From be4cf0e49ae2cc0dc136894a9d823531883bb496 Mon Sep 17 00:00:00 2001
From: jwinterm <johnwmurphy@gmail.com>
Date: Mon, 1 Jun 2026 21:01:38 -0400
Subject: [PATCH] iOS TestFlight: validate .p8 AuthKey before altool upload
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

altool bailed with "Failed to load AuthKey file. (-39) The file ...
does not contain a valid authentication key." — same shape as the
.p12 truncation we hit earlier. The .p8 stored secret is probably
truncated or has stray characters from the original web-UI paste.

Add fail-fast validation right after decoding the .p8 to disk:
prints the first + last lines (just the PEM markers, no key body)
and runs `openssl pkey -in file -noout` to actually parse it. If
either check fails the step bombs immediately with a clear "re-paste
via Gitea API" instruction, saving 30+ seconds before altool fails
the same way with a less useful error.
---
 .github/workflows/build-ios-testflight.yml | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-ios-testflight.yml b/.github/workflows/build-ios-testflight.yml
index 04329ab19..4178eba8b 100644
--- a/.github/workflows/build-ios-testflight.yml
+++ b/.github/workflows/build-ios-testflight.yml
@@ -318,9 +318,29 @@ jobs:
         run: |
           set -e
           mkdir -p "$HOME/.appstoreconnect/private_keys"
-          echo "$APPLE_API_KEY_P8_BASE64" | openssl base64 -d -A > "$HOME/.appstoreconnect/private_keys/AuthKey_${APPLE_KEY_ID}.p8"
+          P8="$HOME/.appstoreconnect/private_keys/AuthKey_${APPLE_KEY_ID}.p8"
+          echo "$APPLE_API_KEY_P8_BASE64" | openssl base64 -d -A > "$P8"
           ls -la "$HOME/.appstoreconnect/private_keys/"
 
+          # Diagnostics — verify the PEM file is well-formed without
+          # printing the private key body. A valid AuthKey .p8 must:
+          #   - Start with "-----BEGIN PRIVATE KEY-----"
+          #   - End with "-----END PRIVATE KEY-----"
+          #   - openssl pkey -in file -noout must succeed (real ASN.1 parse)
+          echo "=== .p8 first/last lines (no key body) ==="
+          head -1 "$P8"
+          tail -1 "$P8"
+          echo "=== openssl parse check (silent on success) ==="
+          if openssl pkey -in "$P8" -noout 2>&1; then
+            echo "OK — .p8 parses as a valid EC private key"
+          else
+            echo "FATAL: .p8 doesn't parse — secret likely truncated or wrong content"
+            echo "Re-paste APPLE_API_KEY_P8_BASE64 via the Gitea API (same flow"
+            echo "as the .p12 re-paste); the file decoded to:"
+            wc -c "$P8"
+            exit 1
+          fi
+
       # ---- Flutter init + codegen + pod install ---------------------------
       - name: Initialize Flutter SDK (iOS precache)
         run: |