How can I validate an in-app purchase JWS Representation from StoreKit2 on my backend in Node? Its easy enough to decode the payload, but I can't find public keys that Apple uses to sign these JWS/JWTs anywhere. Any other time I've worked with JWTs, you simply used the node jsonwebtoken library and passed in the signers public key or shared secret key, either configured or fetched from a JWK. I do see the docs about validating the certificate chain in the x5c field but am at a bit of a loss on how to verify that its from Apple. Anyone can create a JWT and sign one. Thank you!

Sometime between Aug 19, 2022 at 3:19pm CA time and Aug 21 at 1:25pm CA time, there seems to have been a change in XCode cloud which made the /usr/local directories unreadable by whatever user is running the ci_post_install.sh script. This makes homebrew basically broken and essentially makes XCode Cloud unusable. The only workaround I can think of is to do a user-only install of homebrew and run the user-only brew commands. However, I'd like to get an answer from Apple on if that is necessary.