From 852e999a82ea5aab1d191f5e6eebf57907bbf6cf Mon Sep 17 00:00:00 2001
From: Dr Alexander Mikhalev <alex@metacortex.engineer>
Date: Tue, 15 Sep 2026 19:19:21 +0100
Subject: [PATCH] fix(ci): validate legacy Apple PKCS12 bundle

---
 .github/workflows/migrate-release-secrets.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/migrate-release-secrets.yml b/.github/workflows/migrate-release-secrets.yml
index 37ed836..4305d6c 100644
--- a/.github/workflows/migrate-release-secrets.yml
+++ b/.github/workflows/migrate-release-secrets.yml
@@ -77,8 +77,11 @@ jobs:
             exit 1
           }
           export CERT_PASSWORD
+          # The existing Apple Developer ID certificate is a legacy PKCS#12
+          # bundle. OpenSSL 3 requires its legacy provider to read RC2-40-CBC.
           printf '%s' "$CERT_BASE64" | base64 --decode |
-            openssl pkcs12 -in /dev/stdin -passin env:CERT_PASSWORD -noout
+            openssl pkcs12 -legacy -in /dev/stdin \
+              -passin env:CERT_PASSWORD -noout
 
           copy_secret() {
             local name="$1"