`verification/TK-11230/native-build8/CLOUD-SIGNING.md`

36 lines
# Boomer Calc build 8: signing recovered

The missing local Distribution private key is no longer a blocker. The existing
App Store Connect key and Apple cloud-managed signing exported a valid IPA.
Apple's validate-only check returned zero errors on September 11, 2026.

The successful export used the existing archive and team, automatic signing,
`destination=export`, `method=app-store-connect`, and
`manageAppVersionAndBuildNumber=false`. Authentication used the existing key
file; no key material is stored here. Pass the existing key path, ID and issuer
through xcodebuild's `-authenticationKeyPath`, `-authenticationKeyID` and
`-authenticationKeyIssuerID`, together with `-allowProvisioningUpdates`.

Run xcodebuild with a command-local `PATH=/usr/bin:/bin:/usr/sbin:/sbin`.
Otherwise Apple's rsync can launch the Homebrew rsync server during packaging;
that server rejects `--extended-attributes` and export reports `Copy failed`.
No system-wide PATH change is needed.

The resulting IPA is retained at
`artifacts/TK11230-BoomerCalc-8-cloud-export/App.ipa`. Its SHA-256, bundle
identity, checks, and remaining work are in `cloud-signing-proof.json`.
`apple-validation.json` contains Apple's result. Its one warning concerns the
future Spring 2027 minimum iOS version requirement; validation passed today.

Cloud signing is an authenticated remote signing operation even when exporting
to a local directory. Existing certificate inventory was unchanged. Xcode
created an `AWAITING_UPLOAD` build-upload metadata record; no binary was uploaded
or submitted. Preserve existing review submissions and the GovArbitrage owner's
completed reply. All email sends remain excluded.

Exact-build physical-device verification remains unfinished. Signing success
does not establish native UI behavior or App Review acceptance. Recheck current
App Store Connect build state before any later upload or attachment.

Reference: https://developer.apple.com/videos/play/wwdc2021/10204/