惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

爱范儿
爱范儿
大猫的无限游戏
大猫的无限游戏
J
Java Code Geeks
MongoDB | Blog
MongoDB | Blog
Martin Fowler
Martin Fowler
GbyAI
GbyAI
Microsoft Azure Blog
Microsoft Azure Blog
Recent Announcements
Recent Announcements
F
Fortinet All Blogs
B
Blog
U
Unit 42
B
Blog RSS Feed
D
DataBreaches.Net
Google DeepMind News
Google DeepMind News
人人都是产品经理
人人都是产品经理
腾讯CDC
量子位
酷 壳 – CoolShell
酷 壳 – CoolShell
V
Visual Studio Blog
博客园 - 聂微东
MyScale Blog
MyScale Blog
奇客Solidot–传递最新科技情报
奇客Solidot–传递最新科技情报
博客园 - 三生石上(FineUI控件)
Engineering at Meta
Engineering at Meta

Recent Commits to openclaw:main

test: merge chat side-result checks · openclaw/openclaw@ddd2c2a test: merge cron history checks · openclaw/openclaw@f7eb746 test: merge responsive navigation shell checks · openclaw/openclaw@c2e4b47 docs(changelog): add codex oauth fixes · openclaw/openclaw@628e6cd test: merge navigation routing cases · openclaw/openclaw@5d8cecb Tests: mock channel registry bundled fallback · openclaw/openclaw@2b08233 Secrets: avoid broad web search discovery for single plugin config · openclaw/openclaw@a464f59 test: merge config view browser checks · openclaw/openclaw@20cf511 fix(status): align oauth health with runtime · openclaw/openclaw@eed7116 feat: add macOS screen snapshots for monitor preview (#67954) thanks … · openclaw/openclaw@f377db1 fix: report shared auth scopes in hello-ok (#67810) thanks @BunsDev · openclaw/openclaw@0b6c39b Auto-reply: avoid eager bundled route fallback · openclaw/openclaw@3ea1bf4 Tests: narrow session binding contract setup · openclaw/openclaw@54e4e16 fix(macOS): enable undo/redo in webchat composer text input (#34962) · openclaw/openclaw@00951dc Tests: speed up channel setup promotion · openclaw/openclaw@82b529a Docs: refresh agent instructions · openclaw/openclaw@5775fe2 fix(auth): serialize OAuth refresh across agents to fix #26322 (#67876) · openclaw/openclaw@8e79080 test: allow ollama public surface boundary test · openclaw/openclaw@7d4f1a6 Docs: add test performance guardrails · openclaw/openclaw@89706d3 Tests: restore context-engine usage proof · openclaw/openclaw@e4c4f95 Tests: slim context engine runtime coverage · openclaw/openclaw@74c198f ci: retry failed custom checkouts · openclaw/openclaw@0ee5baf test: trim duplicate provider auth onboarding cases · openclaw/openclaw@1ffc02e matrix: fix sessions_spawn --thread subagent session spawning (#67643) · openclaw/openclaw@1ce2596 test: reduce auth choice fixture churn · openclaw/openclaw@857b9cd test: mock health status config boundaries · openclaw/openclaw@9d5ab4a test: mock onboard config io boundary · openclaw/openclaw@299694d test: mock legacy state plugin boundaries · openclaw/openclaw@2713089 test: mock channel install boundaries · openclaw/openclaw@b945248 test: mock doctor preview channel boundaries · openclaw/openclaw@b1a3ad4
chore(ios): migrate release signing to fastlane match · o...
joshavant · 2026-06-16 · via Recent Commits to openclaw:main

@@ -56,17 +56,17 @@ Prereqs:

5656

- `xcodegen`

5757

- `fastlane`

5858

- Apple account signed into Xcode for the canonical OpenClaw team (`FWJYW4S8P8`)

59-

- `asc` CLI authenticated for the canonical OpenClaw team

60-

- Release-owner access to the encrypted signing repo password (`ASC_MATCH_PASSWORD`)

59+

- Fastlane Apple Developer Portal session for the canonical OpenClaw team when creating bundle IDs or enabling services

60+

- Release-owner access to the encrypted signing repo password (`MATCH_PASSWORD`)

6161

- App Store Connect app already created for `ai.openclawfoundation.app`

62-

- App Store Connect API key set up in Keychain via `scripts/ios-asc-keychain-setup.sh` when auto-resolving a build number or uploading to App Store Connect

62+

- App Store Connect API key set up in Keychain via `scripts/ios-app-store-connect-keychain-setup.sh` when auto-resolving a build number or uploading to App Store Connect

63636464

Release behavior:

65656666

- Local development uses the canonical `ai.openclawfoundation.app*` bundle IDs when the OpenClaw team is available, and unique `ai.openclawfoundation.app.test.*` bundle IDs only for non-canonical fallback teams.

6767

- App Store release uses canonical `ai.openclawfoundation.app*` bundle IDs through a temporary generated xcconfig in `apps/ios/build/AppStoreRelease.xcconfig`.

6868

- App Store release uses manual `Apple Distribution` signing with profile names pinned in `apps/ios/Config/AppStoreSigning.json`.

69-

- `asc` owns one-time Developer Portal setup and encrypted signing sync. Fastlane owns release handling after those assets exist.

69+

- Fastlane owns one-time Developer Portal setup, encrypted `match` signing sync to the repo/branch pinned in `apps/ios/Config/AppStoreSigning.json`, and release handling.

7070

- App Store release also switches the app to `OpenClawPushTransport=relay`, `OpenClawPushDistribution=official`, `OpenClawPushAPNsEnvironment=production`, and a production `aps-environment` entitlement.

7171

- `pnpm ios:release:upload` generates App Store screenshots and uploads release notes before archiving and uploading the IPA.

7272

- `pnpm ios:release` remains a compatibility alias for `pnpm ios:release:upload`; prefer the explicit upload command in new release docs and automation.

@@ -93,16 +93,16 @@ Signing setup commands:

9393

pnpm ios:release:signing:plan

9494

pnpm ios:release:signing:check

9595

pnpm ios:release:signing:setup

96-

ASC_MATCH_PASSWORD=... pnpm ios:release:signing:sync:push

97-

ASC_MATCH_PASSWORD=... pnpm ios:release:signing:sync:pull

96+

MATCH_PASSWORD=... pnpm ios:release:signing:sync:push

97+

MATCH_PASSWORD=... pnpm ios:release:signing:sync:pull

9898

```

9999100100

Release-owner secrets:

101101102102

- App Store Connect API auth uses Keychain for private key material plus non-secret `apps/ios/fastlane/.env` variables.

103-

- The encrypted signing repo password lives outside this repo in the release-owner vault and is exposed locally as `ASC_MATCH_PASSWORD`.

103+

- The encrypted signing repo password lives outside this repo in the release-owner vault and is exposed locally as `MATCH_PASSWORD`.

104104

- Apple Distribution private keys, certificates, provisioning profiles, and decrypted signing sync output stay under `apps/ios/build/` or Keychain and are gitignored.

105-

- Rotating release signing means revoking/replacing the Developer Portal certificate or profile with `asc`, then pushing a fresh encrypted sync state.

105+

- Rotating release signing means refreshing Fastlane `match` assets and pushing a fresh encrypted sync state.

106106107107

Prepare the generated release xcconfig/project without archiving:

108108

@@ -142,13 +142,13 @@ fastlane ios auth_check

142142

2. If auth is missing, bootstrap it once on this Mac:

143143144144

```bash

145-

scripts/ios-asc-keychain-setup.sh \

145+

scripts/ios-app-store-connect-keychain-setup.sh \

146146

--key-path /absolute/path/to/AuthKey_XXXXXXXXXX.p8 \

147147

--issuer-id YOUR_ISSUER_ID \

148148

--write-env

149149

```

150150151-

This should create `apps/ios/fastlane/.env` with the non-secret ASC variables while the private key stays in Keychain.

151+

This should create `apps/ios/fastlane/.env` with non-secret App Store Connect variables while the private key stays in Keychain.

152152153153

3. Confirm the App Store Connect app and Apple Developer identifiers/capabilities exist for:

154154

- `ai.openclawfoundation.app`

@@ -157,7 +157,7 @@ This should create `apps/ios/fastlane/.env` with the non-secret ASC variables wh

157157

- `ai.openclawfoundation.app.watchkitapp`

158158

- `ai.openclawfoundation.app.watchkitapp.extension`

159159160-

Use `pnpm ios:release:signing:setup` for the initial portal setup, then `ASC_MATCH_PASSWORD=... pnpm ios:release:signing:sync:push` to publish encrypted signing assets to the shared private repo.

160+

Use `pnpm ios:release:signing:setup` for the initial portal setup, then `MATCH_PASSWORD=... pnpm ios:release:signing:sync:push` to publish encrypted Fastlane match assets to the shared private repo.

161161162162

4. Optional: set a custom official relay URL for the build. If unset, the release flow uses `https://ios-push-relay.openclaw.ai`.

163163