Repository navigation
Fix notarization 401 by trimming the ASC key-id and issuer - #7
Merged
Merged
Conversation
With the .p8 now parsed correctly, notarytool reaches Apple and fails with "401 Unauthenticated". The key-id and issuer were interpolated into the notarytool command straight from the environment, so a trailing newline on those Vault secrets -- the same mangling that corrupted the key -- lands inside the JWT kid/iss claims and Apple rejects the request. Strip both values before use in notarize_binaries and connect_api_key, and fail early with a clear message if either still contains internal whitespace after trimming. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
After #6 fixed the PEM parsing, notarization fails one step later:
This is progress —
notarytoolparsed the key, built a signed JWT, and reached Apple. Apple returned 401 (credentials rejected), not 403 (authorized-but-forbidden), which points at the JWT claims: the--key-id(kid) or--issuer(iss).Those were interpolated into the command verbatim:
The
.p8in the same Vault store arrived with mangled newlines (that was #6). The key-id / issuer secrets almost certainly carry the same trailing newline, which becomes part ofkid/iss→ Apple can't match the key → 401.Fix
.stripthe key-id and issuer in bothnotarize_binariesandconnect_api_key.If it still 401s, the values themselves are wrong
Trimming only fixes stray whitespace. If auth still fails, verify the triple directly with a lightweight probe that authenticates and lists history without uploading anything:
AuthKey_<KEYID>.p8filename).🤖 Generated with Claude Code