macOS signing keys expire on Jan 23th

[lidel]

• [x] get new keys/certs (.p12)
  • [x] Plan A: try getting new cert using the old setup
  • [ ] Plan B: ipshipyard account setup, including 1password
  • [ ] Apple: create ipshipyard org + keys (for both signing AND notarization)
• [x] switch to new keys in https://github.com/ipfs/distributions
• [x] switch to new keys in https://github.com/ipfs/ipfs-desktop/
• [ ] check if macOS will error on binary signed with expired key, and if so, cut a path release signed with new key

[lidel]

Reached out to PL to see if we can get new cert using old setup, might be faster than creating new org for Shipyard.

Caveat is that only "Account Holder" can generate cert for publishing outside of proprietary Apple Store:

[lidel]

Confirmed signing with new cert works in https://github.com/ipfs/ipfs-desktop/pull/2735#issuecomment-1900796898. Will now do a smoke-test release of ipfs-desktop which has additional step of Notarization after Signing. Notarization uses different credentials, which afaik do not expire, but let's make sure things work ok together end-to-end.

Will do IPFS Desktop release on Monday (we don't ship things on Friday).

[lidel]

Kubo v0.26 and IPFS Desktop v0.33 both got signed and Notarized correctly.

New certs for signing are valid until 2027 – closing this one.

IP Shipyard will switch to new Apple Dev Org later this year, but no longer a P0 priority.