Open ofek opened 1 year ago
This is really weird. The error is coming from establishing the websocket connection to ws.codesign.gregoryszorc.com
. That's not your developer ID signing certificate. Rather, it's an AWS issued certificate:
$ openssl s_client -connect ws.codesign.gregoryszorc.com:443
CONNECTED(00000006)
depth=2 C = US, O = Amazon, CN = Amazon Root CA 1
verify return:1
depth=1 C = US, O = Amazon, CN = Amazon RSA 2048 M01
verify return:1
depth=0 CN = *.execute-api.us-west-2.amazonaws.com
verify return:1
write W BLOCK
---
Certificate chain
0 s:/CN=*.execute-api.us-west-2.amazonaws.com
i:/C=US/O=Amazon/CN=Amazon RSA 2048 M01
1 s:/C=US/O=Amazon/CN=Amazon RSA 2048 M01
i:/C=US/O=Amazon/CN=Amazon Root CA 1
2 s:/C=US/O=Amazon/CN=Amazon Root CA 1
i:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./CN=Starfield Services Root Certificate Authority - G2
3 s:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./CN=Starfield Services Root Certificate Authority - G2
i:/C=US/O=Starfield Technologies, Inc./OU=Starfield Class 2 Certification Authority
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIF9TCCBN2gAwIBAgIQDKl6Ovevhi/QfthJX77AJjANBgkqhkiG9w0BAQsFADA8
MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRwwGgYDVQQDExNBbWF6b24g
UlNBIDIwNDggTTAxMB4XDTIzMDYwMjAwMDAwMFoXDTI0MDYzMDIzNTk1OVowMDEu
MCwGA1UEAwwlKi5leGVjdXRlLWFwaS51cy13ZXN0LTIuYW1hem9uYXdzLmNvbTCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKXc4g4BPxWXeE1xPFRmNlW+
LDJFtINjQupm0AiIx+MCKa5op40VQfAwxLHp9Ko2bJULxY5VDRFvKi51CG4Qw0sq
z8X56rjsc7obZizHK9LoLegDDBKNWIKq9msG0X0lxR/B4ednHtOUnEywdvfjhYdn
F/4gPOz/l10Cv4NmX8ieArflDia6YvUyqJl5OBtzLtXb/4UmNPgMrhWgY5vTprIY
mwNRPcNqCPKuA+GzrbIPnTz23NL5d+uFgiMD4U6TQbyixwTOG2mVG8Vsxxnf4kFa
XrQ7iMA1hNXupnFGQbWYL1p4Z+enrjmFaQKCvjFiRtIotEU4GFoPiaosyn9uiLsC
AwEAAaOCAv0wggL5MB8GA1UdIwQYMBaAFIG4DmOKiRIY5fo7O1CVn+blkBOFMB0G
A1UdDgQWBBT4+T35zibaHEnRLYQEOo7FUbWWWjAwBgNVHREEKTAngiUqLmV4ZWN1
dGUtYXBpLnVzLXdlc3QtMi5hbWF6b25hd3MuY29tMA4GA1UdDwEB/wQEAwIFoDAd
BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwOwYDVR0fBDQwMjAwoC6gLIYq
aHR0cDovL2NybC5yMm0wMS5hbWF6b250cnVzdC5jb20vcjJtMDEuY3JsMBMGA1Ud
IAQMMAowCAYGZ4EMAQIBMHUGCCsGAQUFBwEBBGkwZzAtBggrBgEFBQcwAYYhaHR0
cDovL29jc3AucjJtMDEuYW1hem9udHJ1c3QuY29tMDYGCCsGAQUFBzAChipodHRw
Oi8vY3J0LnIybTAxLmFtYXpvbnRydXN0LmNvbS9yMm0wMS5jZXIwDAYDVR0TAQH/
BAIwADCCAX0GCisGAQQB1nkCBAIEggFtBIIBaQFnAHYA7s3QZNXbGs7FXLedtM0T
ojKHRny87N7DUUhZRnEftZsAAAGIecmWiAAABAMARzBFAiEAmSbuS88WYdRwtj9R
OAbWnN/tSFbSQaJkTLBR3Il9UxgCIGObn2iXsxytru8Y/mM0BWeEDYmPXq8wikT3
fdFLiQn3AHUASLDja9qmRzQP5WoC+p0w6xxSActW3SyB2bu/qznYhHMAAAGIecmW
xAAABAMARjBEAiBppsQ0pDPZK4toK4RijjS+xdJAw9xeMdTxLa/aTY35QQIgNt4v
t0CoOiQVkb4LJ/QV4l7H28kIdhcz6p/88w6iIFoAdgDatr9rP7W2Ip+bwrtca+hw
kXFsu1GEhTS9pD0wSNf7qwAAAYh5yZaaAAAEAwBHMEUCIBGbbOpGiWOYNK+KcZHb
BtZuE5wixfpjirDYKCWuMCLpAiEAvkVbLmO4Fptg+6oUkjxq8GNE0mU12PlDWWMp
XzP8a9IwDQYJKoZIhvcNAQELBQADggEBAKX4mIRqK6AHTiihSoLPa+gLd7d8bXId
i2+TYI/uQRwpA5caP4jgyKGjilV727jdIkz+CCVgt4h0IDJBPaRkRI18mzH/7Fqe
6KZDEEN1YefGSQg7BLH6ojgKzIWqC6x9S+9Ooe24bCyHI3zl6ChLYN4WddbG3m6U
DiG2GuHJ+rKFpaOkxH0kppEhRzhMH2ysFWp06DxPzo86cWXrEMxMcltgsyfYoxaN
G5WA+0chcFyUCyNWw8TzQd8dTvWEA3aU0kWEqaVr7cd0XjoIf3jpjAAMT3dAqzhf
en7UJKfTyq5VtmTbcejK63yTQ/Dyoo0wAWIocJBamLdu+mEx8M0gxgs=
-----END CERTIFICATE-----
subject=/CN=*.execute-api.us-west-2.amazonaws.com
issuer=/C=US/O=Amazon/CN=Amazon RSA 2048 M01
---
No client certificate CA names sent
Server Temp Key: ECDH, X25519, 253 bits
---
SSL handshake has read 5525 bytes and written 351 bytes
---
New, TLSv1/SSLv3, Cipher is AEAD-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.3
Cipher : AEAD-AES128-GCM-SHA256
Session-ID:
Session-ID-ctx:
Master-Key:
Start Time: 1699498737
Timeout : 7200 (sec)
Verify return code: 0 (ok)
I'm not sure why you are seeing this. I was able to remote sign the other day just fine. Can you try with a newer version of rcodesign perhaps?
I don't have time to test in the next few days but can you try on Windows? I use Windows so maybe that's the issue.
On GitHub Actions I'm running:
The
app/macos/developer-id-application.pem
file contains the public key as described here. Locally I am running:The
developerID_application.cer
file is what I downloaded from Apple as described here and theprivate.pem
file is the private key I created as described here.I get the following error:
The error appears to come from here. It seems like that crate is unmaintained and now (as of a month ago) there is a maintained fork here. Perhaps this feature would fix the situation?
I don't know why this would be happening seemingly to just me since others I assume are successfully using remote signing.
Here is the certificate: