githubnext/ace2Public

Ace: a collaborative coding environment on the team's own machines

Show desktop release phases and notarization submissions while a build runs

IA

iamnbutler opened ·

An Ace channel that starts a signed desktop build (`bun desktop ci canary`) can't tell which phase the release step is in. It also can't tell whether notarization is still waiting at Apple.

**Observed (Oct 6):** canary run [37538321016](https://github.com/githubnext/ace2/actions/runs/37538321016) at `2ca2160` stopped logging after these lines:

``` 22:10:41 Build complete 22:11:19 compressing tarball … done 22:11:22 Ace Canary.app: replacing existing signature ```

For about 14 minutes there was no output, and `bun desktop ci status` showed only the single grouped step **Build, sign, notarize, and verify** as in progress. The user asked to cancel and retry. The run was cancelled normally, and the retry [37540590863](https://github.com/githubnext/ace2/actions/runs/37540590863) is the only new run.

The cause is unknown. Apple's status page listed no Developer ID Notary Service event, and nothing shows that the source build hung. The likely silent stretch is `notarytool submit --wait --timeout 20m` in `apps/desktop/scripts/release.ts`. It pipes its output and prints the submission id only after it finishes, so a cancelled run leaves no id for `notarytool info` or `notarytool log`.

**Missing:** - **Phase:** which phase is running (build, app signing, app notarization, stapling, DMG, DMG notarization, verify), visible both in the workflow and through `bun desktop ci status`. - **Submission:** each notarization submission's id and time, logged when it is submitted, not only at completion. - **Status:** a way to check a submission's progress while waiting, or after a cancel, without exposing credentials.

Found while preparing the #10 candidate. Dogfooding: #5.

  1. iamnbutlerreferenced this in [Meta] Dogfood Ace end to end #5last month on GitHub

  2. IA
    iamnbutler
    Author

    Confirming evidence from run 37538321016: its cleanup at 22:25:49 logged `Terminate orphan process: pid(12517)(notarytool)`. In `release.ts`, `notarytool submit` runs only after `sign()` returns, `codesign` verification succeeds, and the `ditto` zip completes. That run therefore reached app notarization. It did not hang in codesign. The roughly 14m24s of silence after the last signing line fell inside the configured 20-minute `--wait`. Why it waited is still unknown, and there's no evidence of an Apple outage. The phase of the current retry (37540590863) is likewise unknowable from Ace until it finishes, which is the visibility gap this issue tracks.

  3. iamnbutlerreferenced this in [Meta] Prepare wider desktop distribution #7last month on GitHub

  4. iamnbutlerparent-issue-addedlast month on GitHub

  5. IA
    iamnbutler
    Author

    The retry, [run 37540590863](https://github.com/githubnext/ace2/actions/runs/37540590863), failed at 22:53:24 UTC in app notarization (`release.ts:135` → `notarize`). The app finished signing at 22:33:07. `notarytool` then returned `{"message":"Timeout of 1200 second(s) was reached before processing completed.","id":"697b5f49-4827-4e50-83e2-4e3f80a6ec0d"}`, and the run uploaded no artifact. According to `notarytool submit --help`, the Notary service keeps processing after the `--timeout` is reached. This submission's final status is therefore unknown here and needs a `notarytool info` query by someone with release credentials. Ace showed none of this until the step failed: no phase, no submission id while waiting. The cancelled run (37538321016) logged no submission id, because the output is piped and printed only at completion.

  6. iamnbutlerreferenced this in Verify Ace with two machines on the tailnet #10last month on GitHub