From 5bf875a3986c1e8221816c4d7d94cf524d2f6271 Mon Sep 17 00:00:00 2001 From: EMRG Evolution Date: Thu, 6 Aug 2026 11:01:15 +0800 Subject: [PATCH] =?UTF-8?q?emrg:=20=E7=AD=BE=E5=90=8D/=E5=85=AC=E8=AF=81?= =?UTF-8?q?=E9=AA=8C=E8=AF=81=E4=B8=A5=E6=A0=BC=E5=8C=96=20=E2=80=94=20pkg?= =?UTF-8?q?util=20=E5=BC=BA=E5=88=B6=E6=88=90=E5=8A=9F=20+=20notarytool=20?= =?UTF-8?q?--timeout=2020m=EF=BC=88rant=20P3=20=E8=A1=A5=E5=AE=8C=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/build-release.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml index d046447c..ba38843e 100644 --- a/.github/workflows/build-release.yml +++ b/.github/workflows/build-release.yml @@ -135,10 +135,12 @@ jobs: if [ -z "$PKG" ]; then echo "no pkg found, skipping"; exit 0; fi productsign --sign "$MACOS_SIGNING_IDENTITY" "$PKG" "${PKG}.signed" mv "${PKG}.signed" "$PKG" - pkgutil --check-signature "$PKG" || true + # P3 验证：证书存在时签名必须成功（rant 验收：pkgutil 显示 signed by Developer ID） + pkgutil --check-signature "$PKG" # ── pkg 公证（macOS only，P2 后半；Secret 未配则跳过降级）── - # notarytool submit --wait：轮询直至 Accepted/Invalid，失败即非零退出 → CI 失败 + # notarytool submit --wait：轮询直至 Accepted/Invalid，失败即非零退出 → CI 失败。 + # --timeout 20m：设计文档 §4.4 明确要求（默认 10m，Apple 公证排队高峰可能超时） - name: Notarize pkg (macOS only) if: runner.os == 'macOS' && env.APPLE_ID != '' && env.MACOS_NOTARY_APP_PASSWORD != '' && env.MACOS_NOTARY_TEAM_ID != '' shell: bash @@ -149,7 +151,7 @@ jobs: --apple-id "$APPLE_ID" \ --password "$MACOS_NOTARY_APP_PASSWORD" \ --team-id "$MACOS_NOTARY_TEAM_ID" \ - --wait --output-format json + --wait --timeout 20m --output-format json - name: Staple pkg (macOS only) if: runner.os == 'macOS' && env.APPLE_ID != '' && env.MACOS_NOTARY_APP_PASSWORD != '' && env.MACOS_NOTARY_TEAM_ID != ''