From 8c8746cf0827d681aec5f81b859b469387805667 Mon Sep 17 00:00:00 2001
From: Jay Conrod <jay@engflow.com>
Date: Thu, 12 Nov 2026 15:35:31 -0800
Subject: [PATCH] release: remove unused binary signing and notarization code

The certificate is now password-protected, so we can't import it
with an empty password. We never finished implementing binary
signing and notarization, so the certificate was actually unused.

Signed-off-by: Jay Conrod <jay@engflow.com>
---
 .github/workflows/release.yml |  2 --
 infra/release-build.sh        | 49 -----------------------------------
 2 files changed, 51 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 538cca1..b036dc5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,8 +30,6 @@ permissions:
   contents: write
 
 env:
-  # TODO(REC-55): use real certificate.
-  APPLE_CERT_BASE64: ${{ secrets.APPLE_DEV_CERT_BASE64 }}
   # Recommended here: https://github.com/bazelbuild/bazelisk/issues/88#issuecomment-625178467
   BAZELISK_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   CLUSTER_HOST: opal.cluster.engflow.com
diff --git a/infra/release-build.sh b/infra/release-build.sh
index 78bce6b..819abbd 100755
--- a/infra/release-build.sh
+++ b/infra/release-build.sh
@@ -21,56 +21,11 @@ if [[ -z "${OS:-}" ]]; then
   echo >&2 "OS not set"
   exit 1
 fi
-if [[ "${OS}" == 'macos' && -z "${APPLE_CERT_BASE64:-}" ]]; then
-  echo >&2 "APPLE_CERT_BASE64 not set"
-  exit 1
-fi
 if [[ -z "${RELEASE_VERSION:-}" ]]; then
   echo >&2 "RELEASE_VERSION not set"
   exit 1
 fi
 
-APPLE_CERT_ID=
-install_cert () {
-  if [[ "${OS}" != 'macos' ]]; then
-    return
-  fi
-  # Files in $RUNNER_TEMP are automatically removed on completion.
-  local p12_path="${RUNNER_TEMP}/build_certificate.p12"
-  base64 --decode <<<"${APPLE_CERT_BASE64}" >"${p12_path}"
-  local keychain_path="${RUNNER_TEMP}/dev.keychain"
-  security create-keychain -p '' "${keychain_path}"
-  security set-keychain-settings "${keychain_path}"
-  security unlock-keychain -p '' "${keychain_path}"
-  security import "${p12_path}" -P '' -A -t cert -f pkcs12 -k "${keychain_path}"
-  # Allow productsign to access the identity
-  # This prints some info from the keychain, not sure if it's sensitive.
-  security >/dev/null set-key-partition-list -S apple-tool:,apple:,codesign:,productsign: -s -k '' "${keychain_path}"
-  # Overwrite the keychain search list with the new keychain
-  security list-keychain -d user -s "${keychain_path}"
-  local identities_path="${RUNNER_TEMP}/identities.txt"
-  security find-identity -v | tee "${identities_path}"
-  if ! grep --quiet '1 valid identities found' "${identities_path}"; then
-    echo >&2 "did not find exactly 1 identity"
-    return 1
-  fi
-  APPLE_CERT_ID=$(grep --extended-regexp --only '\b[0-9A-F]{40}\b' "${identities_path}")
-  echo >&2 "Installed certificate with identity ${APPLE_CERT_ID}"
-}
-
-uninstall_cert () {
-  if [[ "${OS}" != 'macos' ]]; then
-    return
-  fi
-  security list-keychains -s ~/Library/Keychains/login.keychain
-  security delete-keychain "${RUNNER_TEMP}/dev.keychain"
-}
-
-sign_and_notarize_binary () {
-  # TODO(REC-55): implement signing and notarization for macOS and Windows.
-  return
-}
-
 EXT=
 case "${OS}" in
 macos)
@@ -100,11 +55,7 @@ BUILD_RELEASE_VERSION="${RELEASE_VERSION}" \
     -- \
     "${TARGETS[@]}"
 
-install_cert
-trap uninstall_cert EXIT
-
 for target in "${TARGETS[@]}"; do
   target_file=$(bazel cquery --output=files "${target}")
-  sign_and_notarize_binary "${target_file}"
   cp "${target_file}" "_out/$(basename ${target_file})${EXT}"
 done