feat(release): resolve Sparkle keys from 1Password

[steipete]

Summary

• add optional 1Password reference resolution for headless Sparkle EdDSA signing
• keep private-key material in mode-0600 temporary files, verify it against the embedded public key, and clean it on success or failure
• keep credential locators out of status output and use generic public fixtures and documentation

Proof

• bash -n skills/release-mac-app/scripts/lib/mac_release.sh skills/release-mac-app/scripts/mac-release skills/release-mac-app/scripts/mac-release.test.sh
• skills/release-mac-app/scripts/mac-release.test.sh
• shellcheck skills/release-mac-app/scripts/lib/mac_release.sh skills/release-mac-app/scripts/mac-release.test.sh
• scripts/validate-skills
• Codex autoreview against origin/main: clean, with no accepted/actionable findings

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 13, 2026, 10:00 PM ET / August 14, 2026, 02:00 UTC.

ClawSweeper review

What this changes

This PR adds optional 1Password reference resolution for headless Sparkle EdDSA signing, using a temporary validated key file.

Merge readiness

⚠️ Ready for maintainer review - 4 items remain

Keep open for explicit owner review: this is an OWNER-authored, security-sensitive release change, and the read-only inspection environment failed before current source, history, and policy could be verified.

Priority: P2
Reviewed head: db2acffebfadd96012788f7a047f6c96a94b60c3
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The stated validation is promising, but review confidence is limited because the required read-only source inspection did not start.
Proof confidence	🌊 off-meta tidepool	Not applicable: This OWNER-authored PR is outside the external-contributor proof gate; its listed automated checks are useful supplemental evidence, though their output was not available to this reviewer.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This OWNER-authored PR is outside the external-contributor proof gate; its listed automated checks are useful supplemental evidence, though their output was not available to this reviewer.
Evidence reviewed	3 items	Owner-authored PR: The supplied GitHub context identifies steipete as both PR author and repository OWNER; owner-authored items require explicit maintainer handling. Security-sensitive scope: The supplied PR diff changes 1Password retrieval and temporary private-key handling in the macOS release helper. Inspection infrastructure failure: The required read-only repository inspection could not start: the sandbox returned bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted; no local source, AGENTS.md, history, or release provenance was inspected.
Findings	None	None.
Security	Needs attention	Verify temporary signing-key containment: The supplied diff introduces 1Password key resolution and temporary private-key files; permissions, cleanup, inherited environment, and error/log redaction need source-level verification before merge.

How this fits together

The macOS release skill collects signing credentials and drives Sparkle appcast signing. The new path accepts a 1Password reference and supplies the resolved key to the release helper.

flowchart LR
  A[Release settings] --> B[Credential resolver]
  C[1Password reference] --> B
  B --> D[Temporary key file]
  D --> E[Public-key validation]
  E --> F[Sparkle signing]

Loading

Decision needed

Question	Recommendation
Does the project owner approve the 1Password-backed Sparkle key flow after verifying its temporary-file lifecycle, cleanup, and redaction behavior in the actual helper?	Review and approve the credential boundary: Verify permissions, cleanup, validation, and log redaction in the helper before merging.

Why: The PR introduces a credential-resolution path for a private release-signing key, and the required source inspection was blocked by the review sandbox.

Before merge

• Resolve security concern: Verify temporary signing-key containment - The supplied diff introduces 1Password key resolution and temporary private-key files; permissions, cleanup, inherited environment, and error/log redaction need source-level verification before merge.
• Resolve merge risk (P1) - Merging changes that resolve and materialize a private signing key needs a focused human check of file permissions, cleanup on every exit path, command/log redaction, and 1Password account selection; that check could not be completed in this environment.
• Complete next step (P2) - A human owner must review the new credential boundary because repository inspection was unavailable.

Findings

• [medium] Verify temporary signing-key containment

Agent review details

Security

Needs attention: The change handles a private release-signing key, but the source-level security pass could not be completed after the inspection sandbox failed.

Review metrics

Metric	Value	Why it matters
Patch surface	4 files, +267 / -30 lines	Most of the patch is release-helper and test logic around private-key resolution, so lifecycle review matters more than the small documentation updates.

Merge-risk options

Maintainer options:

1. Verify private-key handling before merge (recommended)
   Inspect the real helper paths to confirm that a resolved key cannot leak through files, child environments, command lines, or error logs and is removed on all exits.
2. Pause the credential-source expansion
   Defer this optional 1Password integration if that security-boundary review cannot be completed now.

Technical review

Best possible solution:

Have the project owner complete a focused source review of the temporary-key lifecycle and redaction boundaries, then retain the existing documented local and Keychain fallback behavior.

Do we have a high-confidence way to reproduce the issue?

Not applicable as an issue reproduction; the supplied PR body lists shell and skill checks, but the reviewer could not inspect or execute the source path because the read-only sandbox failed.

Is this the best way to solve the issue?

Unclear: the proposed 1Password path may be appropriate, but a source-level security review is needed to establish that it is the safest maintainable implementation.

AGENTS.md: unclear because the file could not be read completely.

Codex review notes: model internal, reasoning high; reviewed against 7d58adec76c8.

Labels

Label changes:

• add P2: This is an optional release-signing workflow change with limited blast radius but credential-handling implications.
• add merge-risk: 🚨 security-boundary: The PR resolves a private signing key from 1Password and writes it to a temporary file for downstream signing tools.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This OWNER-authored PR is outside the external-contributor proof gate; its listed automated checks are useful supplemental evidence, though their output was not available to this reviewer.

Label justifications:

• P2: This is an optional release-signing workflow change with limited blast radius but credential-handling implications.
• merge-risk: 🚨 security-boundary: The PR resolves a private signing key from 1Password and writes it to a temporary file for downstream signing tools.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This OWNER-authored PR is outside the external-contributor proof gate; its listed automated checks are useful supplemental evidence, though their output was not available to this reviewer.

Evidence

Security concerns:

• [medium] Verify temporary signing-key containment
  The supplied diff introduces 1Password key resolution and temporary private-key files; permissions, cleanup, inherited environment, and error/log redaction need source-level verification before merge.
  Confidence: 0.83

What I checked:

• Owner-authored PR: The supplied GitHub context identifies steipete as both PR author and repository OWNER; owner-authored items require explicit maintainer handling. (db2acffebfad)
• Security-sensitive scope: The supplied PR diff changes 1Password retrieval and temporary private-key handling in the macOS release helper. (skills/release-mac-app/scripts/lib/mac_release.sh, db2acffebfad)
• Inspection infrastructure failure: The required read-only repository inspection could not start: the sandbox returned bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted; no local source, AGENTS.md, history, or release provenance was inspected.

Likely related people:

• steipete: The supplied PR metadata identifies steipete as repository OWNER and author of all three commits in this release-helper change; local feature history could not be inspected. (role: project owner and release-helper contributor; confidence: medium; commits: 4681b8997955, a52e05f59e6f, db2acffebfad; files: skills/release-mac-app/scripts/lib/mac_release.sh, skills/release-mac-app/SKILL.md)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Complete a focused human review of the temporary-key lifecycle and redaction paths before merge.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.