
+        response = requests.Response()
+        response.status_code = 409
+        response._content = body.encode()
+        output = io.StringIO()
+        with mock.patch.dict(os.environ, {"CERTIFICATE_CAP_POLICY": "fail"}, clear=True):
+            with mock.patch.object(cert_factory, "request", return_value=response) as request:
+                with contextlib.redirect_stdout(output), self.assertRaises(SystemExit) as failed:
+                    cert_factory.create_distribution_cert("private-token", "private-csr")
+        request.assert_called_once()
+        self.assertEqual(request.call_args.args[:2], ("POST", "/certificates"))
+        text = output.getvalue() + str(failed.exception)
+        self.assertNotIn("private-", text)
+        return json.loads(output.getvalue().split("::", 2)[2]), str(failed.exception)
+
+    def test_limit_requires_the_provider_limit_detail(self):
+        for detail in ["Maximum number of certificates generated.",
+                       "You already have a current Distribution certificate or a pending certificate request."]:
+            with self.subTest(detail=detail):
+                result, message = self.request(json.dumps({"errors": [{
+                    "code": "ENTITY_ERROR.ATTRIBUTE.INVALID", "detail": detail,
+                    "source": {"pointer": "private-source"}, "links": {"about": "private-url"}}]}))
+                self.assertEqual(result["reason"], "certificate_limit")
+                self.assertEqual(result["error_codes"], ["ENTITY_ERROR.ATTRIBUTE.INVALID"])
+                self.assertIn("refuses automatic revocation", message)
+
+    def test_other_conflicts_are_not_reported_as_quota(self):
+        cases = [{"errors": [{"code": "ENTITY_ERROR.ATTRIBUTE.INVALID", "detail": "Invalid private-csr"}]},
+                 {"errors": [{"code": "private-secret", "detail": "private-response"}]},
+                 {"errors": [{"code": ["private-value"]}]}, {"errors": "private-response"},
+                 {"errors": ["private-response"]}, [], None]
+        for case in cases:
+            with self.subTest(case=case):
+                result, message = self.request(json.dumps(case))
+                self.assertEqual(result["reason"], "unclassified_conflict")
+                self.assertNotIn("cap reached", message)
+                self.assertEqual(result["http_status"], 409)
+                self.assertEqual(result["operation"], "certificates_createInstance")
+
+    def test_non_json_response_is_an_unclassified_conflict(self):
+        result, _ = self.request("<html>private-response</html>")
+        self.assertEqual(result["reason"], "unclassified_conflict")
+        self.assertEqual(result["error_codes"], [])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/action/scripts/test_certificate_request.py

@@ -0,0 +1,62 @@
+"""Verify Apple's PEM request boundary with real CSR, certificate and PKCS12 bytes."""
+from __future__ import annotations
+
+import base64
+import datetime as dt
+import json
+import unittest
+from contextlib import redirect_stdout
+from io import StringIO
+from unittest import mock
+
+import requests
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.serialization import pkcs12
+
+import cert_factory
+
+
+class CertificateRequestTests(unittest.TestCase):
+    def test_generated_pem_has_a_valid_signature_and_matching_public_key(self):
+        key, content = cert_factory.generate_key_and_csr()
+        csr = x509.load_pem_x509_csr(content)
+        self.assertTrue(csr.is_signature_valid)
+        self.assertEqual(csr.public_key().public_numbers(), key.public_key().public_numbers())
+
+    def test_posted_pem_and_returned_certificate_preserve_the_signing_identity(self):
+        key, content = cert_factory.generate_key_and_csr()
+        received = []
+
+        def apple_post(method, path, token, *, json_body, allow_status):
+            self.assertEqual((method, path), ("POST", "/certificates"))
+            attributes = json_body["data"]["attributes"]
+            self.assertEqual(attributes["certificateType"], "DISTRIBUTION")
+            csr = x509.load_pem_x509_csr(attributes["csrContent"].encode("ascii"))
+            self.assertTrue(csr.is_signature_valid)
+            now = dt.datetime.now(dt.timezone.utc)
+            cert = (x509.CertificateBuilder().subject_name(csr.subject).issuer_name(csr.subject)
+                    .public_key(csr.public_key()).serial_number(x509.random_serial_number())
+                    .not_valid_before(now - dt.timedelta(minutes=1))
+                    .not_valid_after(now + dt.timedelta(days=1)).sign(key, hashes.SHA256()))
+            received.append(cert)
+            response = requests.Response()
+            response.status_code = 201
+            response._content = json.dumps({"data": {"id": "TESTCERT", "attributes": {
+                "certificateContent": base64.b64encode(cert.public_bytes(serialization.Encoding.DER)).decode()
+            }}}).encode()
+            return response
+
+        with mock.patch.object(cert_factory, "request", side_effect=apple_post) as request:
+            with redirect_stdout(StringIO()):
+                cert_id, der = cert_factory.create_distribution_cert("test-token", content.decode("ascii"))
+        request.assert_called_once()
+        self.assertEqual(cert_id, "TESTCERT")
+        p12 = cert_factory.serialize_p12(key, der, "test-only-password")
+        restored_key, restored_cert, _ = pkcs12.load_key_and_certificates(p12, b"test-only-password")
+        self.assertEqual(restored_key.public_key().public_numbers(), key.public_key().public_numbers())
+        self.assertEqual(restored_cert.fingerprint(hashes.SHA256()), received[0].fingerprint(hashes.SHA256()))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.85
+1.0.87

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.85
+1.0.87

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.85",
+  "version": "1.0.87",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {