From 09a5964788d7e432907e803fed26bc4f20096cba Mon Sep 17 00:00:00 2001 From: argszero Date: Thu, 6 Aug 2026 11:33:21 +0800 Subject: [PATCH 1/2] =?UTF-8?q?emrg:=20=E8=AF=8A=E6=96=AD=20=E2=80=94=20Im?= =?UTF-8?q?port=20signing=20=E5=8A=A0=20p12/keychain=20=E8=AF=8A=E6=96=AD?= =?UTF-8?q?=E8=BE=93=E5=87=BA=EF=BC=88set-key-partition-list=20SecItemCopy?= =?UTF-8?q?Matching=20=E6=A0=B9=E5=9B=A0=E6=8E=92=E6=9F=A5=20R88=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/build-release.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml index 4a1af5c..86baf8c 100644 --- a/.github/workflows/build-release.yml +++ b/.github/workflows/build-release.yml @@ -71,6 +71,12 @@ jobs: security unlock-keychain -p 'ci-temp' /tmp/ci.keychain security import /tmp/signing.p12 -k /tmp/ci.keychain -P "$MACOS_SIGNING_P12_PASSWORD" \ -T /usr/bin/codesign -T /usr/bin/productsign + # ── 诊断（R88：set-key-partition-list SecItemCopyMatching 根因排查）── + echo "=== p12 诊断 ===" + ls -la /tmp/signing.p12 + security find-identity -v -p codesigning /tmp/ci.keychain || true + echo "=== keychain 私钥数量（key class=0x0000000F）===" + security dump-keychain /tmp/ci.keychain 2>&1 | grep -c "class: 0x0000000F" || true # set-key-partition-list 语法：[-S partition-list] [-k password] [match-options] [keychain] # -s = Match keys that can sign（匹配可签名私钥，必须显式提供才能定位项目）； # -S 后跟分区 ID 列表；-k 后跟 keychain 密码。 From fa537a5a882363c7006469a90b505a159c3c2d7f Mon Sep 17 00:00:00 2001 From: argszero Date: Thu, 6 Aug 2026 11:36:09 +0800 Subject: [PATCH 2/2] =?UTF-8?q?emrg:=20macOS=20=E7=AD=BE=E5=90=8D=20import?= =?UTF-8?q?=20=E5=90=8E=E5=8A=A0=E7=A7=81=E9=92=A5=E5=AD=98=E5=9C=A8?= =?UTF-8?q?=E6=80=A7=E6=A3=80=E6=9F=A5=20=E2=80=94=20p12=20=E4=BB=85?= =?UTF-8?q?=E8=AF=81=E4=B9=A6=E9=93=BE=E6=97=B6=E6=98=8E=E7=A1=AE=E6=8A=A5?= =?UTF-8?q?=E9=94=99=EF=BC=88R88=20=E6=A0=B9=E5=9B=A0=E5=AE=9A=E4=BD=8D?= =?UTF-8?q?=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit v0.2.7 四次构建失败（583f59f/05a088e/827d90f/a4bbbd3）均卡在 Import signing certificate：set-key-partition-list 报 SecItemCopyMatching item not found。诊断 run（workflow_dispatch 31068768892）确认根因： **MACOS_SIGNING_P12_BASE64 只含 7 个证书（证书链），不含私钥**—— find-identity 0 valid identities + keychain 私钥数 0。 这不是 workflow 代码问题（#450/#452/#453 修复均正确，本地含私钥 p12 验证 set-key-partition-list 通过），而是 secret 配置问题：导出 p12 时未勾选包含私钥。 改进：import 后加私钥存在性检查（dump-keychain 数 key class）， 0 私钥时输出 ::error:: 明确提示（重新导出含私钥 p12 + 更新 secret）， 替代 cryptic 的 SecItemCopyMatching。 验证：actionlint 全绿（exit 0）。 --- .github/workflows/build-release.yml | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml index 86baf8c..a5c459f 100644 --- a/.github/workflows/build-release.yml +++ b/.github/workflows/build-release.yml @@ -71,12 +71,16 @@ jobs: security unlock-keychain -p 'ci-temp' /tmp/ci.keychain security import /tmp/signing.p12 -k /tmp/ci.keychain -P "$MACOS_SIGNING_P12_PASSWORD" \ -T /usr/bin/codesign -T /usr/bin/productsign - # ── 诊断（R88：set-key-partition-list SecItemCopyMatching 根因排查）── - echo "=== p12 诊断 ===" - ls -la /tmp/signing.p12 - security find-identity -v -p codesigning /tmp/ci.keychain || true - echo "=== keychain 私钥数量（key class=0x0000000F）===" - security dump-keychain /tmp/ci.keychain 2>&1 | grep -c "class: 0x0000000F" || true + # ── 私钥存在性检查（R88 根因：p12 仅证书链无私钥 → SecItemCopyMatching item not found）── + # 有效签名 p12 应报 "1 identity imported"（含私钥）；仅证书链报 "N certificates imported"。 + # find-identity 0 valid + 私钥数 0 → p12 无签名身份，签名必失败，明确报错而非 cryptic 错误。 + KEY_COUNT="$(security dump-keychain /tmp/ci.keychain 2>&1 | grep -c 'class: 0x0000000F' || true)" + IDENTITY_COUNT="$(security find-identity -v -p codesigning /tmp/ci.keychain 2>/dev/null | grep -c 'valid identities found' || true)" + echo "诊断: keychain 私钥数=${KEY_COUNT}, find-identity 输出行数=${IDENTITY_COUNT}" + if [ "$KEY_COUNT" = "0" ]; then + echo "::error::MACOS_SIGNING_P12_BASE64 未包含可签名私钥（import 仅导入证书链，无私钥）。请从钥匙串导出含私钥的 p12：Keychain Access → 右键证书 → 导出 → 格式 p12（勾选包含私钥），然后 base64 更新 GitHub secret。" + exit 1 + fi # set-key-partition-list 语法：[-S partition-list] [-k password] [match-options] [keychain] # -s = Match keys that can sign（匹配可签名私钥，必须显式提供才能定位项目）； # -S 后跟分区 ID 列表；-k 后跟 keychain 密码。