infra: obtain ASF code signing identities for Desktop artifacts

[Astro-Han]

English

Part of #2974 — prerequisite for G9 (#3276).

Outcome

Maka holds the ASF code-signing identities needed to publish Desktop convenience binaries: ASF Apple Developer Program access for macOS and ssl.com eSigner access for Windows, with named Release Managers on each.

Why this is separate

This work consists of INFRA Jira requests and account provisioning, not product code. It has external lead time, cannot be accelerated by adding contributors, and G9 cannot close without it. Tracking it separately keeps that prerequisite visible while the remaining Desktop implementation proceeds.

Current state

• macOS: feat(release): unify Desktop and CLI product releases #3222 proposes a unified .github/workflows/release.yml that still consumes the project’s current Apple credentials and pins FABM2QUA8Q for the standalone CLI. That value has not been established as the ASF Team ID and must not become the final signing authority. The Desktop verifier currently proves only that a signature and notarization are valid, not that they belong to the ASF identity.
• Windows: feat(release): unify Desktop and CLI product releases #3222 continues to build unsigned Windows artifacts, and apps/desktop/electron-builder.config.mjs records that no Authenticode certificate is configured. G9 requires eSigner provisioning and pipeline verification before that release path is complete.

Exit criteria

• The PPMC names one or two Release Managers who will hold the signing credentials.
• An INFRA Jira ticket under the code signing component requests eSigner access for each named Release Manager. Accounts are per-person and may not be shared.
• Each Release Manager creates an Apple ID on their @apache.org address, requests ASF Apple Developer Program membership through INFRA Jira, and records their acceptance of the current Apple Developer Program Agreement.
• Infra confirms the ASF Apple Team ID and the approved CI credential-provisioning method; reviewed repository configuration pins that identity, and both Desktop and standalone CLI verification reject any other Team ID.
• Windows release-candidate builds are signed through eSigner using Infra-approved credential provisioning. Per Infra guidance, sign release candidates only — signing every CI build is a cost to the Foundation.
• The Windows pipeline verifies Authenticode publisher identity and timestamp, and any platform-signature failure blocks the candidate.

Open question for the PPMC and Infra

eSigner accounts are per-person and non-shareable, while automated signing requires the 2FA secret to live in a configuration file. Putting that secret into shared repository secrets means a Release Manager’s personal credential is held by shared CI. ASF documentation does not explicitly approve that GitHub Actions arrangement; ask Infra for the supported provisioning model in the same ticket rather than deciding it locally.

The same ticket should also confirm how Apple Developer ID and notarization credentials may be supplied to the protected GitHub Actions release environment.

Constraints worth stating up front

Apple grants the ASF a fee waiver on the condition that the ASF distributes all involved applications for free.

Platform signatures do not replace the Apache release signature. Every downloadable artifact still needs the detached OpenPGP signature and checksum required by G9, and the source release remains the ASF release.

Out of scope

• Removing bundled Git (Decision needed: where does the Desktop Git runtime come from after we remove bundled Git? #3411) and the rest of the G9 implementation (release: publish ASF-compliant Desktop convenience artifacts #3276).
• Relabeling artifacts already published (release: resolve post-incubation GitHub and npm distribution status #3274).

References

• ASF code signing access
• ASF code signing use
• ASF Apple Developer Program
• ASF release policy

Ownership

Leave unassigned until the PPMC names the Release Managers, since the accounts are issued to specific people.

简体中文

#2974 的一部分——G9（#3276）的前置工作。

目标结果

Maka 取得发布 Desktop convenience binaries 所需的 ASF 代码签名身份：macOS 的 ASF Apple Developer Program 权限，以及 Windows 的 ssl.com eSigner 权限，并为各自指定 Release Manager。

为什么单独跟踪

这项工作是 INFRA Jira 工单和账号开通，不是产品代码。它有外部等待周期，增加人手也无法加速，而 G9 在它完成前不能关闭。单独跟踪可以在继续推进其他 Desktop 实现的同时，清楚展示这个前置依赖。

当前状态

• macOS：feat(release): unify Desktop and CLI product releases #3222 提议的统一 .github/workflows/release.yml 仍使用项目当前的 Apple 凭据，并为 standalone CLI 固定了 FABM2QUA8Q。该值尚未被证明是 ASF Team ID，不能成为最终签名 authority。Desktop verifier 当前只证明签名与公证有效，并未证明它们属于 ASF 身份。
• Windows：feat(release): unify Desktop and CLI product releases #3222 仍构建未签名的 Windows artifacts，apps/desktop/electron-builder.config.mjs 也记录了没有配置 Authenticode 证书。G9 必须取得 eSigner 权限并在流水线中验证签名，才能完成这条发布路径。

完成条件

• PPMC 指定 1～2 名持有签名凭据的 Release Manager。
• 在 INFRA Jira 以 code signing 组件提单，为每位指定的 Release Manager 申请 eSigner 权限。账号按人发放，不可共用。
• 每位 Release Manager 使用 @apache.org 邮箱创建 Apple ID，通过 INFRA Jira 申请加入 ASF Apple Developer Program，并记录其对当前 Apple Developer Program Agreement 的接受。
• Infra 确认 ASF Apple Team ID 和批准的 CI 凭据配置方式；仓库中经过审查的配置固定该身份，Desktop 与 standalone CLI 验证都拒绝其他 Team ID。
• Windows release-candidate 构建通过 eSigner 和 Infra 批准的凭据配置方式签名。依 Infra 指导，只签 release candidate——对每个 CI 构建签名会给基金会带来成本。
• Windows 流水线验证 Authenticode publisher identity 与 timestamp，任何平台签名失败都阻断候选版本。

需要 PPMC 和 Infra 回答的问题

eSigner 账号按人发放且不可共用，而自动签名要求把 2FA secret 写入配置文件。将该 secret 放进共享 repository secrets，意味着某位 Release Manager 的个人凭据由共享 CI 持有。ASF 文档没有明确批准这种 GitHub Actions 安排；应在同一张工单中询问 Infra 支持的配置方式，而不是在项目内自行决定。

同一张工单还应确认 Apple Developer ID 与公证凭据如何提供给受保护的 GitHub Actions release environment。

需要预先说明的约束

Apple 给予 ASF 费用豁免的条件是：ASF 免费分发所有相关应用。

平台签名不能替代 Apache 的发版签名。每个可下载 artifact 仍需要 G9 要求的 detached OpenPGP signature 和 checksum，源码 release 仍然是 ASF release。

不在范围内

• 移除 bundled Git（Decision needed: where does the Desktop Git runtime come from after we remove bundled Git? #3411）以及 G9 的其余实现（release: publish ASF-compliant Desktop convenience artifacts #3276）。
• 对已发布 artifacts 的重新标注（release: resolve post-incubation GitHub and npm distribution status #3274）。

参考资料

• ASF 代码签名权限申请
• ASF eSigner 使用说明
• ASF Apple Developer Program
• ASF 发版政策

负责人边界

在 PPMC 指定 Release Managers 之前保持 unassigned，因为账号发给具体个人。

---

Updated for #3222 from current ASF Infra documentation. Credential, membership, and CI provisioning decisions remain with the PPMC, mentors, and ASF Infra.