From 343cb544d93b22b72f9edc28a7c460d9c04da441 Mon Sep 17 00:00:00 2001
From: enricobuehler <buehler@unom.io>
Date: Fri, 12 Jun 2026 16:01:12 +0000
Subject: [PATCH] =?UTF-8?q?ci(release):=20manual=20Developer=20ID=20export?=
 =?UTF-8?q?=20=E2=80=94=20cloud=20signing=20has=20no=20fallback?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With -allowProvisioningUpdates, exportArchive prefers cloud-managed
Developer ID signing; the App-Manager API key can't ("Cloud signing
permission error") and the valid local identity is never tried.
signingStyle=manual + explicit signingCertificate, cloud flags off
this step (archive keeps them for profile fetch).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .gitea/workflows/release.yml | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index eb34435..18081be 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -139,17 +139,19 @@ jobs:
             <key>method</key><string>developer-id</string>
             <key>teamID</key><string>$TEAM_ID</string>
             <key>destination</key><string>export</string>
+            <!-- Manual + explicit cert: with -allowProvisioningUpdates Xcode prefers
+                 CLOUD-managed Developer ID signing, which the App-Manager-role API key
+                 can't do ("Cloud signing permission error") and it never falls back to
+                 the perfectly valid local identity. -->
+            <key>signingStyle</key><string>manual</string>
+            <key>signingCertificate</key><string>Developer ID Application</string>
           </dict>
           </plist>
           EOF
           DEVELOPER_DIR="$XCODE_DEV_DIR" xcodebuild -exportArchive \
             -archivePath "$RUNNER_TEMP/Punktfunk-macos.xcarchive" \
             -exportOptionsPlist "$RUNNER_TEMP/export-devid.plist" \
-            -exportPath "$RUNNER_TEMP/export-devid" \
-            -allowProvisioningUpdates \
-            -authenticationKeyPath "$RUNNER_TEMP/asc.p8" \
-            -authenticationKeyID "${{ secrets.ASC_API_KEY_ID }}" \
-            -authenticationKeyIssuerID "${{ secrets.ASC_API_ISSUER_ID }}"
+            -exportPath "$RUNNER_TEMP/export-devid"
 
       - name: Notarized DMG
         run: |